CCSP Cloud Concepts, Architecture, and Design — 20 Questions

Question 1

A cloud provider offers a service with an SLA of 99.9% availability. Which TWO of the following are likely consequences if the provider fails to meet this SLA?

Accepted Answer

The customer receives service credits. Option A is correct because cloud SLAs typically define the remedy for a missed availability target as service credits — a percentage of the monthly fee returned to the customer, tiered by how far below 99.9% the actual uptime fell. Option C is correct because the provider itself may owe penalty fees or financial compensation under the SLA terms, making the shortfall a direct cost to the provider. Option B is not typical, since SLAs almost never promise a full refund; credits are partial and capped. Option D is wrong because an SLA breach does not automatically terminate the contract — termination usually requires a separate contractual clause or customer election. Option E is not a standard SLA consequence, as SLAs generally channel remedies through credits rather than creating an automatic right to sue.

Answer

The customer receives a full refund for the service

Answer

The contract is immediately terminated

Answer

The customer can take legal action

Question 2

A cloud provider guarantees 99.99% availability for a service. What is the maximum allowed downtime per year (rounded to nearest minute)?

Accepted Answer

52.56 minutes. 99.99% availability means the service can be unavailable for 0.01% of the time. In a non-leap year of 365 days, there are 525,600 minutes. 0.01% of 525,600 is 52.56 minutes, which rounds to 53 minutes. Therefore, the maximum allowed downtime per year is approximately 52.56 minutes, making option D correct.

Answer

1.01 hours

Answer

5.26 minutes

Answer

8.76 hours

Question 3

An organization is adopting a hybrid cloud strategy and needs to ensure secure connectivity between on-premises and cloud environments. Which TWO approaches are most appropriate for this purpose?

Accepted Answer

Site-to-site VPN over the public internet. Option A (site-to-site VPN over the public internet) is correct because it establishes an encrypted IPsec tunnel between the on-premises VPN gateway and the cloud VPN gateway, providing secure connectivity across the public internet at relatively low cost and quick deployment. Option C (dedicated private network connection such as AWS Direct Connect) is correct because it provides a private, dedicated physical link between the on-premises data center and the cloud provider, delivering consistent bandwidth, lower latency, and stronger security than internet-based tunnels. Option B is wrong because directly exposing on-premises services to the public internet removes the encryption and isolation needed for secure hybrid connectivity and greatly increases attack surface. Option D is wrong because a CASB is a policy enforcement and visibility tool for cloud service usage (e.g., shadow IT, data loss prevention), not a network transport mechanism for connecting on-premises to cloud. Option E is wrong because MPLS-based VPN from a telecom provider is a legacy WAN approach that does not natively extend into public cloud environments the way site-to-site VPN or dedicated private connections do.

Answer

Direct exposure of on-premises services to the cloud via public internet

Answer

Cloud access security broker (CASB)

Answer

MPLS-based VPN from a telecom provider

Question 4

A company is evaluating cloud providers for a global application. They need to ensure high availability and low latency. Which THREE factors are most important to consider during provider evaluation? (Select THREE.)

Accepted Answer

Availability of third-party audit reports (e.g., SOC 2, ISO 27001). Option A is correct because third-party audit reports such as SOC 2 and ISO 27001 independently verify that the provider's security and operational controls meet recognized standards, which is essential for trusting a provider to host a global application. Option B is correct because SLA uptime guarantees define the contractual availability commitment (e.g., 99.9% or 99.99%) and the remedies if that target is missed, directly addressing the high-availability requirement. Option E is correct because global data center locations and regions determine how close compute and storage can be placed to end users, which directly reduces network latency and enables regional failover for availability. Option C does not belong because stock price performance reflects investor sentiment and financial markets, not the technical availability or latency characteristics of the cloud platform. Option D does not belong because the number of employees at a provider says nothing about the geographic distribution, redundancy, or performance of its infrastructure.

Answer

Provider's stock price performance

Answer

Number of employees at the provider

Question 5

An organization is evaluating cloud service providers and wants to ensure that the provider can demonstrate independent verification of its security controls. Which THREE of the following are recognized cloud security audit reports or certifications?

Accepted Answer

ISO 27001. ISO 27001 (A) is correct because it is an internationally recognized certification for an information security management system (ISMS), issued after an independent accredited auditor verifies that the provider's controls meet the standard's requirements. SOC 2 Type II (B) is correct because it is an independent attestation report, prepared by a CPA firm, that evaluates the design and operating effectiveness of a provider's controls over a period of time against the Trust Services Criteria. CSA STAR (C) is correct because it is a cloud-specific security assurance program from the Cloud Security Alliance that provides independent assessment and certification of a cloud provider's security controls, often layered on top of ISO 27001. PCI DSS (D) is not one of the three because it is a payment card industry data security standard that organizations must comply with, not an independent audit report or certification of general cloud security controls. FedRAMP (E) is not one of the three because it is a U.S. government authorization program for cloud services, not an audit report or certification in the same recognized sense as the three correct options.

Answer

PCI DSS

Answer

FedRAMP

Question 6

A cloud architect is designing a multi-tenant SaaS application. Which THREE of the following are essential isolation mechanisms that must be implemented to ensure tenant separation?

Accepted Answer

Data storage isolation (e.g., separate schemas or encryption per tenant). Data storage isolation (A) is essential because multi-tenant separation requires that each tenant's data be logically or physically partitioned—via separate schemas, separate databases, or per-tenant encryption keys—so that one tenant can never read or corrupt another tenant's records. Hypervisor isolation (B) is essential because when tenants share compute hosts, the hypervisor must enforce VM/container boundaries so that one tenant's workload cannot access another tenant's memory, CPU state, or virtual devices. Network isolation via VLANs or SDN (D) is essential because it segments tenant traffic at Layer 2/3, preventing cross-tenant packet sniffing, lateral movement, and unauthorized service access within the shared infrastructure. A shared database for all tenants (C) is not an isolation mechanism—it is the opposite, since it removes the data boundary unless combined with row-level or schema-level controls. Single sign-on (E) is an authentication convenience for users, not a tenant separation control, and by itself does nothing to prevent cross-tenant data or network access.

Answer

Shared database for all tenants

Answer

Single sign-on (SSO) for all tenants

Question 7

Which THREE of the following are valid methods for achieving multitenancy isolation in a public cloud IaaS environment?

Accepted Answer

Encrypting data at rest with tenant-specific keys. Option A is correct because encrypting data at rest with tenant-specific keys ensures that even if storage is shared, one tenant cannot decrypt another tenant's data without the corresponding key, providing cryptographic isolation. Option C is correct because SAN zoning logically partitions the storage fabric so that only designated host bus adapters (HBAs) or initiators can access specific LUNs, preventing cross-tenant storage access at the fabric level. Option E is correct because hypervisor-level isolation ensures each tenant's virtual machines run in separate, hardware-enforced execution contexts, preventing one VM from reading or interfering with another tenant's memory or CPU state. Option B is not a valid isolation method because a single shared database schema allows tenants to potentially access or infer each other's rows unless additional row-level controls are applied, so it does not by itself achieve isolation. Option D is not valid because shared memory segments across tenants deliberately remove the memory boundary between tenants, which violates isolation rather than providing it.

Answer

Using a single database schema for all tenants

Answer

Shared memory segments across tenants for performance

Question 8

A multinational corporation is adopting a hybrid cloud model. The security manager is concerned about data sovereignty and wants to ensure that data stored in the public cloud remains within specific legal jurisdictions. Which of the following cloud deployment models BEST addresses this requirement while still allowing integration with on-premises systems?

Accepted Answer

Hybrid cloud. A hybrid cloud model allows organizations to keep sensitive data in a private cloud located within a specific legal jurisdiction while using public cloud for other workloads, thus addressing data sovereignty and integration requirements.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 9

A startup is choosing a cloud deployment model for a new application that must meet strict data residency requirements in a single country and be accessible only to employees of that startup. The startup has limited capital and wants to avoid building a data center. Which deployment model is MOST appropriate?

Accepted Answer

Community cloud. A community cloud is designed for exclusive use by a community with shared concerns, which fits the residency and employee-only access requirements. It also allows cost sharing, addressing the limited capital constraint. Public cloud lacks exclusivity, private cloud requires building infrastructure, and hybrid adds unnecessary complexity, so community cloud is the best match.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Private cloud

Question 10

A media company has a streaming platform that experiences unpredictable spikes in viewership during live events. The company wants to ensure the platform remains available during these spikes without over-provisioning resources during normal periods. Which cloud computing service model BEST meets this requirement?

Accepted Answer

Infrastructure as a Service (IaaS). The streaming platform requires dynamic scaling and control over the underlying infrastructure to handle unpredictable viewership spikes. IaaS provides virtualized compute, storage, and networking resources that can be automatically scaled, and it allows the company to manage its own streaming software and configurations. This model is best suited for workloads that need granular control and elasticity.

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Question 11

A cloud architect is evaluating a deployment model for a national retail chain. The company wants the cost and scalability benefits of a public cloud but must ensure that its point-of-sale transaction data is processed only by systems dedicated to the retail chain and not shared with any other tenant at the compute layer. Which cloud deployment model BEST satisfies these requirements while retaining public cloud elasticity?

Accepted Answer

Virtual private cloud hosted by a cloud provider and dedicated to a single organization. The requirement combines public cloud economics with dedicated, single-tenant compute for sensitive transaction data. A virtual private cloud hosted by a provider delivers exactly that isolation while preserving elasticity. Public VPC networking alone does not dedicate hardware, a private cloud forfeits elasticity, and a community cloud remains multi-tenant, so only the provider-hosted dedicated virtual private cloud meets all constraints.

Answer

Community cloud shared by several retail organizations

Answer

Private cloud hosted in the retailer's own data center

Answer

Public cloud with a customer-managed virtual private cloud (VPC)

Question 12

A media company needs to process and store raw video footage during live sporting events, then quickly release the compute capacity once each event ends. The workloads are highly variable and short-lived, often lasting only a few hours. Which cloud service model BEST fits this requirement?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS is the best fit because it provides raw, on-demand compute and storage that can be rapidly provisioned for a live event and released immediately afterward, aligning cost with actual usage. The scenario requires direct control over processing infrastructure for short, intense periods, which is the defining strength of IaaS rather than managed application platforms or event-driven function runtimes.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Question 13

A cloud architect is comparing IaaS, PaaS, and SaaS for a new customer-facing application. The security team wants to minimize the portion of the stack the organization must patch and secure, but the development team insists on controlling the runtime, libraries, and application code. The application also requires a relational database that the organization wants to manage itself. Which cloud service model BEST balances these requirements?

Accepted Answer

IaaS. IaaS gives the customer control over the operating system, runtime, libraries, application code, and database, while the provider manages the underlying virtualization, servers, storage, and networking. That aligns with the development team's insistence on control and the desire to self-manage the relational database, even though it requires more patching than PaaS or SaaS.

Answer

PaaS

Answer

DBaaS

Answer

SaaS

Question 14

A media production company stores 800 TB of archived video masters that must remain immediately retrievable for seven years. The security architect is comparing storage deployment models and wants to minimize recurring cost while preserving rapid access. Which cloud storage deployment model is MOST appropriate?

Accepted Answer

Object storage in a public cloud with an archive storage class and lifecycle policies. Archive-class object storage in a public cloud uniquely satisfies both constraints: very low cost per terabyte for long retention and immediate or near-immediate retrieval when a master is requested. Lifecycle rules automate transitions and expiry, and object immutability features support the seven-year hold. Block storage, self-hosted file systems, and edge caches each fail either the cost, scale, or retrievability requirement.

Answer

A content delivery network edge cache configured to hold the master files

Answer

Block storage volumes attached to persistent virtual machines in a private cloud

Answer

A distributed file system hosted on dedicated bare-metal servers inside the corporate data center

Question 15

A retail enterprise is choosing a cloud deployment model for a new analytics platform that must process regulated payment data. Legal counsel requires that the underlying infrastructure never be shared with unrelated organizations, while the platform must still be able to burst capacity during seasonal peaks. The enterprise already owns two data centers and wants to keep its existing hardware investment productive. Which deployment model BEST satisfies these constraints?

Accepted Answer

Hybrid cloud. The scenario pairs an exclusivity mandate for regulated payment data with a need to burst during seasonal peaks while reusing owned hardware. Only a composition of exclusive private infrastructure with public elastic capacity satisfies all three constraints simultaneously. Single-model options either share infrastructure with unrelated tenants or cannot elastically burst, so they each miss a controlling requirement.

Answer

Private cloud

Answer

Public cloud

Answer

Community cloud

Question 16

An organization is adopting a hybrid cloud model. A security architect must document which cloud capabilities are essential to the organization's cloud reference architecture. According to the Cloud Security Alliance, which capability describes the ability to monitor, control, and audit service usage and performance across cloud environments?

Accepted Answer

Service level management. The CSA cloud reference architecture identifies service level management as the capability that covers monitoring, control, and audit of service usage and performance. Elasticity and measured service describe scaling and metering characteristics, while auditability is only one part of the governance picture. Service level management integrates measurement, reporting, and control, which is exactly what the architect must document.

Answer

Elasticity

Answer

Auditability

Answer

Measured service

Question 17

A multinational corporation is designing a cloud architecture that must comply with GDPR for European customer data. The company wants to ensure that data remains within the EU and is not replicated to other regions without explicit consent. Which cloud design principle should be implemented to achieve this?

Accepted Answer

Data localization. Data localization involves implementing technical and organizational measures to ensure data is stored and processed only within a specified jurisdiction. For GDPR compliance, the company must prevent data from being replicated to regions outside the EU without consent. This requires configuring cloud services to use only EU regions, enabling geo-fencing, and restricting cross-region replication. Data localization is the design principle that directly enforces this boundary.

Answer

Data minimization

Answer

Data sovereignty

Answer

Data residency

Question 18

A small startup is developing a new mobile application and wants to minimize upfront infrastructure costs and management overhead. The team has limited operational expertise and prefers to focus on coding rather than managing servers. Which cloud service model is MOST appropriate for deploying the application's backend?

Accepted Answer

Platform as a Service (PaaS). The startup wants to minimize upfront costs and management overhead while focusing on coding. PaaS provides a complete development and deployment environment, managing the underlying infrastructure, so the team can focus on application development. IaaS requires too much operational effort, SaaS does not allow custom development, and FaaS is limited to event-driven functions. Therefore, PaaS is the most appropriate service model.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 19

A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?

Accepted Answer

Private cloud. Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 20

Which cloud service model provides the consumer with the ability to deploy and run custom applications using the provider's programming languages, libraries, and tools, but does not allow management of the underlying infrastructure?

Accepted Answer

PaaS. PaaS (Platform as a Service) provides a managed runtime environment where consumers deploy applications built with provider-supported languages, libraries, and tools, while the provider manages the underlying servers, storage, networking, and OS. The consumer controls only the deployed application and its configuration, not the infrastructure — exactly matching the scenario described.

Answer

SaaS

Answer

IaaS

Answer

CaaS