CCSP Cloud Concepts, Architecture, and Design Practice Test 3 — 15 Questions

Question 1

A company wants to migrate its customer relationship management (CRM) system to the cloud and requires that the provider manages the underlying infrastructure, operating system, and middleware, while the company manages only the application and data. Which cloud service model best meets these requirements?

Accepted Answer

Platform as a Service (PaaS). In PaaS, the provider manages the infrastructure, OS, and middleware; the customer manages applications and data. IaaS would require the customer to manage OS and middleware; SaaS would have the provider manage applications as well.

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 2

A financial institution is subject to strict regulatory requirements that mandate data residency and physical control over its infrastructure. At the same time, it wants to leverage cloud bursting for peak loads. Which deployment model should the institution adopt?

Accepted Answer

Hybrid cloud. A hybrid cloud combines a private cloud for sensitive workloads with public cloud resources for elasticity, meeting both regulatory and scalability needs.

Answer

Private cloud

Answer

Community cloud

Answer

Public cloud

Question 3

An organization is evaluating a cloud provider's SLA for a critical application. The provider offers a 99.95% uptime SLA with a 10% service credit for each 30-minute downtime period exceeding the threshold. The organization's business impact analysis requires a maximum downtime of 4.38 hours per year. Does the provider's SLA meet this requirement, and what is the annual allowed downtime based on the SLA?

Accepted Answer

Yes, because the SLA guarantees 99.95% uptime, which equals 4.38 hours of downtime per year.. 99.95% uptime allows 0.05% downtime per year. 0.05% of 365 days * 24 hours = 0.05% * 8760 hours = 4.38 hours. Exactly meets the requirement. The service credit mechanism does not change the allowed downtime.

Answer

No, because service credits only apply after 30 minutes of downtime, so actual uptime is lower.

Answer

Yes, because the 10% credit effectively increases the uptime commitment.

Answer

No, because 99.95% uptime allows 5 hours of downtime per year.

Question 4

Which characteristic of cloud computing allows a user to provision computing resources automatically without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service enables users to provision resources as needed without manual intervention from the provider. This is a fundamental characteristic defined by NIST.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Measured service

Question 5

A cloud service provider (CSP) offers a shared infrastructure where multiple customers' virtual machines run on the same physical host but are isolated by the hypervisor. Which cloud deployment model does this represent?

Accepted Answer

Public cloud. Public cloud utilizes shared infrastructure with multi-tenancy, where hypervisor isolation separates tenants. Private cloud would be dedicated; community cloud is shared by a specific group; hybrid combines models.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Community cloud

Question 6

An organization is migrating a legacy application to the cloud and wants to minimize vendor lock-in. They plan to use containers orchestrated by Kubernetes. Which design principle is the organization primarily applying?

Accepted Answer

Portability. Portability focuses on avoiding vendor lock-in by using open standards and technologies like Kubernetes and Docker that can run across different cloud providers.

Answer

Elasticity

Answer

Multitenancy isolation

Answer

Reversibility

Question 7

Which of the following is a key consideration when evaluating a cloud service provider's ability to meet compliance requirements for data sovereignty?

Accepted Answer

The provider's data center locations and geographic restrictions. Data sovereignty requires that data is stored and processed in specific geographic locations. Understanding where data centers are located and if they comply with local laws is crucial.

Answer

The provider's support tier

Answer

The provider's penetration testing policy

Answer

The provider's SOC 2 Type II report

Question 8

In the shared responsibility model for public cloud, which of the following is typically the responsibility of the cloud customer when using IaaS?

Accepted Answer

Patch management of the guest operating system. In IaaS, the customer is responsible for managing the operating system, applications, and data. The provider manages the physical infrastructure.

Answer

Network firewall configuration at the hypervisor level

Answer

Physical security of data centers

Answer

Storage device maintenance

Question 9

A cloud architect is designing a solution that must automatically scale compute resources based on real-time demand. The application is stateless and can tolerate brief interruptions. Which cloud design principle is most directly addressed by this requirement?

Accepted Answer

Rapid elasticity. Rapid elasticity allows resources to scale up and down automatically to meet demand, which is the principle being applied. This is a key characteristic of cloud computing.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 10

A company is migrating to a hybrid cloud and needs to ensure consistent security policies across both on-premises and cloud environments. Which of the following is the MOST critical consideration?

Accepted Answer

Ensuring that security policies are uniformly applied and enforced across all environments. Consistent security policy enforcement is key in hybrid cloud. While identity management and encryption are important, ensuring the same policies apply across environments is the most critical to avoid gaps.

Answer

Implementing single sign-on (SSO) for all users

Answer

Using dedicated private network connections

Answer

Choosing the same cloud provider for all public cloud workloads

Question 11

Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?

Accepted Answer

Platform as a Service (PaaS). This is the definition of Platform as a Service (PaaS) per NIST SP 800-145. The consumer manages applications and data, while the provider manages everything else.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Question 12

An organization is looking for a cloud deployment model that is provisioned for exclusive use by a single organization, but may be owned, managed, and operated by the organization, a third party, or some combination. Which deployment model is this?

Accepted Answer

Private cloud. Private cloud is defined as provisioned for exclusive use by a single organization. It can be on-premises or hosted, and managed by the organization or a third party.

Answer

Hybrid cloud

Answer

Community cloud

Answer

Public cloud

Question 13

A cloud security architect is designing a multi-tenant SaaS application that must ensure strong isolation between tenants. Which TWO mechanisms are most effective for achieving multitenancy isolation?

Accepted Answer

Hypervisor-based virtual machine isolation. Network micro-segmentation and hypervisor-level isolation are key for multi-tenant isolation. Encryption at rest protects data but does not isolate compute; database row-level permissions provide logical but not strong isolation; API rate limiting controls usage but not isolation.

Answer

Encryption at rest for all tenant data

Answer

Database row-level permissions

Answer

API rate limiting per tenant

Question 14

A company is evaluating cloud providers for a critical workload and requires high availability, disaster recovery, and portability. Which THREE factors should the company prioritize in the provider evaluation?

Accepted Answer

Support for open APIs and industry standards. SLA guarantees availability, open APIs and standards enable portability, and audit reports demonstrate security and compliance. Data center locations are important for latency but not directly for portability; support tiers are operational but not strategic for these requirements.

Answer

Provider's customer support tiers

Answer

Number of data center locations

Question 15

An organization is adopting a hybrid cloud strategy and needs to ensure secure connectivity between on-premises and cloud environments. Which TWO approaches are most appropriate for this purpose?

Accepted Answer

Site-to-site VPN over the public internet. VPN and dedicated private connections (like AWS Direct Connect or Azure ExpressRoute) are standard for secure hybrid cloud connectivity. Cloud access security brokers (CASBs) are for monitoring, not connectivity; public internet is not secure; MPLS is a type of private connection but less common in cloud contexts.

Answer

Direct exposure of on-premises services to the cloud via public internet

Answer

Cloud access security broker (CASB)

Answer

MPLS-based VPN from a telecom provider