CCSP Cloud Concepts, Architecture, and Design Practice Test 4 — 15 Questions

Question 1

A company is adopting a hybrid cloud strategy. Which TWO security considerations are most critical for maintaining a consistent security posture across environments? (Choose two.)

Accepted Answer

Establishing consistent network security policies (e.g., firewall rules). Option A is correct because consistent network security policies such as firewall rules, security groups, and ACLs ensure that traffic controls are enforced uniformly across on-premises and cloud environments, preventing gaps that attackers could exploit when workloads span both. Option D is correct because identity federation for single sign-on (e.g., SAML 2.0 or OIDC with a central IdP like Entra ID or Okta) provides a unified authentication and authorization model, so users and services have consistent identities and access rights regardless of environment. Option B is incorrect because relying solely on perimeter security fails in hybrid cloud, where assets sit outside a single network boundary and zero-trust, defense-in-depth controls are required. Option C is incorrect because separate security teams per environment create inconsistent policies, duplicated effort, and coordination gaps rather than a unified posture. Option E is incorrect because using different encryption keys per environment is not inherently a consistency requirement; key management should follow a unified governance model (e.g., centralized KMS/HSM with proper key rotation and separation), not simply differ by environment.

Answer

Relying solely on perimeter security

Answer

Deploying separate security teams for each environment

Answer

Using different encryption keys for each environment

Question 2

A company wants to migrate its customer relationship management (CRM) system to the cloud and requires that the provider manages the underlying infrastructure, operating system, and middleware, while the company manages only the application and data. Which cloud service model best meets these requirements?

Accepted Answer

Platform as a Service (PaaS). PaaS provides a managed platform where the provider handles the underlying infrastructure, operating system, and middleware (runtime, databases, web servers), while the customer manages only the application and data. This exactly matches the requirement that the company manages only the application and data. Examples include AWS Elastic Beanstalk, Google App Engine, and Azure App Service.

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 3

A financial institution is subject to strict regulatory requirements that mandate data residency and physical control over its infrastructure. At the same time, it wants to leverage cloud bursting for peak loads. Which deployment model should the institution adopt?

Accepted Answer

Hybrid cloud. A hybrid cloud combines a private cloud (or on-premises infrastructure) with public cloud resources, letting the institution keep regulated data and physical control in its private environment while bursting to public cloud for peak loads. This satisfies data residency and physical control requirements while providing elasticity. Private cloud alone cannot burst to public capacity, and public/community clouds do not give the required physical control.

Answer

Private cloud

Answer

Community cloud

Answer

Public cloud

Question 4

An organization is evaluating a cloud provider's SLA for a critical application. The provider offers a 99.95% uptime SLA with a 10% service credit for each 30-minute downtime period exceeding the threshold. The organization's business impact analysis requires a maximum downtime of 4.38 hours per year. Does the provider's SLA meet this requirement, and what is the annual allowed downtime based on the SLA?

Accepted Answer

Yes, because the SLA guarantees 99.95% uptime, which equals 4.38 hours of downtime per year.. 99.95% uptime translates to 0.05% of a year. A standard 365-day year has 8,760 hours, so 8,760 × 0.0005 = 4.38 hours of allowed downtime per year. Since the business impact analysis requires a maximum of 4.38 hours, the SLA exactly meets the requirement. The 10% service credit is a financial remedy, not an uptime guarantee, so it does not change the calculation.

Answer

No, because service credits only apply after 30 minutes of downtime, so actual uptime is lower.

Answer

Yes, because the 10% credit effectively increases the uptime commitment.

Answer

No, because 99.95% uptime allows 5 hours of downtime per year.

Question 5

Which characteristic of cloud computing allows a user to provision computing resources automatically without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the NIST SP 800-145 characteristic that lets a consumer unilaterally provision computing capabilities, such as server time and network storage, automatically as needed without requiring human interaction with each service provider. This is exactly the ability described in the question. The other characteristics address elasticity, network reachability, and metering, not automated provisioning without provider involvement.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Measured service

Question 6

A cloud service provider (CSP) offers a shared infrastructure where multiple customers' virtual machines run on the same physical host but are isolated by the hypervisor. Which cloud deployment model does this represent?

Accepted Answer

Public cloud. The scenario describes a public cloud deployment model, where a CSP owns and operates the infrastructure and offers services to multiple customers (tenants) over the internet. The key characteristic is multi-tenancy: multiple customers' virtual machines share the same physical host but are logically isolated by the hypervisor. This is the defining trait of a public cloud, as opposed to private, hybrid, or community clouds, which have different ownership and access boundaries.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Community cloud

Question 7

An organization is migrating a legacy application to the cloud and wants to minimize vendor lock-in. They plan to use containers orchestrated by Kubernetes. Which design principle is the organization primarily applying?

Accepted Answer

Portability. Portability is the design principle of avoiding dependence on a specific vendor's proprietary services so workloads can move between environments. Using containers orchestrated by Kubernetes is a classic portability strategy because container images and Kubernetes manifests are largely vendor-neutral. This directly addresses the goal of minimizing vendor lock-in.

Answer

Elasticity

Answer

Multitenancy isolation

Answer

Reversibility

Question 8

Which of the following is a key consideration when evaluating a cloud service provider's ability to meet compliance requirements for data sovereignty?

Accepted Answer

The provider's data center locations and geographic restrictions. Data sovereignty requires that data remains subject to the laws of the country where it is stored or processed. Therefore, the provider's data center locations and any geographic restrictions on where data can be stored, processed, or replicated are the primary considerations. This directly determines which legal jurisdictions can claim authority over the data.

Answer

The provider's support tier

Answer

The provider's penetration testing policy

Answer

The provider's SOC 2 Type II report

Question 9

In the shared responsibility model for public cloud, which of the following is typically the responsibility of the cloud customer when using IaaS?

Accepted Answer

Patch management of the guest operating system. In the IaaS shared responsibility model, the cloud provider secures the physical infrastructure, hypervisor, and network fabric, while the customer is responsible for everything from the guest OS upward — including OS patching, middleware, runtime, applications, and data. Patch management of the guest operating system (C) is therefore squarely the customer's duty. This is a defining characteristic of IaaS versus PaaS or SaaS, where the provider assumes more of the stack.

Answer

Network firewall configuration at the hypervisor level

Answer

Physical security of data centers

Answer

Storage device maintenance

Question 10

A cloud architect is designing a solution that must automatically scale compute resources based on real-time demand. The application is stateless and can tolerate brief interruptions. Which cloud design principle is most directly addressed by this requirement?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that allows resources to scale automatically and dynamically based on demand, including scaling out and in quickly. The requirement for automatic scaling of stateless compute based on real-time demand directly maps to this principle. It ensures capacity matches workload without manual intervention.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 11

A company is migrating to a hybrid cloud and needs to ensure consistent security policies across both on-premises and cloud environments. Which of the following is the MOST critical consideration?

Accepted Answer

Ensuring that security policies are uniformly applied and enforced across all environments. The most critical consideration for consistent security policies across hybrid cloud is ensuring that security policies are uniformly applied and enforced across all environments. This ensures that no matter where workloads reside, the same security controls, access rules, and compliance requirements are met, reducing gaps and misconfigurations. While SSO, private connections, and single cloud provider can aid security, they do not guarantee policy consistency; only uniform enforcement does.

Answer

Implementing single sign-on (SSO) for all users

Answer

Using dedicated private network connections

Answer

Choosing the same cloud provider for all public cloud workloads

Question 12

Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?

Accepted Answer

Platform as a Service (PaaS). NIST SP 800-145 defines PaaS as the model where the consumer deploys applications onto cloud infrastructure but does not manage the underlying network, servers, operating systems, or storage. The consumer controls the deployed applications and possibly application-hosting environment configurations — exactly matching the question's description. This is the canonical PaaS definition.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Infrastructure as a Service (IaaS)

Question 13

An organization is looking for a cloud deployment model that is provisioned for exclusive use by a single organization, but may be owned, managed, and operated by the organization, a third party, or some combination. Which deployment model is this?

Accepted Answer

Private cloud. Private cloud is defined as provisioned for exclusive use by a single organization. It can be on-premises or hosted, and managed by the organization or a third party.

Answer

Hybrid cloud

Answer

Community cloud

Answer

Public cloud

Question 14

A cloud security architect is designing a multi-tenant SaaS application that must ensure strong isolation between tenants. Which TWO mechanisms are most effective for achieving multitenancy isolation?

Accepted Answer

Hypervisor-based virtual machine isolation. Hypervisor-based virtual machine isolation (A) is correct because each tenant runs in its own VM with a separate guest OS, so the hypervisor enforces hardware-level separation of CPU, memory, and I/O, preventing one tenant from accessing another tenant's resources even if the guest OS is compromised. Network micro-segmentation (B) is correct because it applies granular, workload-level policies (e.g., security groups, NSGs, or service-mesh rules) that restrict east-west traffic so tenants can only reach their own components, containing lateral movement and enforcing tenant boundaries at the network layer. Encryption at rest (C) is not the most effective isolation mechanism because it protects data confidentiality if storage media is compromised but does not prevent a tenant from accessing another tenant's data through a running application or shared service. Database row-level permissions (D) provide logical access control within a shared schema but rely on correct query and policy configuration, so they are weaker than infrastructure-enforced isolation and can be bypassed by application or SQL flaws. API rate limiting per tenant (E) addresses fairness, abuse prevention, and availability (e.g., throttling to protect against noisy-neighbor effects) but does not isolate tenants' data or execution environments.

Answer

Encryption at rest for all tenant data

Answer

Database row-level permissions

Answer

API rate limiting per tenant

Question 15

A company is evaluating cloud providers for a critical workload and requires high availability, disaster recovery, and portability. Which THREE factors should the company prioritize in the provider evaluation?

Accepted Answer

Support for open APIs and industry standards. Option A is correct because support for open APIs and industry standards directly enables portability, allowing the company to avoid vendor lock-in and migrate or integrate workloads across providers using well-defined interfaces. Option B is correct because independent audit reports such as SOC 2 and ISO 27001 provide verifiable assurance that the provider's security, availability, and operational controls meet recognized compliance frameworks, which is essential for a critical workload. Option D is correct because SLA guarantees for uptime and availability define the provider's contractual commitment to high availability and provide measurable remedies if service levels are missed, directly supporting the HA/DR requirement. Option C is not a primary evaluation factor here because customer support tiers affect responsiveness and service experience but do not by themselves deliver high availability, disaster recovery, or portability. Option E is also not a primary factor because the number of data center locations alone does not guarantee HA/DR or portability; what matters is how those locations are architected, replicated, and exposed through standards and SLAs.

Answer

Provider's customer support tiers

Answer

Number of data center locations