I85PREP
⌘ K
ISACA CCAK study materials
ISACA CCAK study resources

ISACA CCAK practice questions

One question at a time. Build your ISACA CCAK understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Architecture and Design

A financial institution runs its own operating systems and middleware on virtual machines rented from a public cloud provider. Under the IaaS shared responsibility model, which activity remains the customer's responsibility?

  1. Patching the guest operating system and hardening the middleware stack Correct answer.
  2. Physical security of the provider's data center and patching of the hypervisor
  3. Maintaining the physical network fabric and the virtualization layer
  4. Securing the underlying storage hardware and applying its firmware updates

Explanation

In IaaS the provider secures the facility, hardware, network fabric, and hypervisor, while the customer controls everything from the guest operating system upward. Operating system patching, middleware hardening, and application security therefore stay with the customer. Confusing the guest OS with the hypervisor is the most common error in applying the model.

Question 2Cloud Architecture and Design

Which of the following is one of the five essential characteristics of cloud computing as defined in NIST SP 800-145?

  1. Multi-tenancy
  2. Broad network access Correct answer.
  3. Geographic redundancy
  4. Elastic licensing

Explanation

NIST SP 800-145 lists on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service as the essential characteristics. Multi-tenancy is a design consequence of resource pooling rather than a separately listed characteristic. Geographic redundancy and licensing terms are commercial or architectural choices, not definitional criteria.

Question 3Cloud Architecture and Design

An organization wants a fully functional email and collaboration suite delivered over the internet, with no servers, runtime, or application code for it to manage. Which service model matches this requirement?

  1. PaaS
  2. FaaS
  3. SaaS Correct answer.
  4. IaaS

Explanation

SaaS delivers a complete provider-managed application; the consumer administers only its own users, data, and configuration. IaaS and PaaS leave the customer responsible for parts of the stack such as the operating system, runtime, or application code. FaaS is a serverless compute model for running individual functions, not a finished application.

Question 4Cloud Architecture and Design

Several hospitals operating under the same national health data regulation share a cloud environment that was purpose-built for that specific group of organizations. Which deployment model does this describe?

  1. Community cloud Correct answer.
  2. Public cloud
  3. Hybrid cloud
  4. Private cloud

Explanation

A community cloud is provisioned for exclusive use by a specific group of consumers that share common concerns such as compliance requirements. The defining trait is the bounded, shared constituency rather than open public availability or single-organization ownership. Hybrid cloud would require a composition of two or more distinct models, which is not described here.

Question 5Cloud Architecture and Design

In the NIST cloud computing reference architecture (SP 500-292), which actor manages the use, performance, and delivery of cloud services and negotiates relationships between providers and consumers?

  1. Cloud auditor
  2. Cloud carrier
  3. Cloud broker Correct answer.
  4. Cloud consumer

Explanation

The cloud broker is defined as the entity that manages service use, performance, and delivery while mediating relationships between providers and consumers. The carrier supplies the network transport, and the auditor performs independent assessment of controls. The consumer is the party that uses the services rather than the intermediary that negotiates them.

Question 6Cloud Architecture and Design

When designing a multi-tenant compute platform that hosts workloads from unrelated customers, why is a Type 1 hypervisor generally preferred over a Type 2 hypervisor?

  1. It eliminates the need to patch the virtualization layer after deployment.
  2. It runs directly on hardware, giving lower overhead and a smaller attack surface. Correct answer.
  3. It lets tenants administer the hypervisor console for faster incident response.
  4. It encrypts guest memory automatically, removing the need for host-level controls.

Explanation

A Type 1 hypervisor runs directly on the physical host, which reduces the software layers, improves performance, and narrows the exposure that a compromised general-purpose host OS would create. A Type 2 hypervisor depends on a host operating system, adding both overhead and attack surface. Neither type removes patching duties or grants tenants hypervisor-level access.

Question 7Cloud Architecture and Design

Which risk is most characteristic of running containers owned by different tenants on a single physical host?

  1. Containers cannot enforce CPU and memory limits, making noisy-neighbor effects unavoidable.
  2. All containers share the host kernel, so a kernel exploit can cross tenant boundaries. Correct answer.
  3. Containers cannot be attached to isolated virtual networks or segmented.
  4. Container images cannot be scanned for known vulnerabilities before deployment.

Explanation

Containers package applications but share the host operating system kernel, so a kernel-level vulnerability can allow escape from one container and compromise neighbors. This is why trusted image provenance, kernel patch currency, and stronger isolation such as dedicated hosts or sandboxed runtimes matter in multi-tenant environments. The other stated limitations are not inherent to container technology.

Question 8Cloud Architecture and Design

A SaaS agreement will terminate next quarter. The provider encrypts tenant data at rest using keys it generates and manages itself. Which measure best preserves the customer's ability to render that data unreadable after exit?

  1. Obtaining a copy of the provider's key management policy and audit logs
  2. Requiring the provider to replicate backups into a second region
  3. Using customer-managed keys held in a key store the customer controls, so the key can be revoked or destroyed at exit Correct answer.
  4. Relying on a certificate of destruction for the storage media

Explanation

Cryptographic erasure depends on controlling the key rather than the media; if the customer holds the key in its own key store, destroying it at exit makes residual copies unreadable. Provider-managed keys leave the customer dependent on the provider's deletion and media sanitization processes. Policies, logs, and replication copies do not by themselves remove readability.

Question 9Cloud Architecture and Design

A payment processor requires a recovery point objective of zero for transactions within a region and near real-time continued processing if an entire region is lost. Which architecture best satisfies both requirements?

  1. Synchronous replication across availability zones plus an active-active deployment in a second region Correct answer.
  2. A pilot-light standby that is rebuilt from infrastructure-as-code after failover is declared
  3. Two regions with asynchronous replication and a documented 24-hour recovery point objective
  4. One region spanning three availability zones with nightly backups copied to a second region

Explanation

An RPO of zero inside a region requires synchronous replication across availability zones, while surviving regional loss with near real-time service requires a live second-region footprint rather than rebuild-on-failure. Active-active across regions with asynchronous cross-region replication satisfies both constraints within stated limits. Backup-based or pilot-light approaches cannot meet a zero RPO because they lose committed transactions.

Question 10Cloud Architecture and Design

An enterprise moves a tightly coupled legacy application to IaaS without refactoring it. Which statement best characterizes the resulting control and risk profile?

  1. The customer still patches the guest OS, middleware, and application, and legacy single points of failure remain. Correct answer.
  2. The workload gains horizontal elasticity automatically because it now runs on virtual machines.
  3. The provider assumes responsibility for application patching once the workload runs in the cloud.
  4. Shared responsibility ceases to apply because the workload was not redesigned for cloud.

Explanation

A lift-and-shift migration changes the hosting location but not the application's internal design, so the customer retains operating system, middleware, and application duties. Tight coupling and single points of failure move with the workload, and cloud-native resilience such as horizontal scaling is not gained without redesign. The shared responsibility model always applies and never transfers application patching to the provider in IaaS.

Question 11Cloud Architecture and Design

An enterprise keeps regulated records in its own data center while bursting non-sensitive analytics workloads to a public provider. The two environments remain distinct entities, but standardized APIs and a private network link allow data and application portability between them. Which NIST SP 800-145 deployment model is described?

  1. A private cloud deployment
  2. A community cloud deployment
  3. A public cloud deployment
  4. A hybrid cloud deployment Correct answer.

Explanation

SP 800-145 defines hybrid cloud as a composition of two or more distinct cloud infrastructures that remain unique entities but are bound by standardized or proprietary technology enabling data and application portability. Here the private and public portions are separately owned and operated, which rules out a single public or a single private model.

Question 12Cloud Architecture and Design

A provider supplies and patches the runtime, middleware and operating system for an application environment, while the consumer controls only the deployed application code and its configuration settings. Which cloud service model does this describe?

  1. Infrastructure as a service
  2. Platform as a service Correct answer.
  3. Software as a service
  4. Functions as a service

Explanation

In PaaS the provider maintains the runtime, middleware and operating system, and the consumer controls only the deployed application and limited configuration. That split matches the scenario, and it differs from IaaS, where the consumer still patches the guest operating system.

Question 13Cloud Architecture and Design

A developer provisions a virtual server through a self-service portal and receives it within minutes, with no human interaction with provider staff at any point. Which NIST SP 800-145 essential characteristic does this illustrate?

  1. Measured service
  2. Resource pooling
  3. Rapid elasticity
  4. On-demand self-service Correct answer.

Explanation

On-demand self-service means a consumer can unilaterally provision computing capabilities, such as server time, without requiring human interaction with each service provider. The decisive detail is the absence of provider staff involvement, not how capacity scales or how usage is metered.

Question 14Cloud Architecture and Design

In an IaaS deployment, which control remains the cloud customer's responsibility under the shared responsibility model?

  1. Patching the guest operating system Correct answer.
  2. Maintaining the physical network switches
  3. Patching the firmware of the physical hosts
  4. Securing the virtualization layer

Explanation

In IaaS the provider secures the facilities, hardware and virtualization layer, while the customer secures everything from the guest operating system upward, including patching, middleware and application data. Firmware and hypervisor controls sit inside the provider's scope.

Question 15Cloud Architecture and Design

Which statement describes the purpose of the CSA Cloud Controls Matrix (CCM)?

  1. A reference architecture defining the actors and their roles
  2. A contractual template for negotiating provider service levels
  3. A certification mark awarded to providers that pass an independent audit
  4. A cloud-specific control catalog mapped to major standards Correct answer.

Explanation

The CSA Cloud Controls Matrix is a cloud-focused control catalog with mappings to frameworks such as ISO/IEC 27001, COBIT and NIST, and it is used to assess a provider's control environment. It is guidance and assessment content rather than a certification, an architecture model or a contract.

Question 16Cloud Architecture and Design

A company connects its on-premises network, addressed as 10.0.0.0/16, to a cloud virtual network that was also provisioned as 10.0.0.0/16. The tunnel is established, yet on-premises hosts cannot reach cloud workloads. Which architectural remedy is most appropriate?

  1. Enable a larger maximum transmission unit on both gateways
  2. Re-address one environment with a non-overlapping CIDR block Correct answer.
  3. Increase the tunnel bandwidth to accommodate routing updates
  4. Configure the cloud route table to prefer the on-premises gateway

Explanation

Overlapping private address space on both ends of a connection makes routes ambiguous, so traffic is dropped or misrouted even though the tunnel itself is up. Connectivity must be planned with non-overlapping address ranges, or overlapping prefixes must be translated with NAT before the link is enabled.

Question 17Cloud Architecture and Design

A team deploys event-driven functions that process uploaded files and write results to a database. Which design choice most directly limits the blast radius if one function's code is compromised?

  1. Consolidating all functions under one shared execution role to simplify administration
  2. Storing database credentials in environment variables encrypted with a provider default key
  3. Routing all function traffic through a single shared egress virtual appliance
  4. Assigning each function a dedicated role with only the permissions it requires Correct answer.

Explanation

Least privilege per function limits what a compromised execution identity can reach, because each role grants only the permissions that function's logic needs. Shared roles, default-key secrets and a common egress path all broaden or obscure the reachable attack surface instead of containing it.

Question 18Cloud Architecture and Design

An autoscaling group launches instances from a hardened image produced by a build pipeline, but engineers also patch running instances manually when incidents occur. Which practice best eliminates configuration drift across the fleet?

  1. Enabling verbose logging on all instances and reviewing it weekly
  2. Granting engineers elevated access so fixes can be applied faster
  3. Rebuilding images through the pipeline and replacing running instances Correct answer.
  4. Scheduling a nightly scan of running instances for missing patches

Explanation

Immutable infrastructure treats servers as disposable artifacts rebuilt from version-controlled image definitions, so manual changes never accumulate into unique, inconsistent hosts. Scanning and logging detect drift after the fact, and broader access tends to create more of it.

Question 19Cloud Architecture and Design

A security team must discover which unsanctioned SaaS applications employees use, block uploads of confidential data to them, and apply session policies, all without modifying any application. Which component fulfills this requirement?

  1. A cloud workload protection platform monitoring server processes
  2. A cloud access security broker positioned between users and providers Correct answer.
  3. A host-based intrusion prevention agent installed on every endpoint
  4. A web application firewall placed in front of each internal application

Explanation

A cloud access security broker sits between cloud consumers and providers and delivers discovery of sanctioned and unsanctioned SaaS, data loss prevention and session or access control without touching application code. The other options operate at the network edge, the endpoint or the workload layer and do not provide inline SaaS discovery with data controls.

Question 20Cloud Architecture and Design

Before renewing a contract, a customer wants evidence that a provider's controls operated effectively throughout the preceding twelve months. Which artifact is most appropriate?

  1. The provider's ISO/IEC 27001 certificate of registration
  2. A SOC 2 Type II report covering the review period Correct answer.
  3. A completed security questionnaire signed by the provider's CISO
  4. A penetration test summary dated within the last quarter

Explanation

A SOC 2 Type II report tests both the design and the operating effectiveness of controls over a defined period, which is exactly the evidence requested. A Type I report is point-in-time, a signed questionnaire is self-asserted, and a certificate or a penetration test summary does not demonstrate sustained operation across the year.

Question 21Cloud Architecture and Design

An organization contracts with a cloud provider to run a dedicated cloud environment on the provider's premises. The infrastructure is provisioned for the exclusive use of that one organization and is not shared with any other customer. Which NIST deployment model does this describe?

  1. Community cloud
  2. Public cloud
  3. Hybrid cloud
  4. Private cloud Correct answer.

Explanation

A private cloud is provisioned for exclusive use by a single organization, and it may be owned and operated by the organization or by a third party on or off the organization's premises. The defining test is exclusive use by one organization rather than the location of the hardware.

Question 22Cloud Architecture and Design

Within a cloud region, what is the primary purpose of deploying an application across multiple availability zones?

  1. To remove the need for a load balancer in front of the application
  2. To let the application continue operating if one data center in the region fails Correct answer.
  3. To ensure that data never leaves the country where the region is located
  4. To reduce outbound data transfer charges between regions

Explanation

Availability zones are isolated failure domains within a region, so distributing workloads across them reduces the chance that a single facility outage takes the application down. Resilient designs combine multi-zone placement with health checks and traffic distribution.

Question 23Cloud Architecture and Design

In the NIST cloud computing reference architecture, which actor provides the connectivity and transport that links consumers to cloud services?

  1. Cloud carrier Correct answer.
  2. Cloud auditor
  3. Cloud provider
  4. Cloud broker

Explanation

The cloud carrier is the intermediary that provides connectivity and transport between cloud consumers and cloud providers. Auditors perform independent assessment, brokers mediate relationships, and providers make services available.

Question 24Cloud Architecture and Design

Which statement best describes the architectural difference between containers and virtual machines?

  1. Each container includes a complete guest operating system, while virtual machines share the host kernel.
  2. Containers share the host kernel, while each virtual machine runs its own guest operating system. Correct answer.
  3. Virtual machines package only application binaries, which makes them more portable than containers.
  4. Virtual machines cannot run in public clouds because they require direct access to physical server hardware.

Explanation

Containers isolate processes on a shared host kernel, whereas a virtual machine includes a full guest operating system managed by a hypervisor. This makes containers lighter but means a kernel compromise can affect containers that share it.

Question 25Cloud Architecture and Design

A web application stores user session data on the local disk of each virtual machine, and the load balancer distributes requests randomly across instances. Users are frequently logged out when their requests reach a different instance. Which design change best resolves this while supporting horizontal scaling?

  1. Configure the load balancer to send all traffic to one instance
  2. Increase the local disk size on each virtual machine
  3. Move session state to a shared, highly available data store Correct answer.
  4. Enable sticky sessions on the load balancer for all traffic

Explanation

Externalizing session state to a shared, highly available store lets any instance serve any request, which supports both horizontal scaling and instance replacement. Sticky sessions only mask the problem and can create uneven load or session loss during failures.

Question 26Cloud Architecture and Design

An organization wants to limit the damage that a compromised workload can cause in a public cloud virtual network. Which design practice is most effective?

  1. Apply least-privilege rules between workloads and deny traffic by default Correct answer.
  2. Rely only on the provider's physical network isolation
  3. Place all workloads in a single subnet to simplify monitoring
  4. Assign public IP addresses to every workload for consistent access

Explanation

Default-deny segmentation with least-privilege rules restricts lateral movement from a compromised workload to only the flows it legitimately needs. Physical isolation at the provider level does not control traffic between the customer's own workloads.

Question 27Cloud Architecture and Design

Which outcome is the primary reason to define cloud infrastructure through infrastructure as code (IaC) rather than manual provisioning?

  1. It guarantees that deployed infrastructure will contain no misconfigurations
  2. It makes environments reproducible and changes version-controlled and auditable Correct answer.
  3. It transfers security responsibility for the infrastructure to the cloud provider
  4. It removes the need to review infrastructure changes before deployment

Explanation

IaC stores infrastructure definitions in version control, so environments can be rebuilt consistently and every change can be reviewed and traced. It does not eliminate the need for review or guarantee correctness, because defects can still be codified.

Question 28Cloud Architecture and Design

An application running on cloud virtual machines needs to read objects from a storage bucket. Which credential design best reduces the impact of credential theft?

  1. Store long-lived access keys in an environment variable on each instance
  2. Create one highly privileged account and share it across all instances
  3. Issue short-lived credentials through an attached workload identity or instance role Correct answer.
  4. Embed a shared access key in the application source code

Explanation

Short-lived credentials issued through a workload identity or instance role reduce the value of stolen credentials because they expire and are scoped to the workload. Long-lived or embedded keys remain valid until rotated and are easily copied.

Question 29Cloud Architecture and Design

A SaaS provider hosts multiple customers in a single database schema. The application uses a tenant identifier in every query, but defects have previously allowed one tenant to read another tenant's records. Which control provides the strongest defense against this type of cross-tenant data exposure?

  1. Requiring each tenant to choose a strong password when users log in
  2. Database-enforced row-level security keyed to the authenticated tenant context Correct answer.
  3. Adding the tenant identifier to every application log entry so that audits can trace access
  4. Encrypting the entire database with one key that is shared by all tenants

Explanation

Row-level security enforced by the database applies the tenant predicate independently of application query construction, so a missing filter in application code does not expose another tenant's rows. Logging and authentication controls do not prevent the read from occurring.

Question 30Cloud Architecture and Design

A company must connect its on-premises data center to a public cloud for a latency-sensitive analytics platform that transfers several terabytes per day. Which connectivity approach is most appropriate?

  1. VPC peering between subnets inside the cloud region
  2. Public internet access with application-layer encryption only
  3. A site-to-site VPN tunnel over the public internet
  4. A dedicated private interconnect from the cloud or network carrier Correct answer.

Explanation

A dedicated private interconnect provides predictable bandwidth and lower, more consistent latency than internet-based tunnels for large sustained transfers. Site-to-site VPN is encrypted but its performance varies with internet conditions.

Question 31Cloud Architecture and Design

Which essential cloud characteristic enables a consumer to provision and release resources automatically as demand changes, giving the consumer the impression of unlimited capacity?

  1. Measured service
  2. Resource pooling
  3. Rapid elasticity Correct answer.
  4. Broad network access

Explanation

Rapid elasticity is the ability to scale resources outward and inward automatically to match demand. It lets the consumer use capacity when needed and release it afterward, which is why cloud capacity often appears unlimited to the consumer.

Question 32Cloud Architecture and Design

Which cloud deployment model is provisioned for exclusive use by a specific set of organizations that share common security or compliance concerns?

  1. Public cloud
  2. Private cloud
  3. Community cloud Correct answer.
  4. Hybrid cloud

Explanation

A community cloud is shared by several organizations with common concerns, such as a regulatory regime or industry requirement. The infrastructure may be managed by the members or a third party and can be on or off premises.

Question 33Cloud Architecture and Design

In the NIST cloud computing reference architecture, which actor negotiates relationships between cloud providers and cloud consumers and may add value to cloud services?

  1. Cloud broker Correct answer.
  2. Cloud consumer
  3. Cloud carrier
  4. Cloud auditor

Explanation

A cloud broker manages the use, performance, and delivery of cloud services and negotiates relationships between providers and consumers. The broker can aggregate, integrate, or enhance services from multiple providers.

Question 34Cloud Architecture and Design

A cloud governance team wants to prevent any storage bucket in newly created accounts from being made public, while still allowing exceptional access through an approved exception process. Which design best meets this objective?

  1. Publish a written development standard and rely on monthly manual reviews of public bucket settings
  2. Use an organization-level guardrail that denies public buckets without an approved exception Correct answer.
  3. Enable default encryption on all storage buckets and rotate customer keys annually
  4. Attach a deny-public bucket policy to every existing bucket and audit new buckets quarterly

Explanation

A preventive organization-level guardrail is applied by the cloud management plane and covers new and existing accounts. A written standard is detective at best, and per-bucket policies are difficult to keep complete across an estate.

Question 35Cloud Architecture and Design

An enterprise uses a SaaS human resources platform. In the shared responsibility model for SaaS, which activity remains primarily the customer's responsibility?

  1. Maintaining the provider's application code and database engine
  2. Patching the operating systems and middleware used by the platform
  3. Managing user identities, role assignments and periodic access reviews Correct answer.
  4. Securing the physical data centers that host the platform

Explanation

In SaaS, the provider operates the application, runtime, and infrastructure, while the customer governs its own users, data, and configuration. Customer responsibilities include authorizing access, reviewing entitlements, and protecting data it places in the service.

Question 36Cloud Architecture and Design

A workload in a private cloud subnet must read objects from the provider's object storage service without using the public internet. Which connectivity design should be implemented?

  1. Route traffic through a NAT gateway to the storage service's public endpoint
  2. Store credentials in the workload and call the public storage API over TLS
  3. Create a private endpoint for storage in the workload's virtual network Correct answer.
  4. Attach an internet gateway to the private subnet and restrict access by source IP

Explanation

A private endpoint keeps traffic to the provider's storage service on the provider's private network and avoids exposure through internet gateways. It also supports tighter network and identity controls than routing to a public endpoint.

Question 37Cloud Architecture and Design

A company wants employees to use one set of credentials for several SaaS applications and to enforce multifactor authentication consistently at sign-in. Which architecture should the company implement?

  1. Share a single service account across all SaaS applications and store its password in a team vault
  2. Create separate local administrator accounts for each SaaS application and rotate their passwords
  3. Federate SaaS authentication to a central identity provider using SAML or OIDC Correct answer.
  4. Require employees to connect through an IPsec VPN before using any SaaS application

Explanation

Identity federation lets the SaaS applications trust a central identity provider for authentication, so MFA and access policy are enforced in one place. It also simplifies joiner, mover, and leaver processes compared with per-application accounts.

Question 38Cloud Architecture and Design

An organization must keep encrypted cloud data under its own key control, including retaining key material outside the cloud provider's administrative boundary. Which approach best satisfies this requirement?

  1. Require TLS for all object storage requests and enforce a minimum protocol version
  2. Enable object versioning, MFA delete and cross-region replication on the bucket
  3. Use provider-managed encryption keys with automatic rotation and provider-controlled access
  4. Use customer-held keys in an external HSM or external key manager Correct answer.

Explanation

Holding key material in an external HSM or key manager outside the provider's administrative control supports customer key control and can support hybrid or bring-your-own-key models. Provider-managed keys and TLS alone do not give the customer independent control of key material.

Question 39Cloud Architecture and Design

A regulated workload relies on the cloud provider's API activity logs for evidence. The security team needs to detect if an administrator disables or alters logging in the workload account. Which design provides the strongest independent detection?

  1. Grant account administrators permission to disable logging during approved maintenance windows and then restore it afterward
  2. Keep logs only in the workload account and have workload administrators review them manually each quarter
  3. Rely on the provider's independent audit report as proof that logging cannot be changed by administrators
  4. Export logs to a separate restricted account with immutable storage and alert on logging changes Correct answer.

Explanation

Logging is only trustworthy for audit when administrators of the monitored account cannot silently alter or delete the evidence. Exporting to a separate account with immutable retention and independent alerts creates separation of duties and detects configuration tampering.

Question 40Cloud Architecture and Design

An application has a recovery point objective of 15 minutes and a recovery time objective of 2 hours for a regional outage. Which resilience design meets both objectives with the least operational complexity?

  1. Nightly backups to the same region with manual restore
  2. Synchronous active-active deployment across both regions with continuous dual writes
  3. Tape archive stored offsite with a 24-hour restore process
  4. Asynchronous cross-region replication with automated failover runbooks Correct answer.

Explanation

Asynchronous replication can meet a 15-minute RPO while automated failover supports a two-hour RTO at lower operational complexity than synchronous active-active. Synchronous active-active can meet tighter RPO but is not required and adds significant complexity.

Question 41Cloud Governance

What is the primary purpose of a cloud governance framework?

  1. To align cloud adoption with enterprise strategy, risk appetite, and compliance obligations Correct answer.
  2. To automate the provisioning of cloud infrastructure without human approval
  3. To reduce the unit cost of cloud services below the internal chargeback rate
  4. To migrate every remaining on-premises workload to a public cloud provider

Explanation

Cloud governance sets decision rights and accountability so that cloud use supports business objectives and stays within the organization's risk appetite and regulatory obligations. Cost optimization and automation are possible outcomes of good governance, but they are not its primary purpose.

Question 42Cloud Governance

Under the cloud shared responsibility model, which control area remains the customer's responsibility across IaaS, PaaS, and SaaS?

  1. Classifying data and managing user access to it Correct answer.
  2. Patching the hypervisor that separates tenant virtual machines
  3. Maintaining the provider's underlying network backbone
  4. Securing the physical perimeter of the provider's data centers

Explanation

Although the split of controls varies by service model, the customer always retains ownership of its data and responsibility for determining who may access it. Physical facilities, hypervisors, and provider backbone networks are generally provider-managed.

Question 43Cloud Governance

Which body is most appropriate for resolving conflicts between cloud speed-to-market goals and enterprise security requirements?

  1. The cloud operations team that runs the production environment
  2. The application owner who requested the cloud service
  3. The external audit firm engaged for the cloud assurance review
  4. A cross-functional cloud governance board with business and risk representation Correct answer.

Explanation

Cross-functional trade-offs require a decision-making forum with authority across business, security, risk, and finance. Operational teams execute decisions, auditors provide independent assurance, and individual application owners lack enterprise-wide authority.

Question 44Cloud Governance

A governance principle states that customer data must be protected according to its classification. Which artifact should translate this principle into a mandatory, measurable encryption requirement?

  1. A procedure describing how engineers request encryption keys
  2. A standard specifying approved algorithms and key lengths Correct answer.
  3. A runbook for rotating keys during an incident
  4. A guideline recommending encryption as a good practice

Explanation

Standards are mandatory requirements that operationalize policy principles and make them testable, such as approved algorithms and key lengths. Procedures and runbooks describe how to perform steps, while guidelines are recommended rather than mandatory.

Question 45Cloud Governance

A regulated enterprise wants ongoing assurance over a SaaS provider's controls without conducting continuous on-site monitoring. Which contract provision most directly supports this?

  1. Contractual audit rights and access to independent reports Correct answer.
  2. Most-favored-customer pricing for future purchases
  3. Service level credits for availability shortfalls
  4. Automatic renewal of the subscription at the end of each term

Explanation

Audit rights, coupled with access to independent attestations such as SOC 2 reports, give the customer a contractual basis to obtain and review assurance evidence. Pricing, credits, and renewal terms address commercial outcomes rather than control assurance.

Question 46Cloud Governance

A cloud provider is classified as low criticality because it will hold only public marketing content. What is the most appropriate governance response?

  1. Apply a lighter due diligence tier with documented rationale and periodic review Correct answer.
  2. Delegate all security decisions to the provider's account team
  3. Require the same on-site audit depth as for systems holding regulated data
  4. Skip due diligence entirely because the data is already public

Explanation

Risk-based governance scales due diligence to the criticality of the service and data, while still documenting the decision and reviewing it as circumstances change. Eliminating due diligence or delegating decisions removes accountability; applying the heaviest tier to low-risk content wastes resources.

Question 47Cloud Governance

Before committing a business-critical application to a PaaS provider, which governance artifact most directly addresses lock-in and the return of data at termination?

  1. The application's disaster recovery plan and test schedule
  2. The cloud account incident response plan and escalation path
  3. The enterprise business continuity plan for the data center
  4. An exit plan covering data export, transition, and deletion Correct answer.

Explanation

An exit plan defines how the organization will retrieve its data in usable formats, obtain transition assistance, and verify deletion when leaving a provider. DR, incident response, and BCP address disruptions, not orderly provider exit and data portability.

Question 48Cloud Governance

Several business units are buying SaaS tools outside the security review process. Which governance response is most likely to be effective and sustainable?

  1. Prohibit all cloud purchases until a central committee approves each one
  2. Publish a self-service catalog with embedded controls and fast review Correct answer.
  3. Transfer responsibility for shadow IT to the procurement department alone
  4. Rely on the annual internal audit to identify unapproved services after the fact

Explanation

Shadow IT is usually a symptom of a slow or unclear approval process, so a governed self-service catalog reduces the incentive to bypass controls while keeping risk visible. Blanket prohibition tends to drive usage further underground, and after-the-fact audit is detective rather than preventive.

Question 49Cloud Governance

Which metric best indicates that cloud governance is operating effectively rather than merely documented?

  1. The number of employees who attended cloud awareness training
  2. Percentage of deployments passing automated policy checks before release Correct answer.
  3. The number of cloud policies published on the intranet
  4. The number of cloud governance meetings held each quarter

Explanation

An effectiveness metric should reflect whether controls change outcomes, such as deployments meeting policy before they reach production. Policy counts, training attendance, and meeting frequency measure activity or inputs, not whether governance is actually preventing noncompliant cloud use.

Question 50Cloud Governance

A cloud governance board sees recurring exceptions to a mandatory resource-tagging policy. What is the most appropriate next step?

  1. Revoke all prior exceptions and enforce the policy immediately
  2. Increase penalties for teams requesting exceptions
  3. Ignore exceptions because each was formally approved
  4. Analyze exception root causes and adjust policy or controls Correct answer.

Explanation

Frequent exceptions often signal that a policy is impractical or poorly communicated, so governance should examine patterns and revise the rule or its supporting controls. Simply revoking exceptions or raising penalties treats symptoms and may increase hidden noncompliance.