CCSP Cloud Concepts, Architecture and Design — Timed 10 Questions

Question 1

A healthcare organization is migrating sensitive patient data to a public cloud. The compliance team requires that data be encrypted at rest and in transit, and that the cloud provider cannot access the encryption keys. Which cloud service model should the organization use to maintain sole control over encryption keys?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS provides the customer with full control over the underlying infrastructure, including virtual machines, storage, and networking. This allows the organization to implement their own encryption mechanisms and manage their own keys using a Hardware Security Module (HSM) or a key management service (KMS) that the cloud provider cannot access. In contrast, SaaS and PaaS typically abstract away the infrastructure, limiting customer control over encryption key management.

Answer

Software as a Service (SaaS)

Answer

Hybrid Cloud

Answer

Platform as a Service (PaaS)

Question 2

A company is designing a multi-tier application in the cloud. The web tier must automatically scale based on CPU utilization, while the database tier should remain fixed to maintain data consistency. Which architectural pattern best meets these requirements?

Accepted Answer

Horizontal auto-scaling for the web tier and a fixed database tier. Option A is correct because it separates the stateless web tier, which can safely scale horizontally using auto-scaling groups triggered by CPU utilization thresholds, from the stateful database tier, which must remain fixed to avoid consistency issues such as split-brain or replication lag. Horizontal scaling adds or removes identical web server instances without affecting session state, while a fixed database tier preserves ACID properties and prevents conflicts from concurrent writes across multiple database nodes.

Answer

Manual scaling for both tiers

Answer

Vertical scaling of all tiers

Answer

Single-tier architecture with auto-scaling

Question 3

A financial services firm is designing a cloud environment that must comply with PCI DSS. The security architect proposes using a virtual private cloud (VPC) with subnets, security groups, and network ACLs. However, the compliance officer is concerned about the risk of data exposure due to misconfiguration. Which additional control would BEST address this concern?

Accepted Answer

Integrate Cloud Security Posture Management (CSPM). CSPM tools continuously monitor cloud infrastructure configurations against compliance frameworks like PCI DSS, automatically detecting misconfigurations such as overly permissive security group rules or network ACLs that could expose cardholder data. This directly addresses the compliance officer's concern about data exposure due to misconfiguration by providing real-time visibility and remediation guidance, which is more proactive than the other options.

Answer

Use a Web Application Firewall (WAF)

Answer

Implement a Security Information and Event Management (SIEM) system

Answer

Deploy Data Loss Prevention (DLP) tools

Question 4

A cloud architect is tasked with designing a disaster recovery plan for a critical application. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. The application runs on IaaS with data stored in a relational database. Which replication strategy is MOST cost-effective while meeting the objectives?

Accepted Answer

Asynchronous storage-level replication with 15-minute snapshots. Option D is correct because asynchronous storage-level replication with 15-minute snapshots meets the RPO of 15 minutes and the RTO of 1 hour, while being more cost-effective than synchronous replication. Asynchronous replication avoids the latency and bandwidth costs of synchronous mirroring across regions, and the 15-minute snapshot schedule ensures data loss is limited to the RPO window. This strategy is suitable for IaaS relational databases where near-real-time consistency is acceptable.

Answer

Daily full backups to another region

Answer

Synchronous database mirroring across regions

Answer

Multi-region active-active deployment with load balancing

Question 5

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Accepted Answer

Broad network access. Option A is correct because NIST SP 800-145 defines broad network access as the capability for cloud capabilities to be accessed over the network by standard mechanisms (e.g., HTTPS, SSH, VPN) that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, workstations). This characteristic ensures that resources are available from any location with internet connectivity, not limited to a single physical network segment.

Answer

Location independence

Answer

Dedicated hardware per tenant

Question 6

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive documents that should only be accessible from the internal network (10.0.0.0/24) and only over HTTPS. What is the most likely effect of this policy?

Accepted Answer

The policy allows GetObject from the internal network only when using HTTPS.. The policy includes an explicit Deny for any request that does not use HTTPS (i.e., aws:SecureTransport is false), which overrides any Allow. The Allow statement grants s3:GetObject only when the source IP is within 10.0.0.0/24. Therefore, the effective result is that GetObject is allowed only from the internal network and only over HTTPS, making option B correct.

Answer

The policy allows access from any IP if the request uses HTTPS.

Answer

The policy allows access from any IP in 10.0.0.0/24, but blocks access from the VPC.

Answer

The policy denies all access to the bucket because of the explicit Deny statement.

Question 7

Your company, a global e-commerce platform, operates on a multi-cloud environment with workloads in AWS and Azure. You are the lead cloud architect. The platform experiences peak traffic during promotional events, with traffic spikes up to 10x normal. The application is composed of microservices running in containers orchestrated by Kubernetes on both clouds. Each cloud provider's Kubernetes cluster uses cluster autoscaler and horizontal pod autoscaler. Recently, during a flash sale, the AWS cluster failed to scale adequately, causing latency spikes and timeouts. AWS support indicated that the cluster hit a service quota limit for EC2 instances. You need to prevent this from recurring. You have the following options: A) Implement a multi-region deployment on AWS to distribute load. B) Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first. C) Migrate all workloads to Azure to simplify management. D) Use a global load balancer to route traffic to the cloud with the most available capacity. Which option is the best course of action?

Accepted Answer

Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first.. Option D is correct because the root cause is a hard AWS service quota for EC2 instances, which prevents the cluster autoscaler from launching new nodes. Requesting a quota increase removes this bottleneck, while pod priority classes ensure that critical microservices are scheduled first when resources are constrained, preventing latency spikes during flash sales.

Answer

Migrate all workloads to Azure to simplify management.

Answer

Use a global load balancer to route traffic to the cloud with the most available capacity.

Answer

Implement a multi-region deployment on AWS to distribute load.

Question 8

Drag and drop the steps for performing a cloud migration using the 'lift and shift' strategy into the correct order.

Question 9

Drag and drop the steps for implementing a data retention policy for cloud storage (e.g., Amazon S3) into the correct order.

Question 10

Match each NIST SP 800-53 control family to its focus area.