CCSP Cloud Concepts, Architecture, and Design — 40 Questions

Question 1

A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?

Accepted Answer

Private cloud. Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 2

Which cloud service model provides the consumer with the ability to deploy and run custom applications using the provider's programming languages, libraries, and tools, but does not allow management of the underlying infrastructure?

Accepted Answer

PaaS. PaaS provides a platform for customers to develop and run applications without managing the underlying infrastructure. IaaS provides infrastructure, SaaS provides software.

Answer

SaaS

Answer

IaaS

Answer

CaaS

Question 3

A security auditor is reviewing a cloud provider's controls to ensure that customer data is appropriately isolated. Which design principle is most directly related to this requirement?

Accepted Answer

Multitenancy isolation. Multitenancy isolation ensures that resources (compute, storage, network) of different customers are separated. Elasticity is about scaling, portability about moving, reversibility about exiting.

Answer

Reversibility

Answer

Portability

Answer

Elasticity

Question 4

A company is adopting a hybrid cloud model to run sensitive workloads on-premises and less critical applications in the public cloud. Which security consideration is most critical for this environment?

Accepted Answer

Maintaining consistent security policies across both environments. Hybrid cloud requires consistent security policies across environments to avoid gaps. Connectivity is important but policy consistency ensures security controls are uniformly applied.

Answer

Using a single cloud provider for both environments

Answer

Ensuring high-speed network connectivity

Answer

Implementing data encryption at rest only

Question 5

Which cloud characteristic allows a consumer to automatically provision computing resources, such as server time and storage, as needed without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service enables automatic provisioning. Broad network access is about network availability, resource pooling is about multi-tenancy, rapid elasticity is about scaling.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 6

A cloud customer is evaluating a provider's service level agreement (SLA) that guarantees 99.99% availability. What is the maximum allowable downtime per year (in minutes) before the SLA is violated?

Accepted Answer

52.56 minutes. 99.99% means 0.01% downtime per year. 365 days * 24 hours * 60 minutes = 525,600 minutes. 0.01% of that is 52.56 minutes, approximately 53 minutes.

Answer

8.76 hours

Answer

5.26 minutes

Answer

87.6 hours

Question 7

Which of the following is a key benefit of using containers, such as Docker, in a cloud environment to achieve portability?

Accepted Answer

Containers package applications with dependencies to run consistently across environments. Containers package applications with dependencies, making them portable across different environments. Virtual machines are less portable, APIs enable interoperability but not specifically portability.

Answer

Containers are always stateless

Answer

Containers require a specific hypervisor to run

Answer

Containers provide hardware-level virtualization

Question 8

In the NIST SP 800-145 definition of cloud computing, which characteristic is described as the capability to rapidly and elastically provision and release resources, often automatically?

Accepted Answer

Rapid elasticity. Rapid elasticity is the defined characteristic. Measured service is about metering, resource pooling is about sharing, broad network access is about network availability.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 9

A company wants to avoid vendor lock-in when adopting cloud services. Which strategy is most effective for achieving portability?

Accepted Answer

Adopting open standards and open-source APIs like Kubernetes and Terraform. Using open standards and APIs ensures that workloads can be moved between providers. Using proprietary APIs, single provider services, or managed services increases lock-in.

Answer

Using proprietary APIs from the cloud provider

Answer

Subscribing to a single cloud provider's managed services

Answer

Using proprietary data formats

Question 10

In a public cloud IaaS environment, which of the following is the customer responsible for securing, according to the shared responsibility model?

Accepted Answer

Operating system and applications. The customer is responsible for securing the operating system, applications, and data they deploy. The provider secures the physical infrastructure, network, and hypervisor.

Answer

Virtualization hypervisor

Answer

Network infrastructure

Answer

Physical security of data centers

Question 11

A community cloud is best suited for which scenario?

Accepted Answer

Several government agencies with similar security and compliance requirements. Community clouds are used by organizations with shared concerns like compliance, mission, or security requirements. A single organization would use private cloud, general public use is public cloud, hybrid is for combining models.

Answer

A startup wanting to minimize costs by sharing resources with the general public

Answer

A single organization needing dedicated infrastructure

Answer

A company that needs to burst workloads to the public cloud during peak times

Question 12

Which audit report provides the most comprehensive assurance regarding a cloud provider's controls over a period of time, including controls related to security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports cover controls over a period of time and include the five trust service criteria. SOC 2 Type I is a point-in-time report. ISO 27001 is a certification, not a report. CSA STAR is a self-assessment.

Answer

ISO 27001 certification

Answer

SOC 2 Type I

Answer

CSA STAR self-assessment

Question 13

A cloud security architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms should be implemented to prevent data leakage between tenants?

Accepted Answer

Network isolation using virtual networks. Network isolation (e.g., VLANs, VPCs) and storage isolation (e.g., separate databases or encryption per tenant) are key. Data encryption at rest protects data but not isolation between tenants. Identity federation and API rate limiting are not isolation mechanisms.

Answer

API rate limiting

Answer

Data encryption at rest

Answer

Identity federation

Question 14

An organization is migrating a legacy application to the cloud and wants to maximize elasticity. Which THREE characteristics should the application support to benefit from cloud elasticity?

Accepted Answer

Distributed architecture. Statelessness allows instances to be added/removed easily. Horizontal scaling (adding more instances) is typical for elasticity. Distributed architecture supports scaling. Vertical scaling (bigger instances) is limited by instance size, and monolithic design hinders elasticity.

Answer

Monolithic architecture

Answer

Vertical scaling capability

Question 15

A cloud provider offers a service with an SLA of 99.9% availability. Which TWO of the following are likely consequences if the provider fails to meet this SLA?

Accepted Answer

The customer receives service credits. Typically, SLA violations result in service credits (refunds) and can trigger penalty clauses. Immediate termination is rare, and full refund is not standard. Legal action is possible but less direct.

Answer

The customer receives a full refund for the service

Answer

The contract is immediately terminated

Answer

The customer can take legal action

Question 16

A company is considering moving its customer relationship management (CRM) system to the cloud. The CRM is accessed through a web browser and the provider handles all maintenance, security, and infrastructure. Which cloud service model is being used?

Accepted Answer

SaaS. In SaaS, the provider manages everything except user access and data.

Answer

IaaS

Answer

FaaS

Answer

PaaS

Question 17

Which cloud characteristic allows a user to automatically provision computing resources without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service enables automatic provisioning.

Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling

Question 18

An organization wants to deploy a cloud environment where multiple separate agencies with common compliance requirements share the infrastructure, but each agency retains some control over their own resources. Which deployment model best fits this scenario?

Accepted Answer

Community cloud. Community cloud is designed for organizations with shared concerns.

Answer

Hybrid cloud

Answer

Public cloud

Answer

Private cloud

Question 19

In a public cloud IaaS model, which of the following security controls is the cloud customer primarily responsible for implementing?

Accepted Answer

Guest OS patch management. The customer is responsible for securing the guest OS and applications.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of data centers

Question 20

A cloud provider guarantees 99.99% availability for a service. What is the maximum allowed downtime per year (rounded to nearest minute)?

Accepted Answer

52.56 minutes. 99.99% implies 0.01% downtime. 365*24*60 = 525,600 minutes. 0.01% of 525,600 = 52.56 minutes, about 53 minutes.

Answer

1.01 hours

Answer

5.26 minutes

Answer

8.76 hours