CCSP Cloud Concepts, Architecture, and Design Practice Test 6 — 15 Questions

Question 1

A financial institution requires a cloud environment that is shared by multiple organizations with common regulatory compliance needs, such as PCI DSS. Which deployment model is most appropriate?

Accepted Answer

Community cloud. A community cloud is shared by multiple organizations that have common regulatory or compliance requirements, such as PCI DSS, making it the ideal model for a financial institution needing a compliant shared environment. It provides the cost and scalability benefits of multi-tenancy while meeting sector-specific controls. This matches the definition of community cloud in NIST SP 800-145.

Answer

Private cloud

Answer

Public cloud

Answer

Hybrid cloud

Question 2

An organization is evaluating cloud service providers and notices that one provider's SLA offers 99.99% availability for a specific service, while another offers 99.9%. If the service costs $100,000 per month, what is the maximum allowable downtime per month for the 99.99% SLA?

Accepted Answer

4.32 minutes. The 99.99% SLA allows for a maximum of 0.01% downtime per month. Assuming a 30-day month (43,200 minutes), 0.01% of 43,200 minutes is 4.32 minutes. Therefore, the correct answer is 4.32 minutes.

Answer

8.64 minutes

Answer

43.2 minutes

Answer

2.16 minutes

Question 3

Which characteristic of cloud computing allows a user to automatically provision computing resources without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is the essential cloud characteristic that enables a consumer to unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. This is exactly what the question describes: automatic provisioning without human interaction. Rapid elasticity, broad network access, and resource pooling are related but distinct characteristics that do not specifically address the automatic provisioning aspect.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Resource pooling

Question 4

A company wants to migrate a legacy application to the cloud with minimal re-architecture. They need control over the operating system and middleware but do not want to manage physical hardware. Which service model is most suitable?

Accepted Answer

IaaS. IaaS provides virtualized compute, storage, and networking where the customer controls the OS and middleware but does not manage physical hardware, matching the requirement for minimal re-architecture with OS-level control. It is the lowest-level cloud service model that still abstracts hardware.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 5

Which cloud design principle is most directly related to ensuring that an organization can migrate workloads from one cloud provider to another without significant re-engineering?

Accepted Answer

Portability. Portability is the cloud design principle specifically concerned with avoiding provider lock-in by designing workloads so they can be moved between cloud providers with minimal re-engineering. It emphasizes use of open standards, containerization, abstraction layers, and portable data formats so that the same workload can run on AWS, Azure, or GCP without significant refactoring. This directly matches the scenario of migrating workloads across providers without significant re-engineering.

Answer

Reversibility

Answer

Multi-tenancy isolation

Answer

Elasticity

Question 6

In a hybrid cloud deployment, which of the following is a critical security consideration?

Accepted Answer

Ensuring consistent security policy across environments. Consistent security policy across environments is critical in hybrid cloud because workloads and data span on-premises and cloud boundaries, and inconsistent controls create gaps attackers can exploit. Unified policy ensures identity, encryption, logging, and access controls are applied uniformly. This is a foundational governance requirement for hybrid architectures.

Answer

Using only public cloud for sensitive data

Answer

Avoiding any use of APIs for integration

Answer

Eliminating all private cloud resources

Question 7

An organization is using a public cloud IaaS and wants to ensure they understand which security responsibilities fall on them. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Security of the guest operating system. In an IaaS deployment, the cloud provider secures the physical facility, hardware, and hypervisor, while the customer retains responsibility for everything from the guest OS upward — including OS patching, hardening, host firewalls, and the applications and data running on top. Option C correctly identifies the guest operating system as a customer responsibility. This is the classic 'security OF the cloud vs. security IN the cloud' split defined by the shared responsibility model.

Answer

Hypervisor security

Answer

Physical security of data centers

Answer

Network infrastructure hardening

Question 8

Which cloud design principle ensures that resources can be dynamically adjusted to meet changing demand, often using auto-scaling groups?

Accepted Answer

Elasticity. Elasticity is the cloud design principle that allows resources to be automatically and dynamically scaled up or down to match changing demand, typically implemented via auto-scaling groups, horizontal pod autoscalers, or serverless concurrency. It is what lets a workload add capacity during peak load and release it during idle periods, optimizing both performance and cost. Auto-scaling groups are the canonical implementation of elasticity on IaaS platforms.

Answer

Resource pooling

Answer

Resiliency

Answer

Measured service

Question 9

A cloud provider offers a service with an SLA of 99.999% availability. What is the maximum allowable downtime per year in minutes? (Assume 365 days)

Accepted Answer

5.26 minutes. An SLA of 99.999% availability (often called 'five nines') allows for a maximum of 5.26 minutes of downtime per year. This is calculated by taking the total minutes in a year (365 days × 24 hours × 60 minutes = 525,600 minutes) and multiplying by the allowed unavailability (100% - 99.999% = 0.001%, or 0.00001 as a decimal). 525,600 × 0.00001 = 5.256 minutes, which rounds to 5.26 minutes.

Answer

8.76 minutes

Answer

0.526 minutes

Answer

52.6 minutes

Question 10

Which of the following is an example of a cloud interoperability standard that facilitates portability of containerized applications across different cloud environments?

Accepted Answer

Kubernetes. Kubernetes is an open-source container orchestration platform whose API and manifests (pods, deployments, services) are portable across cloud providers, making it the de facto interoperability standard for containerized workloads. It is governed by the CNCF and implemented by AWS EKS, Azure AKS, GCP GKE, and on-prem distributions, enabling workload portability.

Answer

SOC 2 Type II

Answer

CSA STAR

Answer

ISO 27001

Question 11

Which NIST essential characteristic of cloud computing allows the provider to dynamically assign and reassign resources to multiple tenants, often using a multi-tenant model?

Accepted Answer

Resource pooling. Resource pooling is the NIST essential characteristic that allows the provider to dynamically assign and reassign physical and virtual resources to multiple tenants using a multi-tenant model. This pooling enables economies of scale and flexibility, as resources are shared and reassigned based on demand. The other characteristics do not specifically describe this dynamic assignment to tenants.

Answer

Rapid elasticity

Answer

Broad network access

Answer

Measured service

Question 12

A company is considering migrating its customer relationship management (CRM) system to a SaaS provider. Which TWO of the following security responsibilities typically remain with the customer in a SaaS deployment?

Accepted Answer

User access management. In a SaaS deployment, the customer retains responsibility for managing its own users and identities, so user access management (C) — provisioning, deprovisioning, role assignment, and enforcing least privilege through SSO/MFA — stays with the customer. Likewise, data classification and access control (E) remain customer duties because the customer owns the data and must define its sensitivity, retention, and who may access it, even though the provider secures the underlying platform. Physical security of data centers (A) is handled by the SaaS provider, which owns and operates the facilities. Operating system patching (B) is the provider's responsibility since the customer has no access to the underlying OS in a SaaS model. Application vulnerability management (D) also belongs to the provider, as it develops, hosts, and maintains the SaaS application itself.

Answer

Physical security of data centers

Answer

Operating system patching

Answer

Application vulnerability management

Question 13

Which cloud service model provides the customer with the ability to deploy and run custom applications using the provider's infrastructure, where the customer manages the applications and data, but does not manage the underlying operating system or hardware?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides the customer with the ability to deploy and run custom applications using the provider's infrastructure, where the customer manages the applications and data, but does not manage the underlying operating system or hardware. This matches the description exactly.

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Question 14

A healthcare organization is migrating patient records to a public cloud provider. Which of the following is the most critical consideration regarding shared responsibility when using IaaS?

Accepted Answer

The customer is responsible for securing the operating system, applications, and data they deploy on the IaaS platform.. In IaaS, the provider secures the physical hosts, hypervisor, and network fabric, but the customer retains responsibility for the guest OS, middleware, applications, and data — including patching, hardening, and encryption choices. For a healthcare workload, that means the customer must secure the OS and application layer even though the provider owns the hardware.

Answer

The cloud provider is responsible for all security controls because they own the infrastructure.

Answer

The customer has no responsibility for network security because the provider manages the hypervisor.

Answer

The cloud provider automatically encrypts all data at rest and in transit by default.

Question 15

An organization is designing a multi-cloud strategy using containers to avoid vendor lock-in. Which of the following approaches BEST ensures portability of containerized applications across different cloud providers?

Accepted Answer

Standardize on Docker images and Kubernetes orchestration with open-source tooling.. Standardizing on Docker images and Kubernetes orchestration with open-source tooling (C) best ensures portability because Docker images are OCI-compliant and Kubernetes is a CNCF-graduated project supported by all major cloud providers. This combination avoids proprietary APIs and allows workloads to be moved between AWS EKS, Azure AKS, Google GKE, or on-premises clusters with minimal changes. Open-source tooling further reduces lock-in by providing consistent APIs and configuration formats.

Answer

Use cloud provider-specific container services like Amazon ECS with proprietary APIs.

Answer

Use nested containers to abstract the underlying cloud provider.

Answer

Deploy containers directly on virtual machines without an orchestration layer.