CCSP Practice Test 39 — 15 Questions

Question 1

After decommissioning a cloud database, a company is concerned about data remanence. They have overwritten all storage blocks with zeros. However, regulatory auditors require proof that the data is unrecoverable. What additional step should the company take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request a certificate of destruction from the cloud provider. In a cloud environment, the customer does not have physical access to the underlying storage media. Overwriting with zeros is a software-based sanitization method, but cloud providers typically do not allow customers to perform physical destruction or degaussing. The correct additional step is to request a certificate of destruction from the cloud provider, which serves as auditable proof that the provider has performed its own secure disposal process (e.g., NIST SP 800-88 compliant media sanitization) and that the data is unrecoverable.

Answer

Physically destroy the storage media

Answer

Shred the hard drives

Answer

Degauss the drives

Question 2

In the shared responsibility model for public cloud IaaS, which of the following is typically the responsibility of the cloud customer?

Accepted Answer

Managing virtual machine guest OS patches. In the IaaS shared responsibility model, the cloud provider secures the physical facilities, network backbone, and hypervisor, while the customer is responsible for everything from the guest OS upward — including patching the guest operating system, middleware, and applications. Managing VM guest OS patches is therefore a customer responsibility.

Answer

Network infrastructure redundancy

Answer

Physical security of data centers

Answer

Patching the hypervisor

Question 3

A financial institution is subject to strict regulatory requirements that mandate data residency and physical control over its infrastructure. At the same time, it wants to leverage cloud bursting for peak loads. Which deployment model should the institution adopt?

Accepted Answer

Hybrid cloud. A hybrid cloud combines a private cloud (or on-premises infrastructure) with public cloud resources, letting the institution keep regulated data and physical control in its private environment while bursting to public cloud for peak loads. This satisfies data residency and physical control requirements while providing elasticity. Private cloud alone cannot burst to public capacity, and public/community clouds do not give the required physical control.

Answer

Private cloud

Answer

Community cloud

Answer

Public cloud

Question 4

An organization is using a public cloud IaaS and wants to ensure they understand which security responsibilities fall on them. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Security of the guest operating system. In an IaaS deployment, the cloud provider secures the physical facility, hardware, and hypervisor, while the customer retains responsibility for everything from the guest OS upward — including OS patching, hardening, host firewalls, and the applications and data running on top. Option C correctly identifies the guest operating system as a customer responsibility. This is the classic 'security OF the cloud vs. security IN the cloud' split defined by the shared responsibility model.

Answer

Hypervisor security

Answer

Physical security of data centers

Answer

Network infrastructure hardening

Question 5

A cloud security architect is designing a multi-tenant SaaS application that must ensure strong isolation between tenants. Which TWO mechanisms are most effective for achieving multitenancy isolation?

Accepted Answer

Hypervisor-based virtual machine isolation. Hypervisor-based virtual machine isolation (A) is correct because each tenant runs in its own VM with a separate guest OS, so the hypervisor enforces hardware-level separation of CPU, memory, and I/O, preventing one tenant from accessing another tenant's resources even if the guest OS is compromised. Network micro-segmentation (B) is correct because it applies granular, workload-level policies (e.g., security groups, NSGs, or service-mesh rules) that restrict east-west traffic so tenants can only reach their own components, containing lateral movement and enforcing tenant boundaries at the network layer. Encryption at rest (C) is not the most effective isolation mechanism because it protects data confidentiality if storage media is compromised but does not prevent a tenant from accessing another tenant's data through a running application or shared service. Database row-level permissions (D) provide logical access control within a shared schema but rely on correct query and policy configuration, so they are weaker than infrastructure-enforced isolation and can be bypassed by application or SQL flaws. API rate limiting per tenant (E) addresses fairness, abuse prevention, and availability (e.g., throttling to protect against noisy-neighbor effects) but does not isolate tenants' data or execution environments.

Answer

Encryption at rest for all tenant data

Answer

Database row-level permissions

Answer

API rate limiting per tenant

Question 6

A cloud service provider (CSP) offers a shared infrastructure where multiple customers' virtual machines run on the same physical host but are isolated by the hypervisor. Which cloud deployment model does this represent?

Accepted Answer

Public cloud. The scenario describes a public cloud deployment model, where a CSP owns and operates the infrastructure and offers services to multiple customers (tenants) over the internet. The key characteristic is multi-tenancy: multiple customers' virtual machines share the same physical host but are logically isolated by the hypervisor. This is the defining trait of a public cloud, as opposed to private, hybrid, or community clouds, which have different ownership and access boundaries.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Community cloud

Question 7

A financial services company is required to keep customer data within a specific geographic boundary due to regulatory requirements. The company is evaluating cloud deployment models. Which model would best ensure data sovereignty while still providing scalability?

Accepted Answer

Community cloud hosted in the required geography. A community cloud hosted within the required geography is provisioned for exclusive use by a specific community of organizations that share concerns (here, regulatory compliance), and it can be located in the mandated jurisdiction while still offering elastic, multi-tenant-style scalability. This satisfies data sovereignty because the infrastructure and data reside within the geographic boundary, and it provides scalability through shared community resources rather than a single organization bearing the full cost.

Answer

Hybrid cloud with public cloud bursting

Answer

Public cloud with multi-region deployment

Answer

Private cloud on-premises

Question 8

In a public cloud IaaS environment, which of the following is the customer responsible for securing, according to the shared responsibility model?

Accepted Answer

Operating system and applications. In the IaaS shared responsibility model, the cloud provider secures the physical facilities, hardware, hypervisor, and network fabric, while the customer is responsible for everything from the guest operating system upward, including patching, applications, and data. Therefore the customer must secure the operating system and applications they deploy on IaaS instances.

Answer

Virtualization hypervisor

Answer

Network infrastructure

Answer

Physical security of data centers

Question 9

Which of the following is a key consideration when evaluating a cloud service provider's ability to meet compliance requirements for data sovereignty?

Accepted Answer

The provider's data center locations and geographic restrictions. Data sovereignty requires that data remains subject to the laws of the country where it is stored or processed. Therefore, the provider's data center locations and any geographic restrictions on where data can be stored, processed, or replicated are the primary considerations. This directly determines which legal jurisdictions can claim authority over the data.

Answer

The provider's support tier

Answer

The provider's penetration testing policy

Answer

The provider's SOC 2 Type II report

Question 10

Which cloud characteristic allows a user to automatically provision computing resources without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the NIST-defined cloud characteristic that lets consumers unilaterally provision computing capabilities, such as server time and storage, automatically without requiring human interaction with the service provider. This is exactly what the question describes.

Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling

Question 11

A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?

Accepted Answer

Hold your own key (HYOK). Hold your own key (HYOK) is the only model where the customer generates and stores the key material in their own HSM on-premises, and the cloud provider never has access to the plaintext key. In HYOK, encryption and decryption typically occur on the customer side or through a proxy, so the cloud provider only ever handles ciphertext. This satisfies the requirement that the provider cannot access plaintext keys.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default encryption (SSE-S3)

Question 12

A cloud security architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms should be implemented to prevent data leakage between tenants?

Accepted Answer

Network isolation using virtual networks. Network isolation using virtual networks (B) is correct because placing each tenant's workloads in separate VNets/subnets (or separate VPCs) with security groups/NSGs and peering rules prevents cross-tenant network traffic and lateral movement, which is a primary vector for data leakage in multi-tenant SaaS. Storage isolation through separate databases or schemas (C) is correct because logically or physically partitioning tenant data (dedicated database per tenant, or schema-per-tenant with strict access controls) enforces a hard data boundary so one tenant's queries cannot read another tenant's records. API rate limiting (A) only protects availability and throttles abuse; it does not create a data boundary. Data encryption at rest (D) protects data confidentiality if the storage medium is compromised but does not prevent one tenant from accessing another tenant's data through the application. Identity federation (E) addresses authentication and SSO, not tenant data separation.

Answer

API rate limiting

Answer

Data encryption at rest

Answer

Identity federation

Question 13

A company is designing a multi-cloud strategy to avoid vendor lock-in and ensure portability. They are considering using containers and an open-source orchestration platform. Which of the following is the BEST choice to achieve workload portability across different cloud providers?

Accepted Answer

Kubernetes. Kubernetes is an open-source container orchestration platform that runs on any cloud or on-premises infrastructure, providing a consistent API and workload abstraction that makes containers portable across providers. Because it is not tied to a single vendor, workloads packaged as Kubernetes manifests or Helm charts can be moved between AWS EKS, Azure AKS, Google GKE, or self-managed clusters with minimal changes, directly addressing vendor lock-in and portability.

Answer

Azure Functions

Answer

AWS Lambda

Answer

VMware vSphere

Question 14

A company is adopting a microservices architecture on Kubernetes and needs to ensure least privilege for pod-to-pod communication. Which THREE controls should be implemented?

Accepted Answer

Service accounts with minimal permissions. Option A is correct because assigning each microservice a dedicated Kubernetes ServiceAccount with minimal RBAC permissions ensures pods authenticate to the API server with only the rights they actually need, which is a core least-privilege practice. Option B is correct because NetworkPolicy objects (enforced by a CNI plugin such as Calico or Cilium) provide default-deny ingress/egress and then explicitly allow only the required pod-to-pod flows on specific ports and protocols, directly restricting lateral movement. Option C is correct because RBAC Roles/ClusterRoles bound to those ServiceAccounts limit what pods can do within the cluster, such as which resources and verbs (get, list, watch, create) they may access, preventing privilege escalation. Option D is not correct because Pod Security Admission enforcing containers to run as root is the opposite of least privilege; the restricted profile should require runAsNonRoot, drop capabilities, and disallow privileged containers. Option E is not correct because the Horizontal Pod Autoscaler only scales replica counts based on metrics like CPU or memory and has no bearing on authorization or network access control.

Answer

Pod Security Admission to enforce that containers run as root

Answer

Horizontal Pod Autoscaler

Question 15

A company is adopting a hybrid cloud model to run sensitive workloads on-premises and less critical applications in the public cloud. Which security consideration is most critical for this environment?

Accepted Answer

Maintaining consistent security policies across both environments. In a hybrid cloud model, the most critical security consideration is maintaining consistent security policies across both on-premises and public cloud environments. This ensures that security controls, access management, data protection, and compliance requirements are uniformly enforced, reducing gaps that attackers could exploit. Inconsistencies can lead to misconfigurations, unauthorized access, and data leakage between environments. While network connectivity and encryption are important, they are components of a broader policy consistency strategy.

Answer

Using a single cloud provider for both environments

Answer

Ensuring high-speed network connectivity

Answer

Implementing data encryption at rest only