I85PREP
⌘ K
CCSO study materials
CCSO study resources

CCSO practice questions

One question at a time. Build your CCSO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Governance, Risk, and Compliance

In a cloud GRC program, what is the primary purpose of maintaining a shared responsibility matrix between the provider and the customer?

  1. To document which security and compliance obligations each party owns across the service model Correct answer.
  2. To assign every control in the environment to the cloud provider
  3. To replace the need for a formal risk register
  4. To certify that the provider meets all regulatory requirements on the customer's behalf

Explanation

A shared responsibility matrix clarifies the division of controls between provider and customer so that neither party assumes coverage that does not exist. Because obligations shift across IaaS, PaaS, and SaaS, the matrix must be mapped per service model and per control area.

Question 2Cloud Governance, Risk, and Compliance

A governance team wants policy enforcement to be automatic and preventive rather than manual and detective. Which cloud capability best supports this goal?

  1. A quarterly steering committee meeting
  2. Monthly manual review of configuration exports
  3. Annual third-party penetration testing
  4. Policy-as-code guardrails integrated into the deployment pipeline Correct answer.

Explanation

Policy-as-code expresses governance rules as machine-enforceable checks that block noncompliant deployments before they reach production. This shifts control from after-the-fact detection to preventive enforcement at the point of change.

Question 3Cloud Governance, Risk, and Compliance

Which document should a customer request first to understand a cloud provider's independently audited control environment?

  1. The provider's marketing security whitepaper
  2. An internal architecture diagram shared under NDA
  3. The provider's public status page history
  4. A SOC 2 Type II report or equivalent independent attestation Correct answer.

Explanation

A SOC 2 Type II report or equivalent attestation provides independent auditor testing of controls over a period, which is the strongest starting evidence of the provider's control effectiveness. Whitepapers and diagrams are self-reported and unaudited.

Question 4Cloud Governance, Risk, and Compliance

A risk register entry records a data residency risk with high likelihood and high impact. What does the treatment decision 'accept' mean in this context?

  1. The risk is transferred to the cloud provider through the contract
  2. The risk is monitored only by the security operations team
  3. The organization consciously retains the risk with documented rationale and owner sign-off Correct answer.
  4. The risk is removed by eliminating the affected workload

Explanation

Acceptance means leadership knowingly retains a residual risk, records the justification, and assigns accountability. It requires documented approval at the appropriate authority level rather than passive inaction.

Question 5Cloud Governance, Risk, and Compliance

What is the main compliance value of tagging cloud resources with data classification and owner metadata?

  1. It encrypts data at rest without additional configuration
  2. It enables scoping, reporting, and control targeting based on sensitivity and accountability Correct answer.
  3. It guarantees the resource will pass every regulatory audit
  4. It reduces the cost of compute instances automatically

Explanation

Classification and ownership tags let governance teams scope controls, produce evidence by data sensitivity, and route accountability. Tags make policy targeting and reporting possible across large, dynamic estates.

Question 6Cloud Governance, Risk, and Compliance

Which practice best demonstrates continuous compliance monitoring in a cloud environment?

  1. Collecting screenshots of console settings once per year
  2. Relying solely on the provider's certification badge
  3. Interviewing engineers during the annual audit
  4. Automated configuration checks that evaluate resources against baselines and alert on drift Correct answer.

Explanation

Continuous monitoring uses automated, recurring evaluation of resource configuration against defined baselines and flags drift as it occurs. This provides near-real-time assurance instead of point-in-time snapshots.

Question 7Cloud Governance, Risk, and Compliance

In cloud governance, what does the principle of least privilege require for identity and access management?

  1. Disabling multi-factor authentication for automated jobs
  2. Granting broad administrator roles to reduce support tickets
  3. Sharing a single service account across all teams
  4. Granting only the permissions needed to perform a defined task, for the minimum necessary duration Correct answer.

Explanation

Least privilege limits permissions to what a task requires and constrains how long they are held, reducing blast radius if credentials are compromised. It applies to human and machine identities alike.

Question 8Cloud Governance, Risk, and Compliance

Why should a cloud governance charter define decision rights and escalation paths?

  1. To ensure accountability and timely resolution when policy exceptions or conflicts arise Correct answer.
  2. To shift all compliance liability to the cloud provider
  3. To eliminate the need for a cloud center of excellence
  4. To guarantee that no policy exceptions are ever approved

Explanation

Clear decision rights establish who can approve exceptions, who owns outcomes, and how disputes escalate, which keeps governance responsive. Without them, exceptions stall or get approved informally without accountability.

Question 9Cloud Governance, Risk, and Compliance

An organization stores regulated customer data in a cloud region that its regulator does not permit. Which governance control failed most directly?

  1. Incident response tabletop exercises
  2. Data residency enforcement through region restrictions Correct answer.
  3. Backup encryption
  4. Patch management cadence

Explanation

Data residency requirements constrain where data may be stored and processed, so region restrictions must be enforced through policy and technical guardrails. Storing data in a prohibited region is a direct failure of that control.

Question 10Cloud Governance, Risk, and Compliance

A team proposes deploying a new SaaS tool that will process personal data. Which sequence best reflects a risk-based third-party assessment?

  1. Classify the data, assess the vendor's controls and contract terms, then decide with documented conditions Correct answer.
  2. Approve the tool, then perform a security review after go-live
  3. Rely on the vendor's self-assessment questionnaire alone
  4. Reject all SaaS tools to avoid third-party risk

Explanation

A risk-based assessment first classifies the data involved, then evaluates the vendor's control evidence and contractual obligations before a decision. The outcome should be documented with any conditions or compensating controls.

Question 11Cloud Governance, Risk, and Compliance

A cloud team wants to prove that encryption at rest is enabled on all storage buckets holding sensitive data. Which evidence approach is most reliable?

  1. Querying configuration state programmatically and retaining timestamped results mapped to the control Correct answer.
  2. Asking the engineering lead to confirm it verbally
  3. Reviewing the provider's encryption whitepaper
  4. Checking a single sample bucket manually each quarter

Explanation

Programmatic queries over the full population provide complete, reproducible, timestamped evidence tied to the specific control. This is more defensible than sampling or narrative confirmation.

Question 12Cloud Governance, Risk, and Compliance

A compliance team needs to map cloud controls to a regulatory framework. What is the most effective approach to reduce duplicated effort?

  1. Create a separate control set for each regulation with no cross-references
  2. Build a unified control catalog mapped to multiple frameworks through common control objectives Correct answer.
  3. Map controls only after an audit finding occurs
  4. Rely on the provider's compliance page as the sole mapping

Explanation

A unified control catalog with cross-framework mappings lets one implemented control satisfy multiple regulatory obligations. This avoids redundant testing and keeps evidence reusable across audits.

Question 13Cloud Governance, Risk, and Compliance

A developer requests a policy exception to open a database port to the internet for a short-term test. What is the most appropriate governance response?

  1. Approve the exception permanently to avoid future requests
  2. Require a time-bound exception with compensating controls, risk acceptance, and automatic expiry Correct answer.
  3. Deny all exceptions regardless of justification
  4. Grant the exception and rely on monitoring to catch misuse

Explanation

Time-bound exceptions with compensating controls and documented risk acceptance balance business need against exposure. Automatic expiry ensures the exposure does not become permanent through neglect.

Question 14Cloud Governance, Risk, and Compliance

Which metric best indicates whether a cloud governance program is operating effectively rather than merely existing?

  1. The number of pages in the governance policy document
  2. The number of steering committee members
  3. The total cloud spend for the quarter
  4. The percentage of resources compliant with baselines and the mean time to remediate drift Correct answer.

Explanation

Compliance rate and remediation speed measure whether controls actually operate and how quickly deviations are corrected. These outcome metrics reflect program effectiveness better than activity or volume indicators.

Question 15Cloud Governance, Risk, and Compliance

An organization operates in multiple jurisdictions and must satisfy conflicting retention requirements for the same dataset. What is the most defensible governance approach?

  1. Apply the shortest retention period everywhere to minimize storage
  2. Retain all data indefinitely to avoid violating any rule
  3. Document the conflict, determine the controlling legal obligation per data category, and enforce retention through automated lifecycle policies Correct answer.
  4. Let individual teams decide retention locally without documentation

Explanation

Conflicting obligations require documented legal analysis of which requirement governs each data category, followed by automated enforcement. Lifecycle policies make retention objective and auditable rather than discretionary.

Question 16Cloud Governance, Risk, and Compliance

A cloud center of excellence is being established. Which responsibility set best fits its mandate?

  1. Owning all production application code and release schedules
  2. Performing all security incident response for the enterprise
  3. Defining guardrails, reference architectures, and reusable patterns while enabling teams to self-serve Correct answer.
  4. Approving every individual cloud resource request manually

Explanation

A center of excellence sets standards, guardrails, and reusable patterns that let product teams move quickly within safe boundaries. Its value comes from enablement and consistency rather than manual gatekeeping.

Question 17Cloud Governance, Risk, and Compliance

During an audit, an assessor asks for evidence that access reviews occurred for privileged cloud roles. Which artifact best satisfies this request?

  1. Completed, dated access review records showing reviewer decisions and remediation of inappropriate access Correct answer.
  2. A screenshot of the IAM console showing current users
  3. The identity provider's product documentation
  4. The organization's password complexity policy

Explanation

Access review evidence must show that a reviewer examined entitlements, made decisions, and that inappropriate access was removed. Dated records with outcomes demonstrate the control operated over the audit period.

Question 18Cloud Governance, Risk, and Compliance

A workload's risk rating increases after a new integration exposes it to external partners. What governance action follows most directly from this change?

  1. No action is needed because the workload already passed review
  2. Immediately decommission the workload
  3. Reassess the risk, review applicable controls and contracts, and update the register and approvals Correct answer.
  4. Lower the rating to reflect partner trust

Explanation

Material changes to a system's exposure trigger reassessment of risk, controls, and third-party obligations. The risk register and approvals must reflect the new context so decisions stay current.

Question 19Cloud Governance, Risk, and Compliance

Which contract term most directly supports a customer's ability to audit a cloud provider's compliance posture?

  1. A right-to-audit clause plus commitments to provide current independent attestation reports Correct answer.
  2. A pricing schedule with volume discounts
  3. A clause guaranteeing 99.9 percent uptime
  4. A limitation of liability cap

Explanation

Right-to-audit provisions and commitments to deliver current attestation reports give the customer ongoing assurance over provider controls. Uptime commitments and pricing terms address availability and cost, not compliance evidence.

Question 20Cloud Governance, Risk, and Compliance

An organization's cloud estate grows rapidly through decentralized provisioning. Which governance model best preserves agility while maintaining oversight?

  1. Require every team to build its own compliance process
  2. Provide self-service through pre-approved, policy-enforced templates with automated guardrails Correct answer.
  3. Remove all controls to accelerate delivery
  4. Centralize all provisioning through a single manual approval queue

Explanation

Pre-approved templates with automated guardrails let teams provision quickly within defined boundaries. This scales oversight through automation instead of becoming a bottleneck of manual approvals.

Question 21Cloud Governance, Risk, and Compliance

A regulator requires evidence that security incidents were detected and resolved within defined timeframes. Which governance artifact best demonstrates this?

  1. The list of monitoring tools deployed
  2. Incident records showing detection time, response actions, resolution time, and post-incident review Correct answer.
  3. The provider's service level agreement
  4. The incident response policy document alone

Explanation

Incident records with timestamps and outcomes show that detection and resolution actually met the required timeframes. Policies and tool inventories describe intent and capability, not operational performance.

Question 22Cloud Governance, Risk, and Compliance

A governance team must decide whether to remediate a noncompliant storage configuration now or defer it. Which analysis is most relevant?

  1. The sensitivity of the data exposed, exploitability, and the cost and speed of remediation Correct answer.
  2. The number of engineers who have console access
  3. The team's preference for the current configuration
  4. The age of the storage service in the provider's portfolio

Explanation

Prioritization should weigh the risk exposure, including data sensitivity and exploitability, against the effort and speed of remediation. This produces a defensible, risk-based decision rather than a preference-driven one.

Question 23Cloud Governance, Risk, and Compliance

Two business units deploy to the same cloud account using different logging standards. What is the most effective governance remedy?

  1. Disable logging in the account to reduce complexity
  2. Allow each unit to keep its own standard to avoid friction
  3. Define a mandatory baseline logging control, enforce it centrally, and require exceptions through a documented process Correct answer.
  4. Rely on the provider's default logging without configuration

Explanation

A mandatory baseline enforced centrally ensures consistent evidence and detection across units sharing an account. Exceptions stay controlled and documented so consistency is not sacrificed for flexibility.

Question 24Cloud Governance, Risk, and Compliance

An auditor questions whether a control is designed effectively and operating effectively. How should the governance team distinguish these two assessments?

  1. Design effectiveness is assessed annually and operating effectiveness only at go-live
  2. Both are demonstrated by the same configuration screenshot
  3. Design effectiveness looks at whether the control is capable of meeting the objective, while operating effectiveness looks at whether it actually functioned consistently over the period Correct answer.
  4. Operating effectiveness is proven by the policy document, and design effectiveness by interviews

Explanation

Design effectiveness asks whether a control, as specified, can achieve the control objective; operating effectiveness asks whether it was applied consistently during the period. Both dimensions are needed for a complete conclusion.

Question 25Cloud Governance, Risk, and Compliance

A cloud provider's attestation report includes a qualified opinion on one control area relevant to the customer. What is the most appropriate governance response?

  1. Ignore the qualification because the rest of the report is unqualified
  2. Assess the qualification's impact on the customer's data, implement compensating controls, and document the risk decision Correct answer.
  3. Terminate the relationship immediately without analysis
  4. Accept the qualification as proof the control is effective

Explanation

A qualification signals a control exception that may affect the customer's obligations, so its scope and impact must be analyzed. Compensating controls and documented risk decisions address the gap until remediation is confirmed.

Question 26Cloud Governance, Risk, and Compliance

Which document in a cloud governance program formally assigns accountability for each cloud service to a named owner?

  1. A responsibility assignment matrix covering cloud services Correct answer.
  2. A change calendar listing upcoming maintenance windows
  3. A monthly cloud spend forecast by business unit
  4. A network topology diagram of the cloud landing zone

Explanation

Accountability in cloud governance is assigned through an explicit responsibility assignment matrix (such as a RACI) that maps each service or control to an accountable owner. Without that mapping, ownership stays implicit and gaps go unnoticed during audits. Cost forecasts, topology diagrams, and change calendars document operational facts but assign no accountability.

Question 27Cloud Governance, Risk, and Compliance

A cloud governance team wants a repeatable way to decide which cloud risks to treat first when resources are limited. Which approach is most appropriate?

  1. Prioritize risks that affect the largest number of cloud accounts
  2. Treat risks in the order they were first reported by engineering teams
  3. Rank risks by likelihood and business impact, then treat the highest combined scores first Correct answer.
  4. Address the risks that are cheapest to remediate before any others

Explanation

Risk-based prioritization compares each risk's likelihood of occurrence against its potential business impact, and treatment effort follows the highest combined exposure. This ensures scarce governance effort targets the risks that matter most to the organization. Order of reporting, account count, and remediation cost alone are not measures of risk.

Question 28Cloud Governance, Risk, and Compliance

What is the primary purpose of a cloud governance policy on data residency?

  1. To minimize the number of cloud regions the organization uses for cost reasons
  2. To standardize the naming convention for storage resources across regions
  3. To constrain where data may be stored and processed to satisfy legal and contractual obligations Correct answer.
  4. To require that all cloud data be encrypted with provider-managed keys

Explanation

A data residency policy restricts the geographic locations where data can be stored and processed so the organization meets legal, regulatory, and contractual requirements. It is a legal and compliance constraint, not a cost optimization or encryption standard. Region reduction, key management, and naming conventions may be governed separately but do not define residency.

Question 29Cloud Governance, Risk, and Compliance

A compliance analyst must show that a cloud control remained effective throughout the quarter, not just on the day of the audit. Which evidence type best supports this claim?

  1. A signed policy document stating the control is mandatory
  2. A continuous stream of configuration compliance findings with timestamps covering the full period Correct answer.
  3. A screenshot of the control configuration captured on the audit date
  4. A vendor marketing brief describing the control's capabilities

Explanation

Operating effectiveness over a period requires evidence that spans that period, such as timestamped continuous compliance findings showing the control state throughout the quarter. A single-day screenshot proves only point-in-time configuration. Policy documents and vendor briefs describe intent or capability rather than actual operation.

Question 30Cloud Governance, Risk, and Compliance

An organization's cloud governance board meets quarterly and reviews a backlog of policy exceptions. Which change would most improve the timeliness of risk decisions without weakening oversight?

  1. Delegate low-risk exception approvals to a standing working group with reporting back to the board Correct answer.
  2. Increase the exception backlog threshold so fewer items reach the board
  3. Require every exception, regardless of risk, to be approved by the full board
  4. Cancel the board meetings and let engineering managers approve all exceptions

Explanation

Tiered decision rights let a delegated working group handle low-risk exceptions quickly while the board retains oversight through reporting and keeps authority over high-risk items. This preserves accountability and shortens cycle time. Removing oversight or pushing all decisions to the full board either weakens control or worsens delays, and raising the backlog threshold merely hides the problem.

Question 31Cloud Governance, Risk, and Compliance

A cloud security team wants to enforce that no storage bucket containing regulated data is created without logging enabled. Which governance mechanism enforces this at provisioning time?

  1. A detective scan that reports noncompliant buckets the following week
  2. A quarterly attestation signed by each engineering director
  3. A preventive policy in the cloud platform that blocks noncompliant resource creation Correct answer.
  4. A training module that teaches engineers to enable logging

Explanation

Preventive controls enforced by the platform stop noncompliant resources from being created, which is the only mechanism that acts at provisioning time. Detective scans, training, and attestations operate after the fact or rely on human behavior. A layered program uses all of them, but only the preventive policy guarantees the configuration.

Question 32Cloud Governance, Risk, and Compliance

A cloud governance team is defining key risk indicators for its program. Which indicator most directly signals deteriorating control health?

  1. A rising number of governance policies published in the repository
  2. A rising count of resources that remain noncompliant beyond the remediation SLA Correct answer.
  3. A rising number of cloud accounts provisioned per month
  4. A rising percentage of workloads deployed through infrastructure as code

Explanation

A key risk indicator should measure exposure, and resources lingering past the remediation SLA show that detected issues are not being resolved within agreed timeframes. That trend reflects weakening control effectiveness. Account growth, IaC adoption, and policy volume describe activity or maturity, not risk exposure.

Question 33Cloud Governance, Risk, and Compliance

A multinational company must retain the same customer records for seven years in one country and delete them after two years in another. Which governance response is most defensible?

  1. Segment the data by jurisdiction, apply location-specific retention rules, and document the legal basis for each Correct answer.
  2. Apply the longest retention period everywhere to avoid any risk of premature deletion
  3. Apply the shortest retention period everywhere to minimize stored personal data
  4. Retain the data indefinitely in a single centralized location and restrict access

Explanation

Conflicting retention obligations are managed by segmenting data according to jurisdiction and applying the applicable rule to each segment, with the legal basis recorded for auditability. Applying one period globally either violates a deletion mandate or a retention mandate in some jurisdiction. Indefinite retention breaches deletion obligations and data minimization principles.

Question 34Cloud Governance, Risk, and Compliance

A third-party SaaS provider will process regulated data for a business unit. Which governance artifact most directly establishes the customer's right to obtain independent assurance about the provider?

  1. A data processing addendum listing the categories of personal data
  2. An internal risk register entry recording the vendor's name
  3. A contractual audit rights clause with a defined notice period and scope Correct answer.
  4. A service level agreement specifying uptime percentage

Explanation

The right to audit or obtain independent assurance reports is granted through a contractual audit rights clause that defines scope, notice, and frequency. A risk register entry records the vendor but grants no rights. Uptime SLAs address availability, and a data processing addendum addresses processing terms rather than assurance access.

Question 35Cloud Governance, Risk, and Compliance

A cloud governance lead wants assurance that control mappings remain valid as the organization adopts new services. Which practice best maintains mapping integrity over time?

  1. Review and revalidate control mappings whenever a new service is onboarded or a framework is revised Correct answer.
  2. Store the mapping in a spreadsheet that only the governance lead can edit
  3. Assign mapping ownership to the internal audit function permanently
  4. Freeze the control mapping once approved and revisit it only at the next external audit

Explanation

Control mappings decay as services and frameworks change, so they must be revalidated at defined triggers such as service onboarding or framework revision. Freezing the mapping guarantees drift, and concentrating ownership or edit access in one person creates a bottleneck and single point of failure.

Question 36Cloud Governance, Risk, and Compliance

A cloud governance team needs to demonstrate that privileged access was reviewed regularly for the past year. Which combination of artifacts provides the strongest evidence?

  1. Dated access review records with reviewer decisions plus the system logs confirming changes were applied Correct answer.
  2. An org chart showing who holds privileged roles today
  3. A training certificate for the administrator who performs reviews
  4. A policy stating that access reviews occur quarterly

Explanation

Strong evidence pairs the review record, which shows the decision and reviewer, with system logs confirming that the resulting changes were actually implemented. Together they address both design and operating effectiveness. A policy states intent, a current org chart shows only present state, and a training certificate shows competence rather than performance of reviews.

Question 37Cloud Governance, Risk, and Compliance

A cloud governance committee must approve a workload whose risk rating rose after integration with an external partner. Which action best reflects a risk-based governance response?

  1. Reject the workload outright because any risk increase is unacceptable
  2. Defer the decision until the next annual review cycle
  3. Approve the workload because it was previously accepted at a lower risk rating
  4. Reassess the risk against the organization's risk appetite and require additional controls before approval Correct answer.

Explanation

When a risk profile changes, governance should reassess it against the defined risk appetite and impose proportionate controls before approval. Prior acceptance applied to a different risk level and does not carry forward automatically. Blanket rejection ignores proportionality, and deferral leaves an unmanaged exposure in production.

Question 38Cloud Governance, Risk, and Compliance

An organization discovers that two cloud accounts were provisioned outside the approved landing zone and lack central logging. Which remediation sequence best restores governance?

  1. Delete both accounts immediately to eliminate the exposure
  2. Add the accounts to the exception register and continue operating unchanged
  3. Contain the accounts by enforcing logging and guardrails, assess what was deployed and why, then close the process gap that allowed it Correct answer.
  4. Disable the guardrails in the landing zone so the accounts can be enrolled later

Explanation

The priority is to contain exposure by enforcing logging and guardrails, then understand what was deployed and why, and finally fix the provisioning gap that permitted unapproved accounts. Immediate deletion risks data loss and service disruption without understanding impact. Registering an exception leaves the exposure, and weakening guardrails makes the problem worse.

Question 39Cloud Governance, Risk, and Compliance

A regulator requires that cloud incidents be detected and resolved within defined timeframes. Which governance measure provides the most reliable ongoing assurance?

  1. Automated tracking of detection and resolution timestamps against thresholds, with escalation on breach Correct answer.
  2. A policy clause requiring teams to resolve incidents promptly
  3. A quarterly manual sample of incident tickets reviewed by the governance board
  4. An annual tabletop exercise that simulates a single incident

Explanation

Continuous automated measurement of detection and resolution timestamps against defined thresholds, with escalation when they are breached, provides reliable ongoing assurance across all incidents. Manual sampling covers only a subset, a single exercise tests preparedness rather than actual performance, and a policy clause states an expectation without measuring it.

Question 40Cloud Governance, Risk, and Compliance

A cloud provider's independent attestation report contains a qualified opinion on one control area that affects the customer's regulated workload. How should the governance team respond?

  1. Assess the customer's own compensating controls for the affected area and document the residual risk decision Correct answer.
  2. Ignore the qualification because the remaining control areas are unqualified
  3. Rely on the provider's marketing statement that the issue has been resolved
  4. Treat the entire attestation as invalid and terminate the provider relationship

Explanation

A qualified opinion is scoped to a specific control area, so the team should determine whether the customer's own compensating controls mitigate that gap and record the residual risk decision for governance approval. Treating the whole report as invalid overreacts to a scoped finding. Ignoring the qualification or relying on marketing statements leaves the risk unassessed.

Question 41Cloud Architecture and Shared Responsibility

In the cloud shared responsibility model, which responsibility always remains with the customer regardless of the service model (IaaS, PaaS, or SaaS)?

  1. Classifying their own data and controlling who can access it Correct answer.
  2. Managing the physical security of the data center
  3. Maintaining the underlying network hardware
  4. Patching the hypervisor layer

Explanation

Data classification, access governance, and identity decisions stay with the customer in every service model because the provider cannot know the sensitivity or business context of the data. The provider handles physical, hypervisor, and network hardware layers that sit beneath the customer's control boundary.

Question 42Cloud Architecture and Shared Responsibility

A team deploys a managed relational database service. Under the shared responsibility model, which task falls to the customer?

  1. Applying the database engine's minor version patches
  2. Maintaining the storage subsystem firmware
  3. Configuring database user accounts and their permissions Correct answer.
  4. Ensuring physical redundancy of the database hosts

Explanation

With a managed database, the provider patches the engine and maintains the hosts and storage, but identity and authorization inside the database remain customer-controlled. Account provisioning and permission scoping are access-management duties that never transfer to the provider.

Question 43Cloud Architecture and Shared Responsibility

Which statement best describes the provider's responsibility for data in a public cloud under the shared responsibility model?

  1. The provider is responsible for the confidentiality of customer data content.
  2. The provider approves each customer data classification decision.
  3. The provider owns customer data once it is written to cloud storage.
  4. The provider secures the infrastructure that stores data but does not decide who may access it. Correct answer.

Explanation

Providers secure the physical and logical infrastructure hosting data, but authorization, classification, and content-level protection remain customer duties. Ownership of data stays with the customer, and the provider does not make classification decisions.

Question 44Cloud Architecture and Shared Responsibility

In an IaaS deployment, which layer does the customer typically manage?

  1. The hypervisor and its updates
  2. The guest operating system and its patches Correct answer.
  3. The data center power distribution
  4. The physical host firmware

Explanation

In IaaS the provider manages physical hosts, hypervisor, and facility, while the customer manages the guest operating system, middleware, and applications. Patching the guest OS is therefore a customer task.

Question 45Cloud Architecture and Shared Responsibility

Which concept describes the boundary where provider-managed controls end and customer-managed controls begin?

  1. The responsibility boundary Correct answer.
  2. The trust boundary of the control plane
  3. The data residency line
  4. The network perimeter

Explanation

The responsibility boundary marks which controls the provider operates and which the customer must operate. It shifts depending on the service model but is always defined explicitly in the shared responsibility documentation.

Question 46Cloud Architecture and Shared Responsibility

A customer uses a serverless function service. Which security control is most clearly the customer's responsibility?

  1. Writing least-privilege code and scoping the function's execution role Correct answer.
  2. Patching the runtime that executes the function
  3. Maintaining the availability zone infrastructure
  4. Hardening the underlying compute hosts

Explanation

In serverless models the provider manages runtime, hosts, and availability zones, while the customer owns the function code and the permissions it runs with. Least-privilege execution roles are a core customer control.

Question 47Cloud Architecture and Shared Responsibility

An organization wants to verify that a cloud provider's controls meet its compliance obligations. Which artifact is the most direct source of provider-side control evidence?

  1. The provider's marketing brochure
  2. The service-level agreement uptime percentage
  3. The customer's internal risk register
  4. The provider's independent audit reports and certifications Correct answer.

Explanation

Independent audit reports and certifications document the provider's control environment against recognized frameworks. Marketing materials and SLAs do not provide control-level assurance, and an internal risk register reflects customer, not provider, controls.

Question 48Cloud Architecture and Shared Responsibility

When a customer moves from IaaS to a managed container platform, how does the shared responsibility boundary typically shift?

  1. The provider assumes responsibility for the container host and orchestration control plane. Correct answer.
  2. The customer gains responsibility for the container host operating system.
  3. The customer becomes responsible for the physical network fabric.
  4. The provider assumes responsibility for the application's business logic.

Explanation

A managed container platform moves host and orchestration control-plane operations to the provider. The customer retains responsibility for workloads, images, and configuration, while the provider handles the underlying nodes in most managed offerings.

Question 49Cloud Architecture and Shared Responsibility

Which activity is a customer responsibility even when using a fully managed SaaS application?

  1. Managing the application's identity federation and user provisioning Correct answer.
  2. Patching the SaaS application servers
  3. Operating the SaaS database engine
  4. Securing the SaaS provider's physical facilities

Explanation

In SaaS the provider operates the application, database, and facilities, but the customer governs who within its organization can access the application. Identity federation and user lifecycle provisioning remain customer duties.

Question 50Cloud Architecture and Shared Responsibility

A security architect is mapping controls for a workload that stores regulated data in object storage. Which control pair is entirely customer-owned?

  1. Storage media disposal and drive sanitization
  2. Data classification and access policy definition Correct answer.
  3. Bucket encryption at rest and storage durability
  4. Object storage service availability

Explanation

Classification and access policy are governance decisions the customer must make and enforce. Durability, media sanitization, and service availability are provider-operated controls.