I85PREP
⌘ K
CSPCC study materials
CSPCC study resources

CSPCC practice questions

One question at a time. Build your CSPCC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Architecture Concepts and Design

A solution architect is documenting how a cloud provider's responsibility for physical security differs from the tenant's responsibility for guest OS patching. Which cloud architecture concept is being documented?

  1. The chargeback model
  2. The fault tolerance model
  3. The shared responsibility model Correct answer.
  4. The multi-tenancy model

Explanation

The shared responsibility model divides security and operational duties between the provider and the customer. Physical facility controls belong to the provider, while patching the guest operating system typically belongs to the tenant.

Question 2Cloud Architecture Concepts and Design

An application must remain available even if an entire data center loses power. Which design principle most directly addresses this requirement?

  1. Enabling detailed application logging
  2. Purchasing reserved capacity in one zone
  3. Deploying across multiple availability zones Correct answer.
  4. Increasing the size of a single virtual machine

Explanation

Availability zones are isolated physical locations within a region, so spreading workloads across zones removes a single data center as a failure domain. A single machine, regardless of size, still fails when its host facility fails.

Question 3Cloud Architecture Concepts and Design

A team needs storage for infrequently accessed compliance archives that must be retrievable within minutes and retained for seven years. Which storage tier characteristic best matches this requirement?

  1. An in-memory cache tier with microsecond latency
  2. A local instance store that is erased on stop
  3. A high-performance block volume attached to a running instance
  4. A low-cost archival tier with retrieval latency measured in minutes Correct answer.

Explanation

Compliance archives need durable, low-cost retention with predictable retrieval, so an archival tier with minute-level retrieval fits. Block volumes and caches are priced and designed for active workloads, not long-term retention.

Question 4Cloud Architecture Concepts and Design

Which statement best describes the purpose of a virtual private cloud (VPC)?

  1. It automatically replicates databases across continents.
  2. It provides an isolated, logically defined network in which cloud resources are launched. Correct answer.
  3. It guarantees that workloads never share physical hardware with other tenants.
  4. It replaces the need for identity and access management.

Explanation

A VPC is a logically isolated network boundary where you define subnets, routing, and gateways. It is a software-defined construct, so it does not guarantee dedicated physical hardware.

Question 5Cloud Architecture Concepts and Design

A stateless web tier sits behind a load balancer. Which design change best allows the tier to scale horizontally without breaking user sessions?

  1. Store session state in a shared external data store Correct answer.
  2. Increase the instance size of every web server
  3. Move the session state into local instance memory
  4. Pin each user to a specific instance with sticky sessions

Explanation

Externalizing session state lets any instance serve any request, which is the precondition for elastic horizontal scaling. Sticky sessions and local memory tie a user to one instance and undermine that flexibility.

Question 6Cloud Architecture Concepts and Design

Which cloud characteristic lets a team provision hundreds of servers in minutes rather than waiting weeks for hardware procurement?

  1. Capital expenditure financing
  2. Rapid elasticity Correct answer.
  3. Manual data center provisioning
  4. Fixed capacity planning

Explanation

Rapid elasticity is the ability to acquire and release resources on demand as workload needs change. It removes the long procurement lead time associated with physical hardware.

Question 7Cloud Architecture Concepts and Design

A company wants to avoid large upfront hardware purchases and instead pay monthly for cloud usage. Which benefit of cloud economics does this illustrate?

  1. Removing the need for financial governance
  2. Eliminating all variable costs
  3. Converting capital expenditure into operating expenditure Correct answer.
  4. Guaranteeing the lowest possible unit price

Explanation

Cloud consumption shifts spending from upfront capital investment to ongoing operating expense tied to usage. It does not remove variable cost; it makes cost variable by design.

Question 8Cloud Architecture Concepts and Design

What is the primary architectural purpose of decoupling application components with a message queue?

  1. To replace the need for monitoring and alerting
  2. To reduce the number of services in the architecture
  3. To guarantee that messages are processed in strict order across all consumers
  4. To let producers and consumers operate independently and absorb traffic spikes Correct answer.

Explanation

A queue buffers messages so producers can continue publishing while consumers process at their own pace, which smooths spikes and isolates failures. Ordering guarantees depend on the specific queue type and are not the general purpose of decoupling.

Question 9Cloud Architecture Concepts and Design

A read-heavy application experiences database contention during peak hours. Which pattern most directly offloads repeated read traffic while keeping data reasonably fresh?

  1. A larger primary instance with synchronous multi-region commits
  2. A read replica with a caching layer in front of it Correct answer.
  3. A nightly full backup restored on demand
  4. A write-ahead log shipped to a cold archive

Explanation

Read replicas distribute query load and a cache absorbs repeated reads, reducing pressure on the primary. The combination improves read throughput while bounding staleness through cache expiry and replication lag.

Question 10Cloud Architecture Concepts and Design

An architect must design for a recovery point objective of five minutes and a recovery time objective of one hour. Which combination best satisfies both targets?

  1. Nightly backups with manual restore into a new region
  2. Continuous or frequent replication with automated failover to a warm standby Correct answer.
  3. Weekly snapshots stored in a single zone
  4. No replication, relying on provider durability alone

Explanation

A five-minute RPO requires replication or backup frequency no coarser than five minutes, and a one-hour RTO requires an automated, pre-built recovery path. A warm standby with automated failover meets both.

Question 11Cloud Architecture Concepts and Design

A workload runs steadily at a predictable baseline but spikes unpredictably during sales events. Which purchasing strategy is most cost-effective?

  1. Reserved or committed capacity for the baseline plus on-demand capacity for spikes Correct answer.
  2. Dedicated hosts sized for the highest observed peak
  3. On-demand capacity for all traffic at all times
  4. Spot capacity for the entire workload including the database

Explanation

Commitment discounts reward predictable steady usage, while on-demand pricing covers variable peaks without long-term lock-in. Combining the two aligns cost with each portion of demand.

Question 12Cloud Architecture Concepts and Design

A public-facing subnet must reach the internet for software updates, but instances in it must not accept inbound connections from the internet. Which configuration achieves this?

  1. A VPN tunnel from the subnet to the provider backbone
  2. A peering connection to a partner VPC
  3. A NAT gateway for outbound traffic with no inbound rules allowing internet sources Correct answer.
  4. An internet gateway with a security group allowing all inbound traffic

Explanation

A NAT gateway allows instances in a private subnet to initiate outbound connections while blocking unsolicited inbound traffic. Security group rules should also deny inbound internet sources to enforce the requirement.

Question 13Cloud Architecture Concepts and Design

An application writes objects to storage and must ensure that a partially uploaded object is never visible to readers. Which mechanism should the architect specify?

  1. Direct writes to the final object key as bytes arrive
  2. Client-side retries on every failed write
  3. A scheduled job that deletes suspicious objects hourly
  4. Multipart upload with an atomic completion step Correct answer.

Explanation

Multipart upload assembles parts and exposes the object only when the upload is explicitly completed, so readers never see partial content. Writing directly to the final key can expose incomplete data.

Question 14Cloud Architecture Concepts and Design

A team is choosing between relational and NoSQL storage for a workload with flexible, rapidly evolving document attributes and very high write throughput. Which choice is best justified?

  1. A file share because documents are stored as files
  2. A relational database because it guarantees the highest write throughput
  3. A relational database because joins are always required for correctness
  4. A document-oriented NoSQL store because schema flexibility and write scaling match the access pattern Correct answer.

Explanation

Document stores accommodate evolving attributes without migrations and scale writes horizontally across partitions. Relational engines remain preferable when strong relational integrity and complex joins dominate.

Question 15Cloud Architecture Concepts and Design

An architect must ensure that a single misconfigured service cannot exhaust connections to a shared downstream API. Which pattern should be applied?

  1. Retrying failed calls immediately without limit
  2. A shared administrator credential for all services
  3. A circuit breaker combined with per-client rate limiting Correct answer.
  4. Removing timeouts so slow calls can finish

Explanation

Circuit breakers stop calls to a failing dependency and rate limits cap each client's consumption, containing blast radius. Unlimited retries and missing timeouts amplify the failure instead.

Question 16Cloud Architecture Concepts and Design

A regulated workload requires that encryption keys never leave the customer's controlled hardware security module. Which key management approach fits?

  1. Application-level obfuscation without key management
  2. Keys embedded in source code repositories
  3. Customer-managed keys held in a dedicated HSM under customer control Correct answer.
  4. Provider-managed keys with no customer visibility

Explanation

Customer-managed keys in a dedicated HSM keep key material under the customer's control and satisfy external key custody requirements. Provider-managed keys and embedded secrets do not meet that constraint.

Question 17Cloud Architecture Concepts and Design

An architect is designing identity for workloads running in multiple accounts. Which approach best follows least privilege?

  1. One role with full administrative permissions reused by all services
  2. Distinct roles per workload scoped to required actions, assumed temporarily Correct answer.
  3. A single shared administrative user stored in each account
  4. Long-lived access keys distributed to developers

Explanation

Separate roles with narrowly scoped permissions and temporary credentials limit what each workload can do and reduce credential exposure. Shared administrative identities concentrate risk and defeat audit trails.

Question 18Cloud Architecture Concepts and Design

A media company stores large video files accessed frequently for the first week and rarely afterward. Which lifecycle design reduces cost while preserving availability?

  1. Delete all objects after seven days
  2. Keep every object in the hottest tier indefinitely
  3. Copy each object to a second hot tier for redundancy
  4. Transition objects to a colder tier after a defined age threshold Correct answer.

Explanation

Lifecycle policies move objects to cheaper tiers as access frequency declines, matching storage cost to usage. Deleting objects or duplicating hot copies either loses data or wastes budget.

Question 19Cloud Architecture Concepts and Design

A containerized service must scale automatically based on queue depth rather than CPU utilization. Which design element is required?

  1. Manual scaling performed by an operator each shift
  2. A fixed desired count set at deployment time
  3. CPU-based target tracking alone
  4. A custom scaling policy driven by a queue-length metric Correct answer.

Explanation

Scaling on queue depth requires a policy that consumes a queue-length metric and adjusts capacity accordingly. CPU-based or manual approaches do not respond to backlog growth directly.

Question 20Cloud Architecture Concepts and Design

An architect is asked whether to use a multi-region active-active design for a new internal tool with a four-hour RTO and no data-loss tolerance beyond one day. Which conclusion is best supported?

  1. A single-zone design is sufficient because internal tools are exempt from recovery planning
  2. Active-active multi-region is mandatory because the tool is internal
  3. Multi-region active-active is required whenever an RTO is defined
  4. A single-region multi-zone design with tested backups meets the stated objectives at lower cost Correct answer.

Explanation

Requirements drive architecture: a four-hour RTO and one-day RPO are satisfied by multi-zone resilience plus tested restore. Active-active multi-region adds cost and complexity that the stated objectives do not justify.

Question 21Cloud Architecture Concepts and Design

Two services must exchange events with exactly-once effective processing despite occasional duplicate deliveries. Which design achieves this?

  1. Fire-and-forget delivery with no acknowledgement
  2. Increasing consumer concurrency without tracking processed events
  3. At-least-once delivery with no consumer-side deduplication
  4. Idempotent consumers that deduplicate on a business key Correct answer.

Explanation

Most brokers guarantee at-least-once delivery, so effective exactly-once processing is achieved by making consumers idempotent or by deduplicating on a stable business key. Transport-level guarantees alone cannot prevent duplicate side effects.

Question 22Cloud Architecture Concepts and Design

A team proposes a shared relational database across many microservices to simplify joins. Which consequence is the strongest architectural objection?

  1. Services become coupled through a shared schema, so independent deployment and evolution are impeded Correct answer.
  2. Relational databases cannot enforce referential integrity
  3. Microservices are prohibited from using SQL
  4. Shared databases always cost more than separate ones

Explanation

A shared schema creates hidden coupling: a change made for one service can break others, undermining independent deployment. The objection is about ownership and coupling, not about the relational model's capabilities.

Question 23Cloud Architecture Concepts and Design

A workload must process bursty batch jobs that can tolerate interruption and restart. Which compute choice best balances cost and suitability?

  1. A single large instance with no checkpointing
  2. Dedicated hosts reserved for the entire year
  3. Spot or preemptible instances with checkpointing Correct answer.
  4. On-demand instances kept running continuously

Explanation

Interruption-tolerant batch work is the canonical fit for discounted spare capacity, provided jobs checkpoint so restarts are cheap. Continuous on-demand or dedicated capacity wastes money on idle periods.

Question 24Cloud Architecture Concepts and Design

An architect must decide between synchronous orchestration and asynchronous choreography for a multi-step order workflow. Which consideration most strongly favors choreography?

  1. Steps must execute in strict sequence with compensating transactions
  2. Operators require one dashboard showing every step's state
  3. Steps must evolve and deploy independently with loose coupling between teams Correct answer.
  4. The workflow needs a single place to inspect and enforce step order

Explanation

Choreography lets each service react to events without a central coordinator, which supports independent evolution and deployment. Central visibility and enforced ordering are strengths of orchestration instead.

Question 25Cloud Architecture Concepts and Design

A security review finds that an application stores secrets in environment variables committed to a deployment manifest. Which remediation best addresses the root cause?

  1. Rotate the exposed secrets once and continue the practice
  2. Retrieve secrets at runtime from a managed secrets store using workload identity Correct answer.
  3. Restrict repository access to the operations team only
  4. Encrypt the manifest and store it in the same repository

Explanation

The root cause is that secret material lives in version-controlled configuration, so remediation must move secrets into a managed store accessed via short-lived workload identity. Encrypting or restricting the repository leaves secrets in the deployment pipeline.

Question 26Cloud Architecture Concepts and Design

An architect is diagramming a cloud deployment and needs to distinguish a region from an availability zone. Which statement describes the relationship correctly?

  1. A region contains multiple isolated availability zones connected by low-latency links, and each availability zone spans several regions.
  2. An availability zone is a single data center within a region, and a region is a logical grouping of availability zones in one geographic area. Correct answer.
  3. A region and an availability zone are interchangeable terms for the same physical facility in most providers.
  4. An availability zone contains multiple regions, each of which hosts exactly one data center.

Explanation

A region is a geographic area that groups multiple availability zones, and each availability zone is one or more discrete data centers with independent power and networking. Deploying across zones within a region gives fault isolation without the latency of cross-region traffic. The containment direction runs region-to-zone, never the reverse.

Question 27Cloud Architecture Concepts and Design

A team wants a private network boundary in the cloud where subnets, route tables, and gateways are defined for a set of workloads. Which construct provides this isolated virtual network?

  1. A domain name system (DNS) zone
  2. An object storage bucket
  3. A virtual private cloud (VPC) Correct answer.
  4. A content delivery network (CDN)

Explanation

A VPC is the software-defined network boundary that holds subnets, route tables, internet or NAT gateways, and security controls for a workload. CDNs, buckets, and DNS zones operate at other layers and do not define IP address space or routing. Subnetting and routing decisions all live inside the VPC construct.

Question 28Cloud Architecture Concepts and Design

An application must survive the loss of an entire data center while keeping a single logical database. Which availability-zone deployment approach best meets this requirement within one region?

  1. Rely on nightly backups to object storage in the same zone for recovery.
  2. Run the primary in one availability zone with a synchronous standby in a second zone and automated failover. Correct answer.
  3. Distribute stateless web servers across zones and keep the database in a single zone.
  4. Place the primary database and all replicas in one availability zone to minimize replication lag.

Explanation

Surviving the loss of one data center requires the database itself to have a replica in a separate availability zone with automated failover, so a zone failure does not take down the only copy. Spreading only stateless tiers leaves the data tier as a single point of failure. Backups in the same zone fail alongside the zone.

Question 29Cloud Architecture Concepts and Design

An architect is choosing a load-balancing layer for a workload that needs to route HTTP requests by URL path and terminate TLS. Which choice fits best?

  1. A network load balancer operating at layer 4 that forwards TCP connections without inspecting HTTP.
  2. A layer 7 application load balancer that inspects HTTP and supports path-based routing and TLS termination. Correct answer.
  3. A route table entry that directs traffic to an internet gateway.
  4. A NAT gateway that translates source addresses for outbound traffic.

Explanation

Path-based routing and TLS termination require inspection of HTTP, which is a layer 7 capability of an application load balancer. Layer 4 balancers forward connections based on IP and port without understanding URLs. NAT gateways and route tables handle addressing and forwarding, not request-level routing.

Question 30Cloud Architecture Concepts and Design

A design stores session state on each web server, which breaks when users are routed to a different instance. Which change best addresses this while preserving horizontal scaling?

  1. Reduce the number of web servers to one so sessions never move.
  2. Enable sticky sessions so each user always returns to the same instance.
  3. Move session state to a shared external store such as a distributed cache or database. Correct answer.
  4. Increase the instance size so each server can hold more sessions.

Explanation

Externalizing session state to a shared store makes any instance able to serve any request, which is what allows horizontal scaling and even instance loss without breaking users. Sticky sessions merely pin users and fail when an instance is replaced. Scaling down or up does not remove the coupling between session and server.

Question 31Cloud Architecture Concepts and Design

An architect must let resources in a private subnet download patches from the internet while preventing inbound connections from the internet. Which design accomplishes this?

  1. Place the instances in a public subnet and rely on a host firewall to block inbound traffic.
  2. Route outbound traffic through a NAT gateway in a public subnet, and give the private subnet no inbound internet path. Correct answer.
  3. Assign public IP addresses to every private instance and open only port 443 inbound.
  4. Attach an internet gateway directly to the private subnet and allow all inbound traffic.

Explanation

A NAT gateway lets private-subnet resources initiate outbound connections while remaining unreachable from the internet, because return traffic is stateful and inbound connections cannot be initiated. Internet gateways with public addresses expose the instances. Host firewalls are defense in depth, not a substitute for network placement.

Question 32Cloud Architecture Concepts and Design

A company runs a steady baseline workload but must absorb unpredictable seasonal peaks without long-term commitment. Which combination of purchasing approaches is most cost-effective?

  1. On-demand or spot capacity for the baseline and reserved capacity for the peaks.
  2. Reserved capacity for the predictable baseline plus on-demand or spot capacity for the variable peaks. Correct answer.
  3. Reserved capacity sized for peak demand, kept year-round.
  4. A single large reserved instance sized for the highest observed peak.

Explanation

Matching commitment to the portion of demand that is predictable captures discount pricing for the baseline, while flexible on-demand or spot capacity covers spikes without paying for idle reserved capacity. Committing to peak demand overprovisions for most of the year. The inversion of this pattern wastes discounts on variable load.

Question 33Cloud Architecture Concepts and Design

An architect is evaluating whether a workload should use a multi-region active-active design. The workload has a four-hour recovery time objective, a fifteen-minute recovery point objective, and a limited budget. Which reasoning best supports the decision?

  1. A four-hour RTO and fifteen-minute RPO can be met with a warm standby or backup-and-restore approach in a second region, so active-active adds cost without meeting a stated need. Correct answer.
  2. Active-active multi-region is required whenever an RTO is defined, regardless of its length.
  3. The RPO alone forces active-active because any data loss is unacceptable.
  4. Active-active is the cheapest option because traffic is spread across regions.

Explanation

Recovery objectives should drive the disaster recovery strategy: a four-hour RTO and fifteen-minute RPO are achievable with a warm standby or pilot-light pattern, which costs far less than running full capacity in two regions. Active-active is justified by near-zero RTO or strict latency and availability goals, not by the mere existence of an RTO. Over-engineering against unstated requirements wastes budget.

Question 34Cloud Architecture Concepts and Design

Two microservices must exchange events reliably, but the consumer occasionally processes the same message twice after a retry. Which design pattern makes duplicate deliveries harmless?

  1. Making the consumer idempotent by tracking a unique message or business key and ignoring repeats. Correct answer.
  2. Removing the dead-letter queue so failed messages are dropped.
  3. Increasing the visibility timeout so retries never occur.
  4. Switching from a queue to direct synchronous calls between the services.

Explanation

At-least-once delivery is the norm for distributed queues, so correctness must come from the consumer: recording a unique key and treating a repeated message as a no-op yields effectively-once processing. Tuning timeouts only reduces retries and cannot eliminate duplicates. Synchronous calls trade one failure mode for tighter coupling, and dropping failed messages loses data.

Question 35Cloud Security Governance and Risk Management

An organization is adopting a cloud shared responsibility model. Which statement best describes how security duties are divided between the cloud service provider (CSP) and the customer?

  1. The customer is always responsible for physical security of the data center, regardless of service model.
  2. The CSP is always responsible for all layers of the stack, including customer data and identity configuration.
  3. The split depends on the service model: the CSP secures the underlying infrastructure, while the customer secures what it puts in and configures on the cloud. Correct answer.
  4. Responsibility is transferred entirely to the customer once a contract is signed.

Explanation

Under the shared responsibility model, the provider is accountable for security 'of' the cloud (physical facilities, host infrastructure, hypervisor, managed service internals), while the customer is accountable for security 'in' the cloud (data, identities, configurations, access policies). The boundary shifts by service model: IaaS leaves more to the customer, SaaS leaves less. The model is a governance baseline that must be reflected in contracts and controls.

Question 36Cloud Security Governance and Risk Management

A governance team needs a single risk treatment approach that maps identified cloud risks to controls, owners, and residual risk acceptance. Which artifact best serves this purpose?

  1. A network topology diagram of the VPC peering mesh
  2. A cloud risk register with treatment plans and named risk owners Correct answer.
  3. A vendor marketing brochure describing certifications
  4. An incident postmortem for a single past outage

Explanation

A risk register records each identified risk, its likelihood and impact, the chosen treatment (mitigate, transfer, avoid, accept), the control mapping, an accountable owner, and the residual risk decision. It is the central governance record linking risk assessment to treatment and acceptance. Topology diagrams, brochures, and single postmortems are inputs or evidence but not a treatment framework.

Question 37Cloud Security Governance and Risk Management

Which cloud governance mechanism most directly enforces that only approved, compliant resource configurations can be provisioned in a production account?

  1. A wiki page listing recommended instance sizes
  2. A service control policy or organization policy that denies non-compliant resource creation Correct answer.
  3. A quarterly architecture review board meeting
  4. A monthly chargeback report sent to business units

Explanation

Preventive guardrails such as service control policies, organization policies, or policy-as-code constraints block non-compliant provisioning at the API level, making the control deterministic rather than advisory. Chargeback, documentation, and review meetings influence behavior but do not enforce configuration compliance. Preventive controls are a core governance layer alongside detective controls.

Question 38Cloud Security Governance and Risk Management

What is the primary purpose of a cloud security control matrix aligned to a recognized framework such as ISO/IEC 27017 or the CSA Cloud Controls Matrix?

  1. To guarantee that no security incident will occur
  2. To set the retail pricing of cloud services
  3. To replace the need for any internal audit function
  4. To provide a structured mapping of required controls to framework references, owners, and evidence so compliance can be assessed consistently Correct answer.

Explanation

A control matrix maps each required control to framework references, implementation status, an accountable owner, and the evidence that demonstrates operation. It gives auditors and risk owners a consistent basis for assessing coverage and gaps. It supports assurance but cannot eliminate incidents or substitute for independent audit.

Question 39Cloud Security Governance and Risk Management

An organization wants to transfer some financial exposure from a cloud outage. Which risk treatment is being applied when it purchases cyber insurance covering cloud service interruption?

  1. Risk mitigation through preventive controls
  2. Risk transfer Correct answer.
  3. Risk acceptance
  4. Risk avoidance

Explanation

Purchasing insurance shifts part of the financial consequence of a risk to a third party, which is the definition of risk transfer. Avoidance would mean not using the service at all; acceptance would mean bearing the loss without action; mitigation would reduce likelihood or impact through controls. Transfer does not reduce the underlying likelihood of the outage.

Question 40Cloud Security Governance and Risk Management

What does a cloud data classification scheme primarily enable in a governance program?

  1. It determines how data must be protected, handled, and where it may be stored based on sensitivity Correct answer.
  2. It defines the programming language used by application teams
  3. It sets the number of engineers required to operate the platform
  4. It fixes the availability zone count for every workload

Explanation

Data classification assigns sensitivity levels (for example public, internal, confidential, restricted) and drives the handling rules: encryption requirements, access restrictions, residency constraints, and retention. It is the basis for applying proportionate controls. Staffing, availability design, and language choice are separate architecture decisions.

Question 41Cloud Security Governance and Risk Management

Which activity belongs to the 'monitor' phase of a cloud governance lifecycle rather than to initial policy design?

  1. Defining the tagging standard for cost allocation
  2. Continuously evaluating control effectiveness and compliance drift against defined policies Correct answer.
  3. Drafting the acceptable use policy for cloud accounts
  4. Selecting the cloud service provider during procurement

Explanation

The monitor phase checks whether implemented controls remain effective and whether resources drift from policy, feeding findings back into policy refinement. Drafting policies, defining standards, and selecting providers are design or procurement activities. Continuous compliance evaluation is the hallmark of the monitoring and assurance phase.

Question 42Cloud Security Governance and Risk Management

A risk assessment finds that a public object storage bucket could expose regulated data. Which combination of controls best reflects defense in depth for this risk?

  1. Renaming the bucket to an unguessable string
  2. Disabling access logging to reduce storage cost
  3. Relying solely on a yearly manual review of bucket permissions
  4. Preventive policy denying public buckets, encryption at rest, and continuous detection of public exposure Correct answer.

Explanation

Defense in depth layers preventive controls (policy denial of public ACLs), data protection (encryption at rest), and detective controls (continuous scanning for public exposure). Together they reduce both likelihood and impact. Reliance on a single manual review, obscurity, or removing logging weakens assurance.

Question 43Cloud Security Governance and Risk Management

An enterprise uses a landing zone to standardize new cloud accounts. Which governance outcome does a landing zone most directly provide?

  1. A baseline of identity, networking, logging, and guardrails applied consistently to every new account Correct answer.
  2. A per-application source code repository strategy
  3. A replacement for the organization's incident response plan
  4. A guarantee that each workload will meet its performance SLA

Explanation

A landing zone is a pre-configured, governed environment template that establishes identity federation, network segmentation, centralized logging, and policy guardrails for accounts created within it. It enforces consistency and reduces configuration drift at scale. It does not guarantee application performance, dictate source control, or replace incident response.

Question 44Cloud Security Governance and Risk Management

A governance team is deciding between a preventive and a detective control for encryption of data at rest. Which statement correctly distinguishes them?

  1. Both controls only produce audit reports and never affect resource creation
  2. A preventive control reports unencrypted volumes after the fact, while a detective control blocks their creation
  3. A preventive control blocks creation of unencrypted volumes, while a detective control identifies existing unencrypted volumes after the fact Correct answer.
  4. Preventive controls apply only to networks, and detective controls apply only to storage

Explanation

Preventive controls act before or at the moment of an action, blocking non-compliant resource creation such as unencrypted volumes. Detective controls identify non-compliance after resources exist, through configuration scanning or log analysis. Mature programs combine both so that gaps are blocked where possible and detected where not.

Question 45Cloud Security Governance and Risk Management

A multinational must keep certain customer records within national borders. Which governance requirement should be captured in cloud architecture and vendor agreements?

  1. The maximum number of tags per resource
  2. The internal code review checklist
  3. Data residency and sovereignty constraints specifying approved storage locations Correct answer.
  4. The preferred color scheme of the operations dashboard

Explanation

Data residency and sovereignty requirements define where data may be stored and processed and which legal regimes apply, and they must be reflected in region selection, replication design, and contractual commitments. Tag limits, dashboards, and code review practices are unrelated operational details. Residency is a legal and governance constraint, not a technical preference.

Question 46Cloud Security Governance and Risk Management

A cloud risk assessment uses a likelihood-times-impact scoring model. Two risks score identically, but one affects regulated personal data and the other affects a marketing microsite. What is the most defensible governance action?

  1. Prioritize the regulated-data risk, because regulatory, legal, and reputational consequences may not be fully captured by the numeric score Correct answer.
  2. Ignore both risks until the next annual review
  3. Treat both risks identically because the numeric score is the same
  4. Reduce the score of the regulated-data risk to avoid escalation

Explanation

Quantitative scores are decision aids, not the sole basis for prioritization; qualitative factors such as regulatory exposure, legal liability, and reputational harm must be considered. When scores tie, the risk with greater regulatory or legal consequence generally warrants earlier treatment. Adjusting scores to avoid escalation undermines the integrity of the risk process.

Question 47Cloud Security Governance and Risk Management

Which cloud identity governance practice best limits the blast radius of a compromised workload credential?

  1. Granting a single shared administrative role to all workloads for simplicity
  2. Assigning least-privilege, workload-specific roles with short-lived credentials and regular access reviews Correct answer.
  3. Disabling multi-factor authentication for service accounts
  4. Storing long-lived access keys in application source code

Explanation

Least privilege limits what a compromised credential can do, short-lived credentials reduce the window of misuse, and access reviews remove accumulated permissions. Together they constrain blast radius. Shared administrative roles, embedded long-lived keys, and disabled MFA all expand exposure.

Question 48Cloud Security Governance and Risk Management

An organization is selecting a cloud provider and must evaluate third-party risk. Which evidence is most relevant to governance due diligence?

  1. The visual design of the provider's management console
  2. The number of conference talks given by the provider's engineers
  3. The provider's stock price trend over the last quarter
  4. Independent audit reports and certifications covering the provider's control environment Correct answer.

Explanation

Third-party risk due diligence relies on independent assurance such as SOC 2 reports, ISO/IEC 27001 and 27017 certifications, and penetration test summaries that evidence the provider's control environment. Financial, marketing, and interface factors are not security assurance. Governance should also review report scope and period, not just the certificate's existence.

Question 49Cloud Security Governance and Risk Management

What is the main governance value of centralized cloud logging and log retention controls?

  1. It eliminates the need for access control on cloud resources
  2. It provides tamper-resistant evidence for detection, investigation, and compliance obligations Correct answer.
  3. It reduces the number of regions a provider operates
  4. It replaces the need for encryption of data in transit

Explanation

Centralized, protected logging creates an evidence trail that supports threat detection, forensic investigation, and demonstration of compliance with retention requirements. Logs must be protected from tampering and retained per policy. Logging complements but does not replace access control or encryption.

Question 50Cloud Security Governance and Risk Management

A business unit wants to adopt a new SaaS tool that will process confidential data. Which governance gate should be applied before approval?

  1. Approval by the business unit alone with no security involvement
  2. A security and privacy review covering data classification, vendor assurance, contractual terms, and integration controls Correct answer.
  3. Deferral until the next fiscal year regardless of business need
  4. Immediate approval because SaaS requires no configuration

Explanation

SaaS adoption still requires due diligence: confirm the data classification, verify the vendor's independent assurance, negotiate data protection and breach notification terms, and define identity integration and access controls. Assuming SaaS is inherently safe, bypassing security review, or blanket deferral are all poor governance outcomes.