CCSP Cloud Concepts, Architecture, and Design Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Measured service. NIST SP 800-145 defines five essential characteristics of cloud computing, and 'Measured service' (A) is one of them: cloud systems automatically control and optimize resource use via metering capabilities, providing transparency for both provider and consumer. 'Resource pooling' (E) is also an essential characteristic, where the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with resources dynamically assigned and reassigned according to demand. Multitenancy (B) is a consequence of resource pooling but is not itself listed as a separate essential characteristic in NIST SP 800-145. Virtualization (C) is a common enabling technology for cloud computing but is not one of the five NIST essential characteristics. Auditability (D) is a desirable governance property but is not included in the NIST definition of essential cloud characteristics.

Answer

Multitenancy

Answer

Virtualization

Answer

Auditability

Question 2

A financial institution is evaluating a community cloud deployment shared with other banks. Which TWO security considerations are MOST important for this deployment model?

Accepted Answer

Ensuring strong isolation between tenant data and workloads. In a community cloud shared by multiple banks, option D is essential because tenants share the same underlying infrastructure, so strong logical isolation of data and workloads (via mechanisms like VLANs, hypervisor isolation, encryption, and access controls) is required to prevent cross-tenant data leakage or interference. Option E is also critical because a community cloud serving financial institutions must satisfy shared regulatory obligations such as PCI-DSS for cardholder data and SOX for financial reporting, and the provider and tenants must jointly demonstrate compliance. Option A is not a security consideration but a cost/performance concern, and minimizing bandwidth could even undermine security monitoring and logging. Option B is incorrect because in cloud deployments security responsibility is shared, not fully transferred to the provider. Option C is not required for a community cloud, since multi-tenancy on shared physical servers is normal as long as isolation is enforced.

Answer

Minimizing network bandwidth to reduce costs

Answer

The provider assumes full responsibility for all security controls

Answer

Use of dedicated physical servers for each tenant

Question 3

Which THREE of the following are benefits of using a hybrid cloud deployment model?

Accepted Answer

Elasticity to burst to public cloud during peak demand. Option A is correct because a hybrid cloud lets workloads that exceed on-premises capacity burst into the public cloud on demand, providing elasticity during peak periods without permanently over-provisioning private infrastructure. Option C is correct because the hybrid model explicitly supports workload placement decisions, allowing sensitive or regulated data to remain on-premises while less sensitive workloads run in the public cloud. Option D is correct because hybrid cloud management tooling and unified control planes (e.g., Azure Arc, AWS Outposts, or VMware vSphere/vCloud integrations) allow consistent security policies, identity controls, and compliance configurations to be applied across both environments. Option B is not correct because SLAs typically differ between on-premises infrastructure and public cloud providers, and managing them across a hybrid estate is generally more complex, not simplified. Option E is not correct because data sovereignty concerns are not eliminated by hybrid cloud; they must still be addressed through careful workload placement, data residency controls, and jurisdictional compliance, and hybrid deployments can even complicate them.

Answer

Simplified SLA management across environments

Answer

Eliminates data sovereignty concerns

Question 4

When evaluating a cloud service provider's SLA, which TWO metrics are MOST relevant for assessing availability and reliability?

Accepted Answer

Uptime percentage (e.g., 99.99%). Uptime is the primary SLA metric that quantifies availability, directly expressing the percentage of time the service is operational and typically tied to service credits when the committed threshold is missed. Option E (Recovery Time Objective (RTO) and Recovery Point Objective (RPO)) is correct because these metrics define reliability in terms of how quickly service is restored after an outage (RTO) and how much data loss is tolerable (RPO), which are core to assessing a provider's resilience and disaster recovery commitments. Option B (Support ticket response time) relates to support quality and incident handling, not directly to availability or reliability guarantees. Option C (Maximum throughput per instance) is a performance/capacity metric rather than an availability or reliability measure. Option D (Average latency for API calls) is a performance metric that affects responsiveness but does not by itself indicate availability or reliability.

Answer

Support ticket response time

Answer

Maximum throughput per instance

Answer

Average latency for API calls

Question 5

An organization is migrating a legacy application to the cloud and requires reversibility. Which THREE of the following should be considered to ensure the application can be migrated away from the cloud provider in the future?

Accepted Answer

Using containerization with Kubernetes for workload portability. Option A is correct because containerizing workloads with Kubernetes abstracts the application from the underlying cloud infrastructure, so the same container images and manifests can be redeployed on another provider or on-premises cluster, directly supporting reversibility. Option B is correct because designing with open standards such as OAuth for authentication and REST for service interfaces avoids dependence on a single vendor's proprietary protocols, making it feasible to re-host or re-integrate the application elsewhere. Option E is correct because ensuring data can be exported in standard formats like CSV or JSON prevents data lock-in, allowing the organization to move its data to another platform without loss or costly transformation. Option C is incorrect because proprietary storage and compute APIs increase vendor lock-in and make migration away from the provider harder, which is the opposite of the goal. Option D is incorrect because auto-scaling policies address elasticity and performance, not portability or the ability to exit the cloud provider.

Answer

Using proprietary APIs for storage and compute

Answer

Implementing auto-scaling policies

Question 6

A retail company is designing a new cloud architecture for its e-commerce platform. The security team has been asked to define the cloud security architecture. According to the Cloud Security Alliance (CSA) Enterprise Architecture, which of the following is the PRIMARY purpose of the security architecture domain?

Accepted Answer

To provide a framework for managing security risks and controls across the cloud ecosystem. The security architecture domain in the CSA Enterprise Architecture is designed to provide a holistic framework for managing security risks across cloud environments. It integrates security controls and practices into the overall cloud architecture, ensuring that security is aligned with business goals and compliance obligations.

Answer

To ensure that the cloud provider meets all regulatory compliance requirements

Answer

To define the physical security controls for data centers hosting cloud services

Answer

To specify the encryption algorithms required for data at rest and in transit

Question 7

A media production company wants to use a public cloud for rendering video but must retain full control over the guest OS, patching, and runtime configuration. The company does not want to manage physical hardware or hypervisors. Which cloud service model BEST meets these requirements?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS is the only model that gives the customer control over the guest operating system and runtime while the provider manages the physical infrastructure and hypervisor. PaaS, SaaS, and FaaS abstract away the OS layer, removing the control the media company needs. The scenario explicitly requires retaining patching and runtime configuration, which maps directly to IaaS responsibilities.

Answer

Function as a Service (FaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 8

A multinational bank is deploying a hybrid cloud with sensitive workloads on private infrastructure and analytics on a public cloud. The security team must ensure that data classified as confidential never leaves the private environment, while allowing the public cloud to process anonymized datasets. Which cloud deployment model characteristic is MOST relevant to enforcing this boundary?

Accepted Answer

The hybrid model enables workload placement based on data classification and policy.. Hybrid cloud's primary security value in this scenario is the ability to place workloads and data according to classification and policy. The bank can enforce that confidential data stays private while anonymized datasets are processed publicly. Other options either misstate security properties or contradict the requirement, so workload placement based on data classification is the relevant characteristic.

Answer

The hybrid model automatically replicates all data to both environments for redundancy.

Answer

The private cloud eliminates the need for encryption at rest.

Answer

The public cloud provides stronger physical security than private data centers.

Question 9

A media production company needs to process high-resolution video renders that require tightly coupled, low-latency inter-node communication. The company is evaluating cloud deployment models and wants to retain full control over the hardware, hypervisor, and network fabric while still using cloud burst capacity. Which cloud deployment model BEST meets these requirements?

Accepted Answer

Hybrid cloud. The scenario requires both exclusive control over the underlying infrastructure and the ability to extend into elastic public capacity on demand. A hybrid cloud is the only model that pairs a controlled private environment with public cloud bursting, satisfying the latency-sensitive rendering requirements while avoiding permanent over-provisioning of owned hardware.

Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Question 10

A cloud architect is designing a system that must survive the failure of an entire cloud provider region. The application uses a relational database and object storage. Which design approach BEST achieves regional fault tolerance while minimizing data loss and operational complexity?

Accepted Answer

Deploy the application in two regions with asynchronous database replication and cross-region replication for object storage, then use DNS failover to redirect traffic.. Surviving a full region failure requires resources and data in at least two independent regions. Asynchronous database replication avoids the latency and availability penalties of synchronous cross-region writes, cross-region object storage replication protects unstructured data, and DNS failover provides a practical traffic redirection mechanism with acceptable recovery time objectives.

Answer

Deploy the application in a single region with a multi-master database cluster spanning three availability zones and global load balancing.

Answer

Deploy the application in two availability zones within a single region and rely on the provider's managed backup service for the database.

Answer

Deploy the application in two regions using synchronous database replication and a single object storage bucket with cross-region access.

Question 11

A media production company stores and edits large video files on-premises. During peak project periods, editors need to temporarily consume extra compute and storage, but the company wants to keep its existing private cloud and avoid rebuilding workflows. The company wants a solution that lets the private cloud seamlessly use public cloud resources for these bursts without changing how editors access the files. Which cloud deployment model BEST meets this requirement?

Accepted Answer

Hybrid cloud. A hybrid cloud is designed to integrate a private cloud with public cloud services so workloads can move or burst between them. Because the company wants to retain its private editing workflows while temporarily using public resources during peaks, the hybrid model provides the required elasticity without forcing a full migration or redesign.

Answer

Private cloud

Answer

Public cloud

Answer

Community cloud

Question 12

A startup is building a SaaS product on a public cloud. The security team wants to ensure that virtual machines belonging to different customers cannot access each other's memory or network traffic, even though they may share the same physical host. Which cloud architectural concept MOST directly addresses this requirement?

Accepted Answer

Hypervisor-based virtualization and network segmentation. Multi-tenant isolation on shared hardware is achieved through the hypervisor, which partitions memory and CPU, and through network segmentation, which restricts traffic flows between tenants. These architectural controls directly satisfy the requirement that different customers' virtual machines cannot access each other's memory or network traffic even when co-located.

Answer

Broad network access

Answer

Resource pooling

Answer

Measured service

Question 13

A cloud architect is evaluating a public cloud provider for a regulated workload. The provider offers a shared responsibility model. Which TWO of the following are typically the cloud customer's responsibilities under that model? (Choose two.)

Accepted Answer

Configuring identity and access management policies. Under the shared responsibility model, the customer is responsible for security in the cloud, which includes configuring identity and access management policies and classifying and protecting data. Physical access, hypervisor patching, and physical network fabric are provider responsibilities. Regulated workloads require the customer to focus on data protection and access control while relying on the provider for infrastructure security.

Answer

Maintaining the physical network fabric between availability zones

Answer

Patching the hypervisor

Answer

Managing physical access to the data center

Question 14

A cloud architect is designing a solution that must ensure data isolation between tenants in a multi-tenant environment. The architect decides to use a virtual private cloud (VPC) per tenant. Which of the following is the PRIMARY security benefit of this approach?

Accepted Answer

It ensures that each tenant's network traffic is isolated from other tenants.. Using a VPC per tenant provides network-level isolation, which is critical in multi-tenant environments to prevent cross-tenant traffic and unauthorized access. Each VPC acts as a virtual network boundary, with its own IP range, subnets, route tables, and security groups. This logical separation helps enforce security policies and reduces the attack surface, making it the primary security benefit.

Answer

It provides dedicated physical hardware for each tenant.

Answer

It automatically encrypts all data at rest for each tenant.

Answer

It guarantees compliance with data residency requirements.

Question 15

An enterprise is evaluating a cloud service provider for a workload that handles regulated data. The security architect must assess whether the provider's cloud architecture supports the organization's data residency and audit obligations. Which TWO of the following are the MOST relevant architectural artifacts to request from the provider? (Choose two.)

Accepted Answer

Independent third-party audit reports and certifications such as SOC 2 and ISO/IEC 27001. Assessing data residency and audit obligations requires verifiable evidence about where data lives and how controls are validated. A data flow diagram identifies storage, processing, and replication locations, while independent audit reports and certifications demonstrate that controls have been examined against recognized standards. Together they give the architect the factual basis needed for compliance due diligence.

Answer

The provider's current stock price and quarterly earnings report

Answer

A copy of the provider's internal employee acceptable use policy

Answer

The provider's marketing brochure describing its global footprint and uptime record