I85PREP
⌘ K
Certified Cloud Security Analyst study materials
Certified Cloud Security Analyst study resources

Certified Cloud Security Analyst practice questions

One question at a time. Build your Certified Cloud Security Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Security Fundamentals and Governance

Under the shared responsibility model for a SaaS application, which security control remains the customer's responsibility?

  1. Patching the application servers that host the service
  2. Maintaining the physical security of the data center
  3. Securing the hypervisor that isolates tenants
  4. Managing user identities, roles, and access within the tenant Correct answer.

Explanation

In SaaS the provider owns the infrastructure, platform, and application code, while the customer remains accountable for its own data, identity configuration, and access governance inside the tenant. Identity and access management is therefore the classic customer-side control in a SaaS deployment.

Question 2Cloud Security Fundamentals and Governance

A cloud governance board wants to prevent engineers from launching resources in regions where the organization has no legal presence. Which control type best enforces this at the platform level?

  1. A preventive control using organization-level policy constraints Correct answer.
  2. A corrective control using automated incident tickets
  3. A detective control using monthly billing reports
  4. A compensating control using network segmentation

Explanation

Preventive controls stop an action before it happens, and organization-level policy constraints (such as service control policies or organization policies) block resource creation in disallowed regions at the API layer. Detective and corrective controls only notice or remediate the issue after the resource exists.

Question 3Cloud Security Fundamentals and Governance

Which characteristic most distinguishes a public cloud deployment model from a private cloud?

  1. Customers must accept weaker security controls than in a private data center
  2. The provider is always a third-party company rather than the owning organization
  3. Resources are pooled and delivered to multiple unrelated tenants over a provider network Correct answer.
  4. Workloads are billed only on a fixed annual subscription

Explanation

The defining trait of public cloud is multi-tenant resource pooling delivered over a provider network to many independent customers. Ownership by a third party, pricing model, and control strength are not definitional and can vary.

Question 4Cloud Security Fundamentals and Governance

An organization wants to prove to auditors that privileged access to a production cloud account is reviewed quarterly. Which artifact most directly satisfies this governance requirement?

  1. The account's network flow logs for the quarter
  2. The cloud provider's SOC 2 report for the underlying platform
  3. Signed access review records showing reviewer decisions and dates Correct answer.
  4. The disaster recovery test summary for the quarter

Explanation

Access reviews are a customer-side governance control, and the evidence is the completed review record showing who reviewed which entitlements and when. Provider attestations cover the provider's controls, not the customer's own review process.

Question 5Cloud Security Fundamentals and Governance

What is the primary purpose of a cloud center of excellence (CCoE) in governance?

  1. To replace the organization's internal audit function
  2. To operate the provider's physical infrastructure on behalf of tenants
  3. To approve every individual resource deployment manually
  4. To centralize standards, guardrails, and reusable patterns across cloud teams Correct answer.

Explanation

A CCoE is a cross-functional body that sets standards, builds guardrails and reference architectures, and spreads cloud expertise so teams adopt consistent practices. It enables teams rather than manually approving each deployment.

Question 6Cloud Security Fundamentals and Governance

A team stores regulated data in an object storage bucket and wants assurance that data is encrypted at rest with keys the organization controls and can revoke. Which approach meets this requirement?

  1. Client-side compression before upload
  2. Transport encryption using TLS on the bucket endpoint
  3. Provider-managed encryption keys with default settings
  4. Customer-managed keys held in a controlled key management service Correct answer.

Explanation

Customer-managed keys give the organization control over key lifecycle, rotation, and revocation, which provider-managed keys do not. TLS protects data in transit and compression is not encryption.

Question 7Cloud Security Fundamentals and Governance

Which document typically defines the provider's commitment to service availability and the remedies available if it is missed?

  1. The shared responsibility matrix
  2. The service level agreement Correct answer.
  3. The acceptable use policy
  4. The penetration test report

Explanation

The service level agreement states measurable commitments such as uptime targets and the credits or remedies if the provider fails to meet them. Other documents cover usage rules, responsibility split, or assessment results.

Question 8Cloud Security Fundamentals and Governance

An auditor asks how the organization ensures that a cloud workload complies with an internal baseline before deployment. Which practice provides the strongest preventive assurance?

  1. Sampling deployed workloads once a year
  2. Reviewing the workload in a post-incident report
  3. Enforcing the baseline as code in the deployment pipeline Correct answer.
  4. Documenting the baseline in a wiki page

Explanation

Policy as code embedded in the pipeline evaluates configurations before release and blocks noncompliant deployments, making it preventive and repeatable. Documentation, sampling, and post-incident review are weaker and largely detective or reactive.

Question 9Cloud Security Fundamentals and Governance

Which risk is most specifically introduced by multi-tenancy in a public cloud environment?

  1. Loss of the ability to encrypt data at rest
  2. Cross-tenant exposure through a provider-side isolation failure Correct answer.
  3. Inability to obtain audit logs from the provider
  4. Permanent vendor lock-in for all workloads

Explanation

Multi-tenancy means tenants share underlying infrastructure, so a flaw in provider isolation could expose one tenant's data to another. Encryption, logging, and portability remain available and are separate concerns.

Question 10Cloud Security Fundamentals and Governance

In a cloud governance framework, what does a guardrail (as opposed to a guideline) do?

  1. Technically or procedurally constrains actions that violate policy Correct answer.
  2. Transfers risk to the cloud provider
  3. Records deviations for annual reporting only
  4. Recommends preferred configurations that teams may follow voluntarily

Explanation

Guardrails enforce boundaries so that noncompliant actions are blocked or flagged, whereas guidelines are advisory. Guardrails do not transfer risk to the provider, which only owns its own layer of the stack.

Question 11Cloud Security Fundamentals and Governance

A company must retain cloud audit logs for seven years to satisfy a regulator, but the provider's native log retention is 90 days. What is the appropriate governance response?

  1. Disable logging to reduce storage cost
  2. Rely on provider backups to recover old logs on request
  3. Accept the 90-day limit because the provider is responsible for retention
  4. Export logs to an immutable long-term archive under the organization's control Correct answer.

Explanation

Log retention obligations belong to the customer, so logs must be exported to a controlled, tamper-resistant archive that meets the required period. Provider defaults and backups are not substitutes for a designed retention control.

Question 12Cloud Security Fundamentals and Governance

Which concept describes the ability to move workloads and data between providers with limited rework?

  1. Portability Correct answer.
  2. Elasticity
  3. Federation
  4. Durability

Explanation

Portability is the capacity to relocate workloads and data across environments or providers without major redesign. Elasticity concerns scaling, durability concerns data persistence, and federation concerns identity or trust across domains.

Question 13Cloud Security Fundamentals and Governance

A regulated firm wants its cloud provider to be independently assessed against a widely recognized security control framework and to receive the resulting report under NDA. Which artifact should it request?

  1. An independent third-party attestation report such as SOC 2 Type II Correct answer.
  2. The provider's internal disaster recovery plan
  3. The provider's marketing security whitepaper
  4. The provider's source code repository

Explanation

A SOC 2 Type II report is an independent attestation over the design and operating effectiveness of controls over a period, and providers release it under NDA. Whitepapers are self-reported, and internal plans or source code are not assurance reports.

Question 14Cloud Security Fundamentals and Governance

Why does data residency governance often require more than simply choosing a region at deployment time?

  1. Data and metadata may replicate, back up, or be processed outside the chosen region Correct answer.
  2. Cloud providers cannot report where data is stored
  3. Region selection automatically satisfies every residency law without further controls
  4. Residency rules apply only to structured databases

Explanation

Residency obligations follow the data wherever it goes, including backups, replicas, logs, support access, and metadata, which may leave the selected region. Governance must therefore map all data flows, not just the initial deployment location.

Question 15Cloud Security Fundamentals and Governance

Which governance mechanism best limits the blast radius of a compromised administrator credential in a cloud environment?

  1. Granting the administrator a permanent owner role for convenience
  2. Requiring just-in-time elevated access with approval and session logging Correct answer.
  3. Disabling multi-factor authentication to speed up break-glass access
  4. Sharing the administrator credential among the operations team

Explanation

Just-in-time elevation with approval and session logging ensures privileged rights exist only when needed and are recorded, shrinking the window and scope of misuse. Standing permanent rights, shared credentials, and disabled MFA all enlarge the blast radius.

Question 16Cloud Security Fundamentals and Governance

What is the main governance value of tagging cloud resources consistently?

  1. It encrypts resources automatically at creation
  2. It guarantees compliance with data residency laws
  3. It removes the need for identity and access management
  4. It enables cost allocation, ownership attribution, and policy scoping Correct answer.

Explanation

Consistent tags attach business context such as owner, environment, and cost center, which supports chargeback, accountability, and targeted policy enforcement. Tags do not encrypt data, replace IAM, or by themselves satisfy residency law.

Question 17Cloud Security Fundamentals and Governance

A cloud risk assessment finds that a critical workload depends on a single provider service with no documented alternative. Which governance action is most appropriate?

  1. Remove the workload's audit logging to lower complexity
  2. Ignore the finding because the provider's SLA transfers the risk
  3. Increase the workload's instance size to reduce the risk
  4. Document an exit or contingency plan and monitor provider dependency Correct answer.

Explanation

Concentrated dependency is a strategic risk that governance addresses through documented exit or contingency planning and ongoing monitoring of the dependency. An SLA does not transfer this risk, and unrelated technical changes do not mitigate it.

Question 18Cloud Security Fundamentals and Governance

Which model places the greatest security responsibility on the customer?

  1. Function as a service
  2. Platform as a service
  3. Software as a service
  4. Infrastructure as a service Correct answer.

Explanation

In infrastructure as a service the customer manages the operating system, middleware, runtime, and application on top of provider-managed hardware and virtualization, giving it the largest share of responsibility among these models. Higher-level models shift more of that stack to the provider.

Question 19Cloud Security Fundamentals and Governance

An organization adopts a policy that all new cloud accounts must be created through an automated landing zone with preconfigured logging, networking, and identity baselines. Which governance principle does this best illustrate?

  1. Manual exception handling for each account
  2. Secure-by-default provisioning through infrastructure as code Correct answer.
  3. Decentralized account creation without standards
  4. Reactive incident response after misconfiguration

Explanation

A landing zone delivered as code bakes security and compliance baselines into every account automatically, making the secure configuration the default. This is preventive and consistent, unlike manual, reactive, or decentralized approaches.

Question 20Cloud Security Fundamentals and Governance

Which statement best describes the role of a data classification scheme in cloud governance?

  1. It automatically enforces residency in every region
  2. It replaces the need for encryption in public cloud storage
  3. It is only relevant to on-premises systems
  4. It determines the handling, access, and protection controls required for each data category Correct answer.

Explanation

Classification assigns sensitivity labels that drive which controls, access rules, and handling procedures apply to data. It does not eliminate encryption, is relevant in cloud environments, and does not by itself enforce residency.

Question 21Cloud Security Fundamentals and Governance

A cloud security team discovers that developers can disable mandatory logging on production accounts. Which governance weakness does this most directly reveal?

  1. Poor disaster recovery testing frequency
  2. Excessive reliance on provider-managed encryption
  3. Insufficient network segmentation between environments
  4. Inadequate separation of duties and permission boundaries for production controls Correct answer.

Explanation

Allowing the same roles that build workloads to also disable protective controls indicates missing separation of duties and permission boundaries around production governance functions. The issue is authorization design, not networking, encryption, or DR testing.

Question 22Cloud Security Fundamentals and Governance

Which practice best supports continuous compliance monitoring in a dynamic cloud environment?

  1. Reviewing compliance only after an incident
  2. Annual point-in-time configuration audits only
  3. Relying solely on the provider's certifications
  4. Automated, continuous evaluation of resource configuration against policy Correct answer.

Explanation

Cloud resources change constantly, so continuous automated evaluation against policy detects drift and violations promptly. Annual audits, provider certifications, and post-incident reviews are too infrequent or too indirect to maintain continuous compliance.

Question 23Cloud Security Fundamentals and Governance

An organization operates a private cloud for its own business units and also uses a public provider for burst capacity, with shared identity and tooling across both. Which deployment model does this describe?

  1. Public cloud only
  2. Hybrid cloud Correct answer.
  3. Community cloud
  4. Dedicated hosted private cloud

Explanation

A hybrid cloud combines private and public environments connected by common identity, networking, and management tooling. Community cloud serves a shared constituency, while the other options describe single-model deployments.

Question 24Cloud Security Fundamentals and Governance

What is the primary governance reason to maintain an inventory of cloud assets and data flows?

  1. To satisfy the provider's billing requirements
  2. To eliminate the need for access reviews
  3. To guarantee that no data leaves a region
  4. To know what exists, where data moves, and which controls apply Correct answer.

Explanation

You cannot govern what you cannot see; an asset and data-flow inventory establishes scope for risk assessment, control assignment, and compliance mapping. It does not replace access reviews, guarantee residency, or exist for provider billing.

Question 25Cloud Security Fundamentals and Governance

Which control is detective rather than preventive in a cloud governance program?

  1. A pipeline gate that rejects noncompliant templates
  2. A service control policy that blocks public storage buckets
  3. An alert triggered when a storage bucket becomes publicly readable Correct answer.
  4. A role requirement that enforces multi-factor authentication

Explanation

Detective controls identify conditions after they occur, and an alert on a newly public bucket does exactly that. Policy blocks, pipeline gates, and enforced MFA all prevent the undesired state from arising in the first place.

Question 26Cloud Security Fundamentals and Governance

Which cloud characteristic most directly undermines a governance model built on periodic, manually approved infrastructure changes?

  1. Elastic self-service provisioning that lets teams create resources on demand Correct answer.
  2. Geographic distribution of provider regions across continents
  3. Use of shared hardware by multiple customers
  4. Metered billing that converts capital expense into operating expense

Explanation

Self-service elasticity means resources appear without a human gatekeeper, so change control must be automated rather than ticket-based. Metering, regional spread, and multi-tenancy affect cost, latency, and isolation but do not by themselves bypass an approval workflow.

Question 27Cloud Security Fundamentals and Governance

In the shared responsibility model for a SaaS deployment, which responsibility remains with the customer?

  1. Securing the physical data center and hypervisor layer
  2. Patching the application server operating system
  3. Configuring the provider's network backbone
  4. Managing user identities, access, and the data placed in the service Correct answer.

Explanation

For SaaS the provider runs the application stack, operating system, and infrastructure. The customer still governs who can access the service and what data is stored there, which is where most SaaS breaches originate.

Question 28Cloud Security Fundamentals and Governance

A governance board wants a single authoritative statement of how cloud services must be used, approved, and reviewed. Which artifact should it issue?

  1. A cloud security policy approved by executive management Correct answer.
  2. A service level agreement with each provider
  3. A configuration baseline for a specific workload
  4. An incident response runbook

Explanation

A policy is the top-level management directive that sets mandatory expectations and authority; standards, baselines, and procedures derive from it. SLAs and runbooks are operational documents subordinate to policy.

Question 29Cloud Security Fundamentals and Governance

Which pair correctly distinguishes a cloud standard from a cloud procedure?

  1. A standard applies only to providers, while a procedure applies only to customers
  2. A standard is approved by auditors, while a procedure is approved by developers
  3. A standard states measurable requirements, while a procedure gives step-by-step instructions to meet them Correct answer.
  4. A standard is optional guidance, while a procedure is mandatory

Explanation

Standards translate policy into specific, measurable requirements such as key length or log retention. Procedures describe the ordered steps staff follow to satisfy those requirements.

Question 30Cloud Security Fundamentals and Governance

A multinational retailer must keep customer records within the country of origin while still using a global provider. Which governance approach addresses this requirement most directly?

  1. Requiring multi-factor authentication for all administrative accounts
  2. Purchasing the provider's highest support tier
  3. Encrypting all records with customer-managed keys stored centrally
  4. Restricting deployments and replication to approved in-country regions and verifying provider data processing terms Correct answer.

Explanation

Residency is about where data is stored and processed, so the control is a combination of region restrictions and contractual commitments from the provider. Encryption and MFA improve confidentiality but do not prevent data from leaving a jurisdiction.

Question 31Cloud Security Fundamentals and Governance

An organization wants to compare the security posture of two candidate providers before signing. Which evidence is the most reliable basis for that comparison?

  1. Marketing pages describing the providers' security features
  2. The providers' published uptime statistics for the past year
  3. Reference calls with the providers' sales engineers
  4. Independent third-party audit reports and certifications covering the relevant scope Correct answer.

Explanation

Independent audit reports against recognized frameworks give verified, scoped evidence that can be compared objectively. Marketing material and sales conversations are self-reported and cannot be relied on for assurance.

Question 32Cloud Security Fundamentals and Governance

A company classifies data so that the highest tier requires customer-managed keys, private connectivity, and quarterly access reviews. What governance function does this classification perform?

  1. It determines the provider's pricing tier automatically
  2. It replaces the need for a risk assessment process
  3. It transfers regulatory liability to the cloud provider
  4. It maps data sensitivity to mandatory controls that engineering must implement Correct answer.

Explanation

Classification is the bridge between business risk and technical control selection; each tier carries a defined control set. It informs risk assessment rather than replacing it and does not shift regulatory accountability.

Question 33Cloud Security Fundamentals and Governance

Which governance structure best resolves conflicts between speed of delivery and cloud security requirements?

  1. An external consultancy retained on a per-project basis
  2. A cloud center of excellence with delegated authority and representation from security, operations, and delivery Correct answer.
  3. A monthly steering committee that meets only after incidents
  4. A security team that reviews every change request manually

Explanation

A center of excellence combines cross-functional expertise with delegated decision rights, so standards are set once and applied consistently without becoming a bottleneck. Manual review of every change does not scale, and reactive committees leave gaps.

Question 34Cloud Security Fundamentals and Governance

A team wants to adopt a new cloud service that is not on the approved list but is needed urgently for a project. Which governance response is most appropriate?

  1. Run a documented exception process with risk assessment, time limit, and compensating controls Correct answer.
  2. Deny the request because the service is unapproved
  3. Allow use and document the decision after the project ends
  4. Delegate the decision to the requesting developer

Explanation

Mature governance provides a controlled path for exceptions, balancing delivery needs against risk with explicit ownership and expiry. Blanket denial drives shadow IT, while unrecorded or self-approved use removes accountability.

Question 35Cloud Security Fundamentals and Governance

Which metric best indicates whether a cloud governance program is actually operating rather than merely documented?

  1. The number of pages in the cloud security policy
  2. The frequency of governance committee meetings
  3. The number of providers the organization has contracts with
  4. The percentage of cloud resources deployed through the approved automated pipeline Correct answer.

Explanation

Governance effectiveness is shown by adherence in practice, such as how much provisioning flows through approved, controlled paths. Document length, contract count, and meeting cadence measure activity, not enforcement.

Question 36Cloud Security Fundamentals and Governance

An organization wants to prevent any cloud resource from being created outside approved regions. Which mechanism enforces this most reliably?

  1. A quarterly manual sample audit of deployed resources
  2. A training course for engineers on regional requirements
  3. A written standard requiring regional deployment
  4. An automated policy evaluated at provisioning time that denies noncompliant requests Correct answer.

Explanation

Preventive, automated policy evaluation blocks noncompliant resources before they exist, removing reliance on human diligence. Documents, sampling, and training influence behavior but cannot guarantee the outcome.

Question 37Cloud Security Fundamentals and Governance

A cloud risk register lists a provider service that has no contractual data deletion guarantee. Which treatment is most aligned with risk governance?

  1. Accept the risk because the service is popular
  2. Remove the entry because the provider is certified
  3. Transfer the risk entirely by purchasing cyber insurance
  4. Record the risk with an owner, assess its likelihood and impact, and select a treatment such as contractual amendment or a compensating control Correct answer.

Explanation

Risk governance requires documented ownership, assessed exposure, and a deliberate treatment decision. Acceptance without analysis, deletion of the entry, or relying solely on insurance leaves the exposure unmanaged.

Question 38Cloud Security Fundamentals and Governance

A regulated bank is choosing between deploying on infrastructure as a service and on a provider-managed application platform. Which governance consideration most strongly favors the managed platform?

  1. The bank avoids all responsibility for access management
  2. The bank retains full control of the operating system and middleware
  3. The bank can customize the network stack in greater detail
  4. The provider assumes patching and configuration hardening of the runtime, reducing the bank's control surface Correct answer.

Explanation

Moving up the service stack shifts operational security tasks such as patching and hardening to the provider, shrinking the customer's control surface. The bank never sheds responsibility for identity and access, and greater customization actually increases its burden.

Question 39Cloud Security Fundamentals and Governance

An enterprise discovers that two business units built separate landing zones with conflicting logging and network rules. Which root governance failure does this most likely indicate?

  1. No centralized architecture authority defined reusable, mandatory foundations Correct answer.
  2. Insufficient provider regions were available
  3. The provider's SLA excluded the affected services
  4. Encryption keys were stored in the wrong region

Explanation

Divergent foundations usually stem from the absence of a central body that defines and mandates reusable patterns. Region availability, key placement, and SLA terms are unrelated to duplicated, conflicting account structures.

Question 40Cloud Security Fundamentals and Governance

A cloud governance team must decide whether a new region may be used for a workload handling confidential data. Which analysis is most complete?

  1. Checking that the region appears on the provider's public status page
  2. Evaluating legal jurisdiction, provider control availability in that region, data replication paths, and exit options before approval Correct answer.
  3. Verifying that the region's pricing matches the current budget
  4. Confirming the region offers the lowest latency for the user base

Explanation

Region approval is a multi-factor governance decision covering legal exposure, control parity, replication behavior, and reversibility. Latency, status pages, and pricing are relevant inputs but each alone is insufficient for confidential data.

Question 41Cloud Architecture, Models and Shared Responsibility

Under the NIST cloud definition, which characteristic means a consumer can unilaterally provision computing capabilities such as server time and storage without requiring human interaction with each service provider?

  1. On-demand self-service Correct answer.
  2. Resource pooling
  3. Measured service
  4. Rapid elasticity

Explanation

On-demand self-service describes the consumer's ability to provision capabilities automatically, without human interaction with the provider. Rapid elasticity concerns scaling in and out, measured service concerns metering, and resource pooling concerns multi-tenant sharing.

Question 42Cloud Architecture, Models and Shared Responsibility

A company deploys an application on infrastructure it owns but manages through a vendor's orchestration layer, keeping full control of the guest operating system. Which deployment model does this describe?

  1. Hybrid cloud
  2. Private cloud Correct answer.
  3. Community cloud
  4. Public cloud

Explanation

A private cloud is provisioned for exclusive use by a single organization, whether operated on or off premises. The key test is exclusive use, not the physical location or who supplies the orchestration tooling.

Question 43Cloud Architecture, Models and Shared Responsibility

In an IaaS delivery model, which layer remains the customer's responsibility under the shared responsibility model?

  1. Physical security of the data center
  2. The hypervisor and host firmware
  3. The network backbone between availability zones
  4. Guest operating system patching and configuration Correct answer.

Explanation

In IaaS the provider secures the physical facility, hardware, and virtualization layer, while the customer secures everything from the guest operating system upward. Patching the guest OS therefore stays with the customer.

Question 44Cloud Architecture, Models and Shared Responsibility

Which cloud service model places the greatest security responsibility on the customer?

  1. IaaS Correct answer.
  2. PaaS
  3. SaaS
  4. FaaS

Explanation

IaaS gives the customer control of the operating system, middleware, runtime, and application, so it carries the largest customer-side security burden. As abstraction increases toward PaaS, SaaS, and FaaS, more layers shift to the provider.

Question 45Cloud Architecture, Models and Shared Responsibility

An organization consumes SaaS for email. Which activity is unambiguously the customer's responsibility?

  1. Securing the underlying hypervisor
  2. Patching the email application servers
  3. Maintaining the storage hardware holding mailboxes
  4. Managing user identities, access, and mailbox configuration Correct answer.

Explanation

In SaaS the provider runs the application, runtime, and infrastructure, while the customer governs its own users, data, and configuration. Identity and access management is the classic customer-side duty in SaaS.

Question 46Cloud Architecture, Models and Shared Responsibility

Which statement best captures the provider's responsibility for security 'of' the cloud versus the customer's responsibility for security 'in' the cloud?

  1. The provider secures the physical, network, and virtualization layers that host all tenants. Correct answer.
  2. The customer secures the hypervisor isolation between tenants.
  3. The customer secures the physical perimeter of the data center.
  4. The provider secures customer data classification and access policy.

Explanation

Security 'of' the cloud covers the provider-controlled foundation: facilities, hardware, network, and virtualization. Security 'in' the cloud covers what the customer deploys and configures on top of that foundation.

Question 47Cloud Architecture, Models and Shared Responsibility

Which cloud characteristic most directly enables a provider to serve multiple tenants from shared physical hardware while keeping their data logically separated?

  1. Rapid elasticity
  2. Resource pooling Correct answer.
  3. Measured service
  4. Broad network access

Explanation

Resource pooling means computing resources are pooled to serve multiple consumers using a multi-tenant model, with logical separation of each tenant's allocation. This is the characteristic that creates multi-tenancy and its associated isolation risks.

Question 48Cloud Architecture, Models and Shared Responsibility

A regulator requires that a workload run on hardware dedicated to a single organization, with no other tenants sharing the physical hosts. Which arrangement satisfies this requirement?

  1. A SaaS deployment with per-tenant database schemas
  2. A multi-tenant public cloud region with logical network segmentation
  3. A single-tenant private cloud or dedicated host offering Correct answer.
  4. A serverless platform with per-function isolation

Explanation

Dedicated hardware, whether a private cloud or a single-tenant host offering, removes cross-tenant co-residency on physical hosts. Logical segmentation and per-tenant schemas still rely on shared hardware, which does not meet a dedicated-hardware mandate.

Question 49Cloud Architecture, Models and Shared Responsibility

A team migrates a workload from IaaS virtual machines to a managed container platform where the provider patches the host OS and orchestrator. How does the responsibility boundary shift?

  1. The provider assumes host and orchestrator patching, while the customer retains image and workload configuration duties. Correct answer.
  2. The customer gains responsibility for host kernel patching.
  3. All security responsibility transfers to the provider.
  4. The customer becomes responsible for physical network security.

Explanation

Moving up the abstraction stack shifts host and orchestrator maintenance to the provider, but the customer still owns container images, workload configuration, secrets, and identity. Responsibility is redistributed, never eliminated.

Question 50Cloud Architecture, Models and Shared Responsibility

Which scenario is the clearest example of a customer misconfiguration rather than a provider failure?

  1. A provider hypervisor vulnerability is disclosed and patched by the vendor.
  2. A provider's availability zone suffers a power outage.
  3. A storage bucket is created with public read access enabled by the customer's deployment template. Correct answer.
  4. A provider's backbone link experiences packet loss.

Explanation

Misconfiguration occurs when the customer sets an insecure option in a service the provider operates correctly. Public bucket exposure from a customer template is a customer-side configuration error, while outages and hypervisor flaws are provider-side concerns.