CCSP Cloud Concepts, Architecture and Design Practice Test 2 — 15 Questions

Question 1

A developer is designing a microservices-based application in the cloud. They need to ensure communication between services is loosely coupled and resilient to failures. Which design pattern should they implement?

Accepted Answer

Event-driven messaging. Event-driven messaging (B) is correct because it enables asynchronous, decoupled communication between microservices, allowing them to operate independently and remain resilient to failures. When a service publishes an event, other services consume it at their own pace, preventing cascading failures and ensuring the system can handle partial outages without blocking. This pattern directly supports loose coupling and fault tolerance, which are critical for cloud-based microservices architectures.

Answer

API gateway

Answer

Service mesh

Answer

Database per service

Question 2

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

Accepted Answer

Description of tests and results. The SOC 2 Type II report evaluates the operational effectiveness of controls over a specified period (typically 6–12 months). The 'Description of tests and results' section provides the auditor's detailed testing procedures and outcomes, directly showing whether controls operated effectively throughout that period. This makes it the most relevant aspect for assessing control effectiveness over time.

Answer

System description

Answer

Opinion letter

Answer

Management's assertion

Question 3

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

Accepted Answer

Multi-region active-active. Multi-region active-active is the only strategy that can meet both a 15-minute RTO and a 5-minute RPO because it maintains synchronous or near-synchronous replication between two or more regions, allowing traffic to be instantly redirected with zero or minimal data loss. This approach eliminates the recovery time needed to spin up infrastructure or restore data, as the application is already fully operational in multiple regions.

Answer

Backup and restore

Answer

Pilot light

Answer

Warm standby

Question 4

A small business wants to use a cloud service but has limited in-house IT expertise. Which cloud service model requires the least customer management responsibility?

Accepted Answer

SaaS. SaaS (Software as a Service) delivers a complete application managed entirely by the cloud provider, so the customer only needs to use the software without managing underlying infrastructure, platforms, or runtime. For a small business with limited IT expertise, this model minimizes operational overhead because the provider handles maintenance, patching, and availability.

Answer

IaaS

Answer

PaaS

Answer

FaaS

Question 5

During a cloud migration, a company decides to move a legacy application with no code changes. Which migration strategy are they using?

Accepted Answer

Rehost (lift and shift). Option A is correct because rehost (lift and shift) moves applications without modification. Options B, C, and D involve changes to the application or purchasing a new solution.

Answer

Refactor

Answer

Repurchase

Answer

Replatform

Question 6

A cloud architect is evaluating cloud service models for a new application. Which two characteristics are advantages of PaaS over IaaS? (Choose two.)

Accepted Answer

Reduced management of middleware and runtime. Option C is correct because PaaS abstracts away middleware, runtime, and OS management, allowing developers to focus on code rather than patching or configuring these layers. This reduces operational overhead compared to IaaS, where you must manage the OS, runtime, and middleware yourself. Option E is correct because PaaS platforms typically include built-in load balancing, auto-scaling, and redundancy features, whereas in IaaS you must architect and implement these capabilities manually.

Answer

Greater control over the underlying OS

Answer

Lower cost due to shared infrastructure

Answer

Higher flexibility to customize networking

Question 7

A company is implementing a hybrid cloud architecture. Which two components are essential for establishing a secure connection between on-premises and cloud environments? (Choose two.)

Accepted Answer

Direct connect or dedicated interconnect. A Direct Connect or dedicated interconnect provides a private, dedicated network connection from on-premises to the cloud provider, bypassing the public internet for lower latency and more consistent bandwidth. A VPN gateway establishes an encrypted tunnel over the public internet using protocols like IPsec (IKEv2) to secure data in transit. Together, these two components form the essential hybrid connectivity layer: the dedicated circuit for primary, high-throughput traffic and the VPN as a secure backup or for lower-cost, lower-bandwidth needs.

Answer

Identity and access management (IAM)

Answer

Cloud access security broker (CASB)

Answer

Web application firewall (WAF)

Question 8

A cloud architect is designing a multi-cloud strategy to avoid vendor lock-in. Which three design considerations should be included? (Choose three.)

Accepted Answer

Implement abstraction layers such as containers or cloud-agnostic APIs. Option A is correct because implementing abstraction layers such as containers (e.g., Docker, Kubernetes) or cloud-agnostic APIs (e.g., Terraform, OpenStack) decouples application code from underlying cloud infrastructure. This allows workloads to be migrated between providers without rewriting core logic, directly addressing vendor lock-in by standardizing deployment and orchestration interfaces.

Answer

Standardize on one cloud provider for core services

Answer

Use provider-specific APIs for optimal performance

Question 9

What is the effective permission for a request coming from IP address 10.1.2.3?

Accepted Answer

Access allowed only for GetObject. The effective permission for a request from IP 10.1.2.3 is 'Access allowed only for GetObject' because the bucket policy includes an explicit allow for the s3:GetObject action when the source IP matches 10.1.2.3, and no explicit deny applies to that IP. Since there is no explicit deny for this specific request, the explicit allow grants access only to the GetObject action, not to other actions like PutObject or DeleteObject.

Answer

Access allowed for all actions

Answer

Access denied due to explicit deny

Answer

Access denied because no explicit allow

Question 10

What is the most likely cause of the failure?

Accepted Answer

Resource exhaustion in the availability zone. The failure is most likely due to resource exhaustion in the availability zone. When launching instances in a specific Availability Zone, the cloud provider may have insufficient capacity to fulfill the request, even if the instance type is available in the region. This is a common transient condition that occurs when demand exceeds available compute resources in that zone.

Answer

Instance type not available in that region

Answer

Incorrect region

Answer

Insufficient CPU quota

Question 11

Which type of threat is this log most likely indicating?

Accepted Answer

Data exfiltration. The log shows a large volume of outbound data transfers from a cloud storage bucket to an external IP address, which is characteristic of data exfiltration. In cloud environments, such activity often involves unauthorized copying of sensitive data to an attacker-controlled location, bypassing normal access controls.

Answer

Account takeover

Answer

Malware infection

Answer

Insider threat

Question 12

A company is migrating its on-premises workloads to a public cloud environment. The security team is concerned about maintaining visibility into network traffic between virtual machines in the same virtual network. Which cloud architecture component should be implemented to address this concern?

Accepted Answer

Virtual network traffic mirroring. Virtual network traffic mirroring (or port mirroring) enables the capture and inspection of all network packets flowing between virtual machines within the same virtual network, including east-west traffic. This provides the security team with the deep packet visibility needed for threat detection, compliance auditing, and troubleshooting without requiring changes to the VM configurations or routing paths.

Answer

Security groups

Answer

Virtual private cloud (VPC) peering

Answer

Network access control lists (NACLs)

Question 13

A cloud architect is designing a multi-region application to ensure high availability. The application must automatically fail over to a secondary region if the primary region becomes unavailable. Which strategy best meets this requirement?

Accepted Answer

Active-passive with automated failover using health checks. Active-passive with automated failover using health checks is the correct strategy because it ensures that the secondary region automatically takes over when the primary region fails, without manual intervention. Health checks continuously monitor the primary region's endpoints (e.g., via HTTP/HTTPS probes or TCP checks), and upon detecting consecutive failures (e.g., 3 failed health checks), the failover mechanism—such as DNS-based routing with a low TTL (e.g., 60 seconds) or a global load balancer—automatically redirects traffic to the passive secondary region. This meets the high availability requirement by minimizing downtime while keeping the secondary region idle to reduce costs.

Answer

Active-passive with manual failover

Answer

Active-active with load balancing across regions

Answer

Read replicas in secondary region

Question 14

A company uses a cloud provider's object storage service for backup data. The security policy requires that data be encrypted at rest using keys managed by the company's on-premises hardware security module (HSM). Which encryption method should be used?

Accepted Answer

Client-side encryption. Client-side encryption is the only method where the encryption keys are generated and managed entirely within the customer's on-premises HSM, and data is encrypted before it is sent to the cloud provider's object storage. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, fully satisfying the policy requirement that keys be managed by the company's on-premises HSM.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with cloud provider-managed keys (SSE-S3)

Answer

Server-side encryption with customer-managed keys (SSE-KMS)

Question 15

A cloud architect is designing a cost-optimized architecture for a batch processing job that runs once per day. The job requires high compute capacity for approximately 5 hours. Which cloud service model is most suitable?

Accepted Answer

Spot instances. Spot instances are the most suitable for this batch processing job because they offer significant cost savings (up to 90% compared to on-demand) and are ideal for fault-tolerant, stateless workloads that can handle interruptions. The job runs once per day for only 5 hours, so it can easily be designed to checkpoint progress and resume if a spot instance is reclaimed, making the cost-optimized choice clear.

Answer

Reserved instances

Answer

On-demand instances

Answer

Dedicated hosts