I85PREP
⌘ K
CCSP study materials
CCSP study resources

CCSP practice questions

One question at a time. Build your CCSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts, Architecture and Design

Which characteristic allows cloud resources to be scaled outward and inward automatically in response to demand?

  1. Rapid elasticity Correct answer.
  2. Dedicated hosting
  3. Manual provisioning
  4. Single tenancy

Explanation

Rapid elasticity is an essential cloud characteristic in which resources can be provisioned and released automatically to match demand. Dedicated hosting, manual provisioning, and single tenancy describe the opposite of pooled, elastic cloud behavior.

Question 2Cloud Concepts, Architecture and Design

In which service model does the provider manage the runtime, middleware, and operating system while the consumer deploys applications?

  1. SaaS
  2. PaaS Correct answer.
  3. Colocation
  4. IaaS

Explanation

Platform as a Service provides a managed runtime and middleware environment in which consumers deploy their applications. The provider manages the underlying platform, while the consumer focuses on application code and configuration.

Question 3Cloud Concepts, Architecture and Design

Which deployment model provisions infrastructure for exclusive use by a single organization?

  1. Hybrid cloud
  2. Public cloud
  3. Private cloud Correct answer.
  4. Community cloud

Explanation

A private cloud is provisioned for exclusive use by a single organization, whether managed internally or by a third party. Community, public, and hybrid models involve shared or combined infrastructure arrangements.

Question 4Cloud Concepts, Architecture and Design

What does the measured-service characteristic require?

  1. Manual approval for each request
  2. Flat fee regardless of consumption
  3. Metered pay-per-use billing Correct answer.
  4. Unlimited unmetered resource use

Explanation

Measured service means the provider automatically meters resource usage and bills consumers according to consumption. This transparency supports pay-per-use pricing and capacity planning.

Question 5Cloud Concepts, Architecture and Design

Which service model gives the consumer the greatest control over operating systems and runtime configuration?

  1. PaaS
  2. IaaS Correct answer.
  3. SaaS
  4. Serverless

Explanation

IaaS provides virtualized compute, storage, and networking on which consumers install and manage their own operating systems and runtimes. PaaS, SaaS, and serverless abstract more of the underlying platform from the consumer.

Question 6Cloud Concepts, Architecture and Design

In SaaS, what is the consumer typically responsible for?

  1. Managing user access and data Correct answer.
  2. Maintaining the runtime engine
  3. Configuring the physical network
  4. Patching the hypervisor

Explanation

In SaaS the provider manages the application, runtime, middleware, operating system, and infrastructure. The consumer remains responsible for appropriate use, such as managing user access and protecting its data.

Question 7Cloud Concepts, Architecture and Design

Which deployment model is shared by organizations with common compliance requirements?

  1. Hybrid cloud
  2. Public multi-tenant cloud
  3. Private cloud
  4. Community cloud Correct answer.

Explanation

A community cloud is shared by several organizations that have common concerns such as compliance, security, or mission requirements. It differs from public, private, and hybrid models in its shared purpose and governance.

Question 8Cloud Concepts, Architecture and Design

What does multitenancy in cloud computing mean?

  1. A single customer uses all provider resources
  2. Resources are dedicated to one department
  3. Each customer receives a physically separate data center
  4. Consumers share pooled resources with logical isolation Correct answer.

Explanation

Multitenancy means multiple consumers share pooled provider resources while logical controls keep their workloads and data isolated. Physical separation is not required for multitenancy.

Question 9Cloud Concepts, Architecture and Design

In the NIST cloud reference architecture, which actor uses services provided by a cloud provider?

  1. Cloud service broker
  2. Cloud auditor
  3. Cloud carrier
  4. Cloud consumer Correct answer.

Explanation

The cloud consumer is the actor that uses services provided by a cloud provider. Auditors assess controls, carriers provide connectivity, and brokers aggregate or intermediate services.

Question 10Cloud Concepts, Architecture and Design

What is the primary role of a cloud auditor?

  1. Aggregating services from multiple providers
  2. Negotiating service contracts with providers
  3. Independently assessing controls Correct answer.
  4. Providing physical network connectivity

Explanation

A cloud auditor performs independent examination of controls, such as security, privacy, and performance, against an agreed standard. This independence distinguishes auditing from contract negotiation or service brokerage.

Question 11Cloud Concepts, Architecture and Design

Which item is a shared consideration that organizations must address regardless of cloud deployment model?

  1. Data center power redundancy
  2. Legal and compliance needs Correct answer.
  3. Physical cage access log review
  4. Hypervisor patch management cadence

Explanation

Shared considerations such as legal, compliance, governance, and audit requirements apply across deployment models and must be addressed by the consumer. Hypervisor patching, physical access logs, and power redundancy are provider-specific operational controls.

Question 12Cloud Concepts, Architecture and Design

Which practice best reduces cloud vendor lock-in?

  1. Storing data only in proprietary formats
  2. Using provider-specific APIs for all integrations
  3. Using open standards and portable formats Correct answer.
  4. Consolidating all workloads with one provider

Explanation

Lock-in decreases when workloads, data, and interfaces are portable across providers. Open standards and portable formats make migration and exit planning more feasible.

Question 13Cloud Concepts, Architecture and Design

Which function is typical of a cloud access security broker (CASB)?

  1. Providing physical interconnection between data centers
  2. Enforcing policy and visibility over cloud service usage Correct answer.
  3. Managing the hypervisor layer
  4. Issuing public TLS certificates

Explanation

A CASB sits between users and cloud services to provide visibility and policy enforcement over cloud usage. It helps discover shadow IT, control data movement, and apply security policies.

Question 14Cloud Concepts, Architecture and Design

Which control best mitigates data remanence when cloud storage media is reused?

  1. Using shared administrator accounts
  2. Disabling audit logging entirely
  3. Increasing network bandwidth capacity
  4. Cryptographic erasure of keys Correct answer.

Explanation

Cryptographic erasure makes encrypted data unrecoverable by destroying the keys needed to decrypt it, which is effective when physical media cannot be sanitized directly. It addresses remanence risk in shared cloud storage.

Question 15Cloud Concepts, Architecture and Design

Which design principle reduces risk from a provider-side key compromise?

  1. Storing provider-managed keys in plaintext
  2. Using one global key for all tenants
  3. Disabling all key rotation
  4. Customer-controlled keys Correct answer.

Explanation

Customer-controlled keys, including bring-your-own-key or hold-your-own-key models, reduce exposure when the provider's key management is compromised. The consumer retains control over key lifecycle and access.

Question 16Cloud Concepts, Architecture and Design

What is a primary benefit of identity federation in cloud environments?

  1. Storing user credentials in plaintext
  2. Eliminating the need for authentication
  3. Single sign-on across trusted domains Correct answer.
  4. Removing the need for authorization policies

Explanation

Identity federation allows trusted domains to exchange authentication assertions, enabling single sign-on and reducing credential sprawl. Authentication and authorization still occur; federation changes how trust is established.

Question 17Cloud Concepts, Architecture and Design

An organization wants to keep regulated data on-premises while using public cloud for burst capacity. Which deployment model fits?

  1. Public cloud
  2. Hybrid cloud Correct answer.
  3. Private cloud
  4. Community cloud

Explanation

A hybrid cloud combines two or more distinct deployment models, such as on-premises private infrastructure and public cloud, while enabling data and application portability. This supports keeping regulated data local while using public cloud for additional capacity.

Question 18Cloud Concepts, Architecture and Design

Which feature distinguishes cloud computing from traditional service-oriented architecture?

  1. Reuse of service components
  2. Use of standard web services
  3. Loose coupling of services
  4. Elastic self-service Correct answer.

Explanation

Cloud computing adds on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service to service-oriented concepts. SOA principles such as web services, reuse, and loose coupling can exist without cloud elasticity.

Question 19Cloud Concepts, Architecture and Design

Which risk is most specific to virtualization in cloud environments?

  1. Hypervisor VM escape Correct answer.
  2. Physical storage media theft
  3. DNS cache poisoning attacks
  4. Credential password spraying

Explanation

Virtualization introduces the hypervisor as a critical layer; a hypervisor compromise can allow an attacker to escape a virtual machine and affect other tenants. Physical theft, password spraying, and DNS attacks are broader threats not specific to virtualization.

Question 20Cloud Concepts, Architecture and Design

What is the primary purpose of an API gateway in cloud architecture?

  1. Managing physical network cabling and racks
  2. Providing block storage encryption at rest
  3. Centralizing API auth and routing Correct answer.
  4. Replacing all identity provider services

Explanation

An API gateway centralizes common API concerns such as authentication, authorization, throttling, and routing to backend services. It does not replace identity providers or handle physical infrastructure.

Question 21Cloud Concepts, Architecture and Design

Which actor in the cloud reference architecture provides the connectivity between consumers and providers?

  1. Cloud carrier Correct answer.
  2. Cloud broker
  3. Cloud auditor
  4. Cloud consumer

Explanation

The cloud carrier provides the network connectivity that transports services between cloud providers and consumers. Brokers intermediate services, auditors assess controls, and consumers use services.

Question 22Cloud Concepts, Architecture and Design

A company must ensure data remains within a specific country and wants a provider-managed environment. Which factor should drive provider selection?

  1. Lowest headline compute price only
  2. Largest number of global regions
  3. Data residency and audit evidence Correct answer.
  4. Provider brand and marketing presence

Explanation

Data residency requirements are met through contractual commitments, region design, and supporting audit evidence. Price, brand, or global footprint do not demonstrate that data will remain within the required jurisdiction.

Question 23Cloud Concepts, Architecture and Design

Which combination best applies least privilege in a cloud IAM design?

  1. Granting broad admin roles to simplify operations
  2. Scoped roles and separation of duties Correct answer.
  3. Disabling logging for privileged actions
  4. Sharing one privileged account across all teams

Explanation

Least privilege limits permissions to those required for a role and separates conflicting duties to reduce abuse. Broad admin roles, shared privileged accounts, and disabled logging all violate least-privilege and accountability principles.

Question 24Cloud Concepts, Architecture and Design

Which artifact best provides independent assurance about a cloud provider's security controls over time?

  1. A list of data center locations
  2. A self-attested security questionnaire
  3. Provider's marketing brochure
  4. A SOC 2 Type II report Correct answer.

Explanation

A SOC 2 Type II report provides independent auditor testing of controls over an extended period. Marketing materials, self-attestations, and location lists do not offer independent evidence of control operation.

Question 25Cloud Concepts, Architecture and Design

Which control most directly mitigates the risk of insecure cloud APIs?

  1. Increasing available storage capacity
  2. Auth, input validation, rate limiting Correct answer.
  3. Disabling TLS to reduce network latency
  4. Using one shared API key for all clients

Explanation

API security depends on strong authentication, rigorous input validation, and rate limiting to prevent unauthorized access and abuse. Capacity changes, shared keys, and disabled TLS do not address API weaknesses and may worsen them.

Question 26Cloud Concepts, Architecture and Design

Which cloud service model provides a managed runtime and middleware so that the consumer can deploy applications without managing the underlying operating system?

  1. Software as a Service
  2. Infrastructure as a Service
  3. Desktop as a Service
  4. Platform as a Service Correct answer.

Explanation

In Platform as a Service, the provider manages the infrastructure, operating system, and runtime, while the consumer focuses on deploying and configuring applications. Infrastructure as a Service leaves operating system management with the consumer, and Software as a Service delivers a completed application rather than an application platform.

Question 27Cloud Concepts, Architecture and Design

A web application automatically adds compute instances when traffic increases and removes them when traffic falls. Which essential cloud characteristic does this illustrate?

  1. Broad network access
  2. Rapid elasticity Correct answer.
  3. Resource pooling
  4. Measured service

Explanation

Rapid elasticity describes the ability to scale resources outward and inward automatically in response to demand. Measured service concerns metering and billing, while resource pooling concerns sharing physical capacity among consumers.

Question 28Cloud Concepts, Architecture and Design

Migrating from an owned data center to public cloud primarily changes which financial characteristic?

  1. OpEx becomes CapEx
  2. CapEx becomes variable OpEx Correct answer.
  3. Variable costs become fixed costs
  4. Direct costs become shared costs

Explanation

Public cloud commonly shifts large upfront investment in facilities and hardware from capital expenditure to usage-based operating expenditure. This aligns cost more closely with consumption, though it does not by itself eliminate fixed costs or shared-cost allocations.

Question 29Cloud Concepts, Architecture and Design

Which NIST cloud reference architecture actor negotiates relationships between providers and consumers and may aggregate or enhance services?

  1. Cloud carrier
  2. Cloud broker Correct answer.
  3. Cloud consumer
  4. Cloud auditor

Explanation

A cloud broker acts between providers and consumers, managing service use and negotiating relationships, and may aggregate or add value to services from multiple providers. The carrier provides connectivity, the consumer uses services, and the auditor performs independent assessment.

Question 30Cloud Concepts, Architecture and Design

An application must store millions of large, immutable backup files and retrieve them by unique identifier. Which storage type is the best fit?

  1. File storage
  2. Relational database
  3. Object storage Correct answer.
  4. Block storage

Explanation

Object storage is designed for large volumes of unstructured data accessed by key, with metadata and high durability at scale. It suits backups and media better than block or file storage, which are organized for volumes or directory hierarchies.

Question 31Cloud Concepts, Architecture and Design

Which design choice most directly improves availability if an entire cloud region becomes unavailable?

  1. Adding more application servers in the same region
  2. Adding a content delivery network for static assets
  3. Deploying across regions with automated failover Correct answer.
  4. Increasing the size of the primary database instance

Explanation

A regional outage can affect all resources in that region, so resilience requires duplication and failover in a separate region. Scaling within one region or caching static content does not protect against loss of the entire region.

Question 32Cloud Concepts, Architecture and Design

Which approach packages an application and its dependencies into a portable unit that runs consistently across cloud environments?

  1. Virtual machine snapshot
  2. Serverless function
  3. Configuration management script
  4. Container image Correct answer.

Explanation

A container image bundles the application with its libraries and runtime dependencies, enabling consistent execution on any compatible container platform. Virtual machine snapshots capture an entire machine state and are less portable, while configuration scripts do not package the application runtime.

Question 33Cloud Concepts, Architecture and Design

An enterprise wants to reduce risk if a cloud provider suddenly terminates service. Which contract and architecture provision is most directly relevant?

  1. A service level agreement with 99.9 percent uptime
  2. A right-to-audit clause
  3. A documented exit plan with data export formats Correct answer.
  4. A data classification policy

Explanation

Provider exit risk is addressed through a documented exit strategy that specifies how data is exported, in what format, and what transition assistance is available. Availability commitments and audit rights address different risks and do not ensure recoverability of data or workloads.

Question 34Cloud Concepts, Architecture and Design

Which architecture decision best limits the impact of a compromised virtual machine in a public cloud environment?

  1. Using one shared administrator account for all workloads
  2. Encrypting each virtual machine disk with a provider key
  3. Segmenting workloads with least-privilege access Correct answer.
  4. Assigning public IP addresses to all workloads

Explanation

Network segmentation and least-privilege permissions restrict how far an attacker can move from a compromised workload. Encryption at rest protects stored data in some scenarios but does not by itself contain lateral movement or privilege abuse.

Question 35Cloud Data Security

What is the primary purpose of classifying cloud data?

  1. To drive handling and protection controls based on sensitivity Correct answer.
  2. To eliminate the need for encryption at rest
  3. To enable the use of multiple cloud providers simultaneously
  4. To reduce the storage and egress costs charged by the cloud provider

Explanation

Classification determines how data must be handled, who may access it, what encryption and monitoring apply, and how long it is retained. It is a governance control, not a cost or multi-cloud feature.

Question 36Cloud Data Security

In the cloud data lifecycle, which stage immediately follows 'store'?

  1. Archive
  2. Create
  3. Destroy
  4. Use Correct answer.

Explanation

The common cloud data lifecycle sequence is create, store, use, share, archive, and destroy. After data is stored, it is used by applications and users.

Question 37Cloud Data Security

Which protocol should be used to protect data in transit between a user and a cloud service?

  1. Telnet
  2. TLS Correct answer.
  3. FTP
  4. SNMP

Explanation

TLS provides encrypted and integrity-protected transport for web and API traffic. FTP, Telnet, and SNMP do not provide the same transport protection by default.

Question 38Cloud Data Security

What does data loss prevention (DLP) primarily do?

  1. Compresses data before archiving to reduce storage cost
  2. Encrypts data at rest using customer-managed keys
  3. Detects and blocks sensitive-data exfiltration Correct answer.
  4. Backs up data to a secondary region and validates restore

Explanation

DLP inspects content and context to identify sensitive data and then alerts on or blocks unauthorized movement. Backup, encryption, and compression are separate controls.

Question 39Cloud Data Security

Which tool capability helps an organization find sensitive data stored across cloud services?

  1. Virtual private network gateway service
  2. Sensitive-data discovery scanning Correct answer.
  3. Global load balancer
  4. Web application firewall policy

Explanation

Discovery and classification tools scan cloud storage and SaaS repositories to locate sensitive data and label it for protection. Network and load-balancing services do not inspect stored content.

Question 40Cloud Data Security

Which control protects data at rest in cloud object storage?

  1. Server-side encryption Correct answer.
  2. Port security on the virtual switch
  3. TLS termination at the load balancer
  4. DNSSEC validation for the zone

Explanation

Server-side encryption protects objects at rest by encrypting them with provider-managed or customer-managed keys. The other controls protect network transport or name resolution.

Question 41Cloud Data Security

What is the role of a data retention policy?

  1. To define how data is encrypted at rest
  2. To set retention periods and destruction triggers Correct answer.
  3. To define how data is replicated across regions
  4. To define which users and groups can access the data

Explanation

A retention policy specifies how long each data category must be kept and what event or date triggers destruction. Access control, encryption, and replication are separate policies.

Question 42Cloud Data Security

What does data sovereignty mean?

  1. Data can be freely moved across any border
  2. Data is stored only in the cloud provider's headquarters country
  3. Stored data is subject to the laws of the host country Correct answer.
  4. Data is always encrypted with a customer-managed key

Explanation

Data sovereignty holds that data stored in a country is subject to that country's laws and regulations. It is distinct from encryption key ownership and from unrestricted data movement.

Question 43Cloud Data Security

A payment processor replaces card numbers with tokens, and the token vault is the only place the mapping exists. Which statement best describes the security benefit?

  1. The token preserves the original card number's mathematical properties
  2. Compromise of the token store does not expose the original card numbers Correct answer.
  3. Tokenization is reversible encryption with the same key
  4. Tokenization eliminates the need to secure the token vault

Explanation

Tokenization substitutes a surrogate value for the sensitive data, and the original value is retrievable only through the protected vault. The token itself has no mathematical relationship to the original value.

Question 44Cloud Data Security

A cloud application encrypts each object with a unique data encryption key (DEK), and the DEK is encrypted by a key encryption key (KEK) in a KMS. What is the main advantage?

  1. It makes the key encryption key unnecessary for decryption
  2. It stores the data key in plaintext alongside the object
  3. It limits exposure per key and simplifies rotation Correct answer.
  4. It removes the need to rotate data encryption keys

Explanation

Envelope encryption means each object is protected by a distinct DEK, so compromise or rotation affects a smaller data set. The KEK remains protected in the KMS and is used to wrap and unwrap DEKs.

Question 45Cloud Data Security

An organization must destroy data stored across immutable backups. Which approach best supports timely destruction when physical media cannot be erased?

  1. Deleting the object metadata only
  2. Overwriting each object individually through the API
  3. Destroying the keys that protect the data Correct answer.
  4. Moving the data to a colder storage tier

Explanation

Cryptographic erasure destroys the keys needed to decrypt the data, rendering the remaining ciphertext unrecoverable. This approach works even when immutable copies cannot be physically overwritten.

Question 46Cloud Data Security

Why should encryption keys be rotated periodically?

  1. To make ciphertext smaller
  2. To eliminate the need for access controls on the KMS
  3. To limit the data exposed by any single compromised key Correct answer.
  4. To increase the encryption algorithm's key length automatically

Explanation

Rotation reduces the volume of data protected by a given key and limits the blast radius of a key compromise. It does not change algorithm key length, remove access controls, or shrink ciphertext.

Question 47Cloud Data Security

Which requirement most strongly justifies using a hardware security module (HSM) for cloud key management?

  1. The need to store large volumes of encrypted user data inside the HSM
  2. FIPS-validated crypto with tamper-resistant key storage Correct answer.
  3. The need to reduce network latency for database queries
  4. The need to eliminate key rotation

Explanation

HSMs provide tamper-resistant hardware and validated cryptographic operations for key generation and storage. They are not bulk data stores, latency reducers, or a replacement for rotation.

Question 48Cloud Data Security

Which technique is most appropriate for providing developers with realistic-looking but non-sensitive production data?

  1. Static masking or synthetic data generation Correct answer.
  2. Encrypting the production database with a KEK
  3. Storing the data in a public bucket
  4. Using TLS for database connections

Explanation

Static masking or synthetic data generation replaces sensitive values with realistic but non-sensitive substitutes for non-production use. Encryption and TLS protect the original data but do not de-sensitize it.

Question 49Cloud Data Security

A CASB in inline mode is deployed between users and SaaS applications. What primary capability does this provide?

  1. It guarantees data residency in a single country
  2. It enforces DLP and access policy on cloud traffic Correct answer.
  3. It replaces the need for identity providers
  4. It encrypts all data at rest in the SaaS provider's data center

Explanation

An inline CASB can inspect traffic to cloud services and enforce policy, including DLP and access restrictions. It does not encrypt the provider's stored data, replace identity providers, or by itself guarantee residency.

Question 50Cloud Data Security

A legal hold is placed on data. What must the organization do?

  1. Move the data to an archive tier immediately
  2. Preserve the data and suspend normal deletion Correct answer.
  3. Encrypt the data with a new key
  4. Delete the data according to the retention schedule

Explanation

A legal hold overrides routine retention and destruction schedules until the hold is released. The data must be preserved in a form that can be produced for litigation or investigation.