CCSP Cloud Concepts, Architecture, and Design Practice Test 8 — 15 Questions

Question 1

A cloud architect is designing a system for a media streaming company that experiences unpredictable spikes in viewer demand during live events. The company wants to minimize infrastructure costs during periods of low demand while maintaining the ability to handle sudden increases in traffic. The architect proposes using a cloud deployment model that provides rapid elasticity and measured service. Which cloud deployment model BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Public cloud. The public cloud model is designed to provide on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These characteristics allow the media streaming company to automatically scale resources during live events and reduce costs when demand is low. Private, community, and hybrid models do not offer the same combination of rapid elasticity and cost efficiency for unpredictable workloads.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 2

A startup wants to deploy a customer relationship management (CRM) application without managing any servers, operating systems, or middleware. The vendor hosts the application, and the startup's administrators only create user accounts and configure settings through a web interface. Which cloud service category is being used?

Accepted Answer

Software as a Service (SaaS). The clue is that the provider hosts the entire application and the customer only manages users and configuration. That is the SaaS model, where the provider owns the application, runtime, middleware, operating system, and infrastructure. IaaS and PaaS leave more layers under customer control, and FaaS is a developer-oriented serverless compute service rather than a finished business application.

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Answer

Platform as a Service (PaaS)

Question 3

A small business wants to use a cloud-based email and collaboration suite where the provider manages the application, servers, and operating system. The business only needs to configure user accounts and settings. Which cloud service model is being used?

Accepted Answer

Software as a Service (SaaS). SaaS is the model where the provider manages the entire application stack, and the customer only handles configuration and user management. The scenario explicitly states the provider manages the application, servers, and operating system, leaving only account and settings configuration to the business. IaaS, PaaS, and FaaS all require more customer responsibility for the application or runtime.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 4

A healthcare organization is designing a cloud solution to store and process electronic protected health information (ePHI). The organization must comply with HIPAA and wants to ensure that the cloud service provider (CSP) meets the necessary security and privacy requirements. The organization is evaluating a CSP that offers a Business Associate Agreement (BAA). Which of the following is the MOST critical factor to verify before signing the BAA?

Accepted Answer

The CSP has implemented appropriate administrative, physical, and technical safeguards to protect ePHI.. The HIPAA Security Rule requires covered entities and their business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. Before signing a BAA, the healthcare organization must verify that the CSP has these safeguards in place. While data residency, contractual clauses, and SLAs are relevant, they do not replace the need for comprehensive security controls.

Answer

The CSP's BAA includes a clause allowing the CSP to use ePHI for its own purposes.

Answer

The CSP's data center locations are within the United States.

Answer

The CSP offers a 99.999% uptime service level agreement (SLA).

Question 5

A startup is developing a new mobile application and wants to minimize infrastructure management while focusing on code development. The team has limited operational resources and prefers a serverless approach. Which cloud service model should they adopt?

Accepted Answer

Function as a Service (FaaS). FaaS is the most serverless option, allowing developers to run code in response to events without provisioning or managing servers. It aligns with the startup's goal of minimizing infrastructure management and focusing on code development. The provider handles all scaling, patching, and capacity planning, making it ideal for teams with limited operational resources.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 6

A small business wants to move its email and productivity suite to a cloud service where the provider manages the application, runtime, and underlying infrastructure, and users access the software through a browser. Which cloud service model is being described?

Accepted Answer

Software as a Service (SaaS). In SaaS, the provider manages the application, runtime, middleware, operating system, and infrastructure, while the customer consumes the software, often through a browser. Email and productivity suites delivered this way fit the SaaS model precisely, with the customer retaining only limited configuration and user management responsibilities.

Answer

Function as a Service (FaaS)

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Question 7

A media company runs a video transcoding workflow on a public cloud. Jobs arrive unpredictably and must be processed within minutes, but the company wants to minimize cost by using spare capacity that can be reclaimed when demand for full-price capacity rises. The jobs are checkpointed every 30 seconds and can resume on a different host. Which cloud service model and purchasing approach BEST fits this requirement?

Accepted Answer

Infrastructure as a Service with spot instances. The workload is interruption-tolerant because it checkpoints frequently and can resume elsewhere, which is exactly the profile that reclaimable spare-capacity pricing is built for. Using infrastructure as a service preserves control over the transcoding runtime while allowing the team to bid on spare capacity and cut cost. Committed discounts, per-seat subscriptions, and dedicated hosts all price or isolate capacity in ways that do not match unpredictable, bursty batch processing.

Answer

Platform as a Service with a committed use discount

Answer

Infrastructure as a Service with dedicated hosts

Answer

Software as a Service with a per-seat subscription

Question 8

A media company runs a video-transcoding workload on a public cloud IaaS platform. The workload is stateless, tolerant of interruption, and must complete within a 6-hour window at the lowest possible compute cost. The company's architects propose using a cloud service that provisions spare capacity at a significant discount but can reclaim it with a two-minute notice. Which cloud deployment and service model does this describe?

Accepted Answer

Spot instances within a public cloud. The workload is stateless, tolerant of interruption, and cost-sensitive, which maps precisely to spare-capacity compute sold at a discount with short-notice reclamation. Committed-term reservations, physically isolated hosts, and full-price on-demand capacity all fail at least one stated constraint, either cost, availability guarantees, or the eviction behavior the architects are designing around.

Answer

Reserved instances within a community cloud

Answer

Dedicated hosts within a private cloud

Answer

On-demand instances within a hybrid cloud

Question 9

A government agency is evaluating a cloud deployment model where several agencies with similar missions and compliance obligations will jointly use a cloud environment governed by a shared policy framework. Each agency will retain independent control over its own data and security configurations. Which cloud deployment model does this describe?

Accepted Answer

Community cloud. The community cloud model is defined by exclusive use among a group of organizations sharing common mission, security, policy, and compliance interests. Because several agencies jointly consume the environment under a shared governance framework while each controls its own data, this matches the community cloud definition precisely rather than single-tenant private, open public, or cross-model hybrid arrangements.

Answer

Hybrid cloud

Answer

Private cloud

Answer

Public cloud

Question 10

A cloud security manager is designing an exit strategy for a critical SaaS application. The provider's contract permits data export only through a proprietary API that returns records in a non-standard binary format. The manager must reduce the risk of being unable to move data to another provider. Which action BEST addresses this risk?

Accepted Answer

Negotiate a contractual right to receive data in a documented, non-proprietary format at any time. The core risk is that data can only be extracted in a proprietary binary format, which prevents migration to another provider. The strongest mitigation is a contractual right to receive the data in a documented, non-proprietary format on demand. Authentication hardening, backups through the same API, and API documentation do not remove the format dependency, so they cannot resolve the portability problem.

Answer

Enable multi-factor authentication for all administrative accounts on the SaaS platform

Answer

Require the provider to publish its API documentation to the customer's security team

Answer

Replicate the SaaS data nightly to an on-premises backup appliance using the same API

Question 11

A logistics firm runs a customer portal on a public cloud provider. The board wants assurance that a provider outage will not halt order intake. The architect proposes an active-passive deployment in a second region of the same provider. Which design element is MOST critical to validate the recovery time objective?

Accepted Answer

Regularly scheduled failover tests that measure actual recovery time and data loss. Recovery objectives are validated by measurement, not by documentation or provider guarantees. Scheduled failover exercises reveal the real elapsed time to restore service and the true data loss window, accounting for DNS time-to-live, database promotion, and application reconnection. Replication and agreements enable recovery, but only testing produces the evidence that the stated recovery time objective is achievable.

Answer

A documented failover runbook that has never been executed

Answer

A service level agreement from the provider guaranteeing 99.99 percent regional availability

Answer

Cross-region replication of the database with asynchronous commit enabled

Question 12

A startup is deploying a new web application and wants to avoid managing servers, operating systems, or runtime updates. The developers only want to upload code and have the provider handle scaling, patching, and availability. They do not need control over the underlying infrastructure. Which cloud service model is MOST appropriate?

Accepted Answer

PaaS. PaaS abstracts the infrastructure and runtime so developers can focus on code while the provider handles patching, scaling, and availability. Because the startup does not want to manage servers, operating systems, or runtime updates, PaaS aligns directly with its operational and development needs.

Answer

DaaS

Answer

IaaS

Answer

SaaS

Question 13

A cloud security manager is evaluating the security responsibilities of the cloud provider and the cloud consumer under the shared responsibility model for a PaaS deployment. Which TWO of the following are typically the responsibility of the cloud consumer? (Choose two.)

Accepted Answer

Managing user identities and access within the application. In a PaaS model, the cloud provider manages the underlying infrastructure, including servers, operating systems, and runtime environments, while the consumer is responsible for the security of their applications and data. This includes configuring application-level security controls and managing user identities and access within the application. These two areas fall under the consumer's control and are critical for protecting the application from threats.

Answer

Managing the physical security of data centers

Answer

Securing the hypervisor and virtualization layer

Answer

Patching the underlying operating system and runtime

Question 14

A financial services company is migrating its legacy on-premises application to a public cloud IaaS environment. The application currently uses a shared file system that requires strong consistency and low-latency access for transaction processing. The cloud architect must choose a storage solution that meets these performance requirements. Which cloud storage type is MOST appropriate?

Accepted Answer

File storage. The application requires a shared file system with strong consistency and low latency. Cloud file storage services, such as Amazon EFS or Azure Files, provide shared NFS or SMB access with configurable performance and strong consistency. Block storage is not inherently shared, object storage is not low-latency or strongly consistent, and archive storage is for cold data. Therefore, file storage is the most appropriate choice.

Answer

Object storage

Answer

Block storage

Answer

Archive storage

Question 15

A bank is designing a new payment API that must run in a public cloud. The security team wants the application to run in an isolated, logically separated section of the provider's network where the bank controls inbound and outbound traffic, defines its own IP addressing, and can connect privately to the provider's object storage without traversing the internet. Which cloud architecture construct should the bank use?

Accepted Answer

A virtual private cloud with private subnets and a service endpoint. The requirement combines network isolation, customer-defined addressing and traffic control, and private access to a provider service. A virtual private cloud supplies the isolated network and its subnets, route tables, and gateways; security groups and network ACLs provide the traffic control; and a service endpoint keeps storage traffic on the provider backbone. Content delivery, web application firewalls, and hardware security modules address latency, application attacks, and key protection, not network isolation.

Answer

A web application firewall in front of the API gateway

Answer

A content delivery network with origin shielding

Answer

A dedicated hardware security module cluster