CCSP Cloud Concepts, Architecture, and Design Practice Test 3 — 15 Questions

Question 1

A cloud security architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms should be implemented to prevent data leakage between tenants?

Accepted Answer

Network isolation using virtual networks. Network isolation using virtual networks (B) is correct because placing each tenant's workloads in separate VNets/subnets (or separate VPCs) with security groups/NSGs and peering rules prevents cross-tenant network traffic and lateral movement, which is a primary vector for data leakage in multi-tenant SaaS. Storage isolation through separate databases or schemas (C) is correct because logically or physically partitioning tenant data (dedicated database per tenant, or schema-per-tenant with strict access controls) enforces a hard data boundary so one tenant's queries cannot read another tenant's records. API rate limiting (A) only protects availability and throttles abuse; it does not create a data boundary. Data encryption at rest (D) protects data confidentiality if the storage medium is compromised but does not prevent one tenant from accessing another tenant's data through the application. Identity federation (E) addresses authentication and SSO, not tenant data separation.

Answer

API rate limiting

Answer

Data encryption at rest

Answer

Identity federation

Question 2

An organization is migrating a legacy application to the cloud and wants to maximize elasticity. Which THREE characteristics should the application support to benefit from cloud elasticity?

Accepted Answer

Distributed architecture. Option A (Distributed architecture) is correct because spreading workloads across multiple independent components or nodes lets the cloud platform add or remove capacity in parallel, which is essential for elastic scaling. Option C (Horizontal scaling support) is correct because elasticity is achieved primarily by adding or removing instances (scale out/in), so the application must be designed to run across multiple identical instances. Option D (Stateless design) is correct because stateless components do not hold session or local state, allowing any instance to handle any request and enabling instances to be created or destroyed freely during elastic scaling. Option B (Monolithic architecture) is not correct because a single tightly coupled deployment unit cannot be scaled or updated granularly, limiting elasticity. Option E (Vertical scaling capability) is not correct because vertical scaling means resizing a single server (scale up/down), which is constrained by hardware limits and does not provide the rapid, automated elasticity that horizontal scaling delivers.

Answer

Monolithic architecture

Answer

Vertical scaling capability

Question 3

A company is considering moving its customer relationship management (CRM) system to the cloud. The CRM is accessed through a web browser and the provider handles all maintenance, security, and infrastructure. Which cloud service model is being used?

Accepted Answer

SaaS. SaaS (Software as a Service) is the correct model because the provider delivers a complete, ready-to-use application (the CRM) over the web while managing all underlying infrastructure, platform, security patching, and maintenance. The customer only interacts with the application through a browser and does not manage servers, middleware, or runtime environments. This matches the classic SaaS definition where the consumer uses the provider's application running on cloud infrastructure.

Answer

IaaS

Answer

FaaS

Answer

PaaS

Question 4

Which cloud characteristic allows a user to automatically provision computing resources without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the NIST-defined cloud characteristic that lets consumers unilaterally provision computing capabilities, such as server time and storage, automatically without requiring human interaction with the service provider. This is exactly what the question describes.

Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling

Question 5

An organization wants to deploy a cloud environment where multiple separate agencies with common compliance requirements share the infrastructure, but each agency retains some control over their own resources. Which deployment model best fits this scenario?

Accepted Answer

Community cloud. A community cloud is a deployment model where infrastructure is shared by several organizations with common concerns (e.g., compliance, security, jurisdiction). In this scenario, multiple agencies with common compliance requirements share the infrastructure while each retains control over their own resources, which aligns exactly with the community cloud model. This model balances cost-efficiency with the specific needs of a defined community.

Answer

Hybrid cloud

Answer

Public cloud

Answer

Private cloud

Question 6

In a public cloud IaaS model, which of the following security controls is the cloud customer primarily responsible for implementing?

Accepted Answer

Guest OS patch management. The customer is responsible for securing the guest OS and applications.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of data centers

Question 7

A company is designing a multi-cloud strategy to avoid vendor lock-in and ensure portability. They are considering using containers and an open-source orchestration platform. Which of the following is the BEST choice to achieve workload portability across different cloud providers?

Accepted Answer

Kubernetes. Kubernetes is an open-source container orchestration platform that runs on any cloud or on-premises infrastructure, providing a consistent API and workload abstraction that makes containers portable across providers. Because it is not tied to a single vendor, workloads packaged as Kubernetes manifests or Helm charts can be moved between AWS EKS, Azure AKS, Google GKE, or self-managed clusters with minimal changes, directly addressing vendor lock-in and portability.

Answer

Azure Functions

Answer

AWS Lambda

Answer

VMware vSphere

Question 8

An organization needs to migrate a legacy application to the cloud. The application requires full control over the operating system, middleware, and runtime. The team wants to minimize management overhead while retaining OS-level access. Which cloud service model is most appropriate?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking where the customer manages the OS, middleware, and runtime while the provider manages the underlying physical infrastructure. This matches the requirement for full OS-level control with reduced management overhead compared to on-premises. SaaS, PaaS, and FaaS abstract away the OS, so they cannot satisfy the need for OS-level access.

Answer

SaaS

Answer

FaaS

Answer

PaaS

Question 9

Which of the following is a key benefit of using a hybrid cloud deployment model?

Accepted Answer

Ability to keep sensitive data on-premises while leveraging public cloud for less sensitive workloads. A key benefit of hybrid cloud is the ability to keep sensitive data on-premises while leveraging public cloud for less sensitive workloads, thus meeting compliance and security requirements while gaining cloud scalability. This flexibility is a primary driver for hybrid adoption.

Answer

Complete isolation from public networks

Answer

Single vendor management

Answer

Elimination of shared responsibility

Question 10

Which NIST-defined cloud characteristic ensures that resources can be scaled up and down rapidly based on demand?

Accepted Answer

Rapid elasticity. Rapid elasticity is the NIST-defined essential characteristic that allows cloud resources to be provisioned and released automatically, scaling outward and inward commensurate with demand. It enables the cloud consumer to scale capabilities elastically, often in near real-time, without human intervention. This characteristic directly addresses the ability to scale up and down rapidly based on demand, as stated in the question.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 11

A cloud security architect is evaluating a CSP for a financial services client. Which of the following audit reports would provide the most comprehensive assurance regarding the CSP's controls over security, availability, processing integrity, confidentiality, and privacy?

Accepted Answer

SOC 2 Type II. SOC 2 Type II is specifically designed to provide assurance over security, availability, processing integrity, confidentiality, and privacy (the Trust Services Criteria). It includes an independent auditor's opinion on the effectiveness of controls over a period. This makes it the most comprehensive for the listed areas.

Answer

PCI DSS Attestation of Compliance

Answer

SOC 1 Type II

Answer

ISO 27001 certification

Question 12

Which design principle is MOST directly concerned with the ability to move workloads between cloud providers or back on-premises without significant re-architecture?

Accepted Answer

Portability. Portability is the design principle concerned with the ability to move workloads, data, and applications between cloud providers or back on-premises without significant re-architecture. It emphasizes avoiding proprietary lock-in through open standards, containers, and abstraction layers. The scenario's phrase 'move workloads between cloud providers or back on-premises without significant re-architecture' is the definition of portability.

Answer

Reversibility

Answer

Isolation

Answer

Elasticity

Question 13

A company plans to deploy a multi-tier application across multiple cloud providers to avoid single points of failure. They need to ensure consistent security policies, including identity federation and network segmentation, across all environments. Which architecture consideration is MOST critical?

Accepted Answer

Implementing a unified security policy management tool. Implementing a unified security policy management tool is most critical for ensuring consistent security policies, including identity federation and network segmentation, across multiple cloud providers. Such a tool centralizes policy definition, translation, and enforcement, providing a single pane of glass for security management. This addresses the complexity of multi-cloud environments where native tools differ. Other options either do not address multi-cloud (single provider) or introduce inconsistency (different encryption standards).

Answer

Using a single cloud provider for all tiers

Answer

Storing all data in a single provider's data center

Answer

Using different encryption standards for each provider

Question 14

A cloud architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms are essential to prevent tenant data leakage? (Choose two.)

Accepted Answer

Network isolation (e.g., VLANs, VPCs). Option B (Network isolation, e.g., VLANs, VPCs) is correct because segmenting tenant traffic at Layer 2/Layer 3 with VLANs or cloud VPCs and security groups prevents cross-tenant lateral movement and unauthorized access to another tenant's resources, which is a foundational control against data leakage in multi-tenant SaaS. Option D (Logical data isolation, e.g., database per tenant) is correct because separating tenant records through per-tenant databases, schemas, or tenant-ID row-level filtering ensures that queries and application logic cannot read or modify another tenant's data even if a request is misrouted. Option A (Geographic isolation) is not essential here because placing tenants in different regions addresses residency and latency, not the core logical separation needed to stop data leakage between tenants sharing the same application. Option C (Shared storage volume encryption) is insufficient because encrypting a shared volume protects data at rest but does not prevent one tenant's application context from accessing another tenant's records on that same volume. Option E (Hypervisor isolation) is not the essential mechanism for this scenario because it separates VMs at the virtualization layer, whereas multi-tenant SaaS typically shares application and database tiers where network and logical data isolation are the decisive controls.

Answer

Geographic isolation

Answer

Shared storage volume encryption

Answer

Hypervisor isolation

Question 15

An organization is evaluating a cloud service provider and reviewing their SLA. Which THREE metrics are most important for assessing the provider's reliability and accountability? (Choose three.)

Accepted Answer

Frequency of performance reporting. Option B (Frequency of performance reporting) is correct because an SLA's reporting cadence determines how often the provider must disclose measured performance against targets, giving the customer the visibility needed to verify reliability and hold the provider accountable. Option C (Service credits or compensation for downtime) is correct because financial remedies such as service credits are the primary contractual enforcement mechanism that makes the provider accountable when availability commitments are missed. Option E (Monthly uptime percentage guarantee) is correct because the uptime percentage (for example, 99.9% or 99.95%) is the core quantitative reliability commitment against which actual availability is measured. Option A (Number of data center employees) does not belong because headcount is not a defined SLA reliability or accountability metric and does not reflect service availability. Option D (Provider's stock price) does not belong because stock price is a financial-market indicator unrelated to the contractual service levels in an SLA.

Answer

Number of data center employees

Answer

Provider's stock price