CCSP Cloud Concepts, Architecture, and Design Practice Question
A multinational bank is deploying a hybrid cloud with sensitive workloads on private infrastructure and analytics on a public cloud. The security team must ensure that data classified as confidential never leaves the private environment, while allowing the public cloud to process anonymized datasets. Which cloud deployment model characteristic is MOST relevant to enforcing this boundary?
⚠ Common exam trap
It's easy for candidates to confuse hybrid cloud with automatic data replication, when hybrid actually enables policy-driven placement rather than copying everything everywhere.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hybrid model enables workload placement based on data classification and policy.
Hybrid cloud's primary security value in this scenario is the ability to place workloads and data according to classification and policy. The bank can enforce that confidential data stays private while anonymized datasets are processed publicly. Other options either misstate security properties or contradict the requirement, so workload placement based on data classification is the relevant characteristic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The hybrid model automatically replicates all data to both environments for redundancy.
Why it's wrong here
Automatic replication of all data would violate the requirement that confidential data never leaves the private environment. Hybrid cloud does not imply blanket replication; data movement is controlled by policy and architecture. This option contradicts the security objective and is therefore incorrect for this scenario.
- ✗
The private cloud eliminates the need for encryption at rest.
Why it's wrong here
Private cloud does not eliminate encryption requirements; encryption at rest is still necessary for defense in depth and compliance. More importantly, this option does not explain how the hybrid model enforces the boundary that keeps confidential data private. It is a false security assumption unrelated to the placement control described in the scenario.
- ✓
The hybrid model enables workload placement based on data classification and policy.
Why this is correct
Hybrid cloud allows workloads and data to be placed according to sensitivity and regulatory policy. The bank can keep confidential data on private infrastructure while sending only anonymized datasets to the public cloud. This placement control is the defining characteristic that directly enforces the boundary between environments, making it the most relevant answer.
- ✗
The public cloud provides stronger physical security than private data centers.
Why it's wrong here
Physical security strength is not the deciding factor for keeping confidential data inside the private environment. Even if the public cloud has robust physical controls, the bank's policy requires data to remain on private infrastructure. This option does not address the need to enforce a data classification boundary between deployment environments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.