CCSP Cloud Concepts, Architecture, and Design Practice Test 2 — 15 Questions

Question 1

An organization is adopting a hybrid cloud model. A security architect must document which cloud capabilities are essential to the organization's cloud reference architecture. According to the Cloud Security Alliance, which capability describes the ability to monitor, control, and audit service usage and performance across cloud environments?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Service level management. The CSA cloud reference architecture identifies service level management as the capability that covers monitoring, control, and audit of service usage and performance. Elasticity and measured service describe scaling and metering characteristics, while auditability is only one part of the governance picture. Service level management integrates measurement, reporting, and control, which is exactly what the architect must document.

Answer

Elasticity

Answer

Auditability

Answer

Measured service

Question 2

A multinational corporation is designing a cloud architecture that must comply with GDPR for European customer data. The company wants to ensure that data remains within the EU and is not replicated to other regions without explicit consent. Which cloud design principle should be implemented to achieve this?

Accepted Answer

Data localization. Data localization involves implementing technical and organizational measures to ensure data is stored and processed only within a specified jurisdiction. For GDPR compliance, the company must prevent data from being replicated to regions outside the EU without consent. This requires configuring cloud services to use only EU regions, enabling geo-fencing, and restricting cross-region replication. Data localization is the design principle that directly enforces this boundary.

Answer

Data minimization

Answer

Data sovereignty

Answer

Data residency

Question 3

A small startup is developing a new mobile application and wants to minimize upfront infrastructure costs and management overhead. The team has limited operational expertise and prefers to focus on coding rather than managing servers. Which cloud service model is MOST appropriate for deploying the application's backend?

Accepted Answer

Platform as a Service (PaaS). The startup wants to minimize upfront costs and management overhead while focusing on coding. PaaS provides a complete development and deployment environment, managing the underlying infrastructure, so the team can focus on application development. IaaS requires too much operational effort, SaaS does not allow custom development, and FaaS is limited to event-driven functions. Therefore, PaaS is the most appropriate service model.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 4

A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?

Accepted Answer

Private cloud. Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 5

Which cloud service model provides the consumer with the ability to deploy and run custom applications using the provider's programming languages, libraries, and tools, but does not allow management of the underlying infrastructure?

Accepted Answer

PaaS. PaaS (Platform as a Service) provides a managed runtime environment where consumers deploy applications built with provider-supported languages, libraries, and tools, while the provider manages the underlying servers, storage, networking, and OS. The consumer controls only the deployed application and its configuration, not the infrastructure — exactly matching the scenario described.

Answer

SaaS

Answer

IaaS

Answer

CaaS

Question 6

A security auditor is reviewing a cloud provider's controls to ensure that customer data is appropriately isolated. Which design principle is most directly related to this requirement?

Accepted Answer

Multitenancy isolation. Multitenancy isolation is the design principle that ensures customer data and workloads are logically separated in a shared cloud environment. It directly addresses the auditor's requirement by preventing one tenant from accessing another's data through mechanisms like virtual networks, hypervisor separation, and encryption. This principle is fundamental to cloud security and compliance.

Answer

Reversibility

Answer

Portability

Answer

Elasticity

Question 7

A company is adopting a hybrid cloud model to run sensitive workloads on-premises and less critical applications in the public cloud. Which security consideration is most critical for this environment?

Accepted Answer

Maintaining consistent security policies across both environments. In a hybrid cloud model, the most critical security consideration is maintaining consistent security policies across both on-premises and public cloud environments. This ensures that security controls, access management, data protection, and compliance requirements are uniformly enforced, reducing gaps that attackers could exploit. Inconsistencies can lead to misconfigurations, unauthorized access, and data leakage between environments. While network connectivity and encryption are important, they are components of a broader policy consistency strategy.

Answer

Using a single cloud provider for both environments

Answer

Ensuring high-speed network connectivity

Answer

Implementing data encryption at rest only

Question 8

Which cloud characteristic allows a consumer to automatically provision computing resources, such as server time and storage, as needed without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the NIST-defined characteristic where a consumer can unilaterally provision computing capabilities, such as server time and storage, automatically without human interaction with the provider. This matches the question's wording exactly.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 9

A cloud customer is evaluating a provider's service level agreement (SLA) that guarantees 99.99% availability. What is the maximum allowable downtime per year (in minutes) before the SLA is violated?

Accepted Answer

52.56 minutes. An SLA of 99.99% availability allows 0.01% downtime per year. A year has 365 days × 24 hours × 60 minutes = 525,600 minutes. 0.01% of 525,600 is 52.56 minutes, so the maximum allowable downtime is 52.56 minutes per year. This is the correct calculation.

Answer

8.76 hours

Answer

5.26 minutes

Answer

87.6 hours

Question 10

Which of the following is a key benefit of using containers, such as Docker, in a cloud environment to achieve portability?

Accepted Answer

Containers package applications with dependencies to run consistently across environments. Containers bundle the application code together with its libraries, runtime, and configuration into a single immutable image, so the same image runs identically on a developer laptop, on-premises servers, or any cloud VM/container service. This decoupling from the underlying host OS and infrastructure is precisely what delivers portability across cloud environments.

Answer

Containers are always stateless

Answer

Containers require a specific hypervisor to run

Answer

Containers provide hardware-level virtualization

Question 11

In the NIST SP 800-145 definition of cloud computing, which characteristic is described as the capability to rapidly and elastically provision and release resources, often automatically?

Accepted Answer

Rapid elasticity. NIST SP 800-145 defines rapid elasticity as the capability to elastically provision and release resources, in some cases automatically, to scale rapidly outward and inward commensurate with demand. The phrase 'rapidly and elastically provision and release resources, often automatically' maps directly to this characteristic. It is one of the five essential characteristics of cloud computing alongside on-demand self-service, broad network access, resource pooling, and measured service.

Answer

Resource pooling

Answer

Broad network access

Answer

Measured service

Question 12

A company wants to avoid vendor lock-in when adopting cloud services. Which strategy is most effective for achieving portability?

Accepted Answer

Adopting open standards and open-source APIs like Kubernetes and Terraform. Using open standards and APIs ensures that workloads can be moved between providers. Using proprietary APIs, single provider services, or managed services increases lock-in.

Answer

Using proprietary APIs from the cloud provider

Answer

Subscribing to a single cloud provider's managed services

Answer

Using proprietary data formats

Question 13

In a public cloud IaaS environment, which of the following is the customer responsible for securing, according to the shared responsibility model?

Accepted Answer

Operating system and applications. In the IaaS shared responsibility model, the cloud provider secures the physical facilities, hardware, hypervisor, and network fabric, while the customer is responsible for everything from the guest operating system upward, including patching, applications, and data. Therefore the customer must secure the operating system and applications they deploy on IaaS instances.

Answer

Virtualization hypervisor

Answer

Network infrastructure

Answer

Physical security of data centers

Question 14

A community cloud is best suited for which scenario?

Accepted Answer

Several government agencies with similar security and compliance requirements. A community cloud is shared infrastructure provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, compliance). Several government agencies with similar security and compliance requirements is the canonical example, because they can share costs while meeting common regulatory mandates like FedRAMP or CJIS. The defining trait is a bounded community with shared interests, not the general public.

Answer

A startup wanting to minimize costs by sharing resources with the general public

Answer

A single organization needing dedicated infrastructure

Answer

A company that needs to burst workloads to the public cloud during peak times

Question 15

Which audit report provides the most comprehensive assurance regarding a cloud provider's controls over a period of time, including controls related to security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II reports provide assurance over the design AND operating effectiveness of controls across a defined audit period (typically 3–12 months), covering the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. This period-based testing makes it the most comprehensive assurance option for evaluating a cloud provider's sustained control environment.

Answer

ISO 27001 certification

Answer

SOC 2 Type I

Answer

CSA STAR self-assessment