75 of 84 questions · Page 1/2 · Ccsp Cloud Architecture topic · Answers revealed
An organization is moving a legacy application to the cloud and wants to minimize changes to the application code. They require full control over the operating system and middleware. Which cloud service model is most appropriate?
Correct. IaaS offers full control over OS and middleware.
Why this answer
IaaS provides virtual machines where the customer can install and configure the OS and middleware without modifying the application code.
An organization wants to deploy a cloud environment where multiple separate agencies with common compliance requirements share the infrastructure, but each agency retains some control over their own resources. Which deployment model best fits this scenario?
Community cloud serves a group with common interests, such as compliance.
Why this answer
Community cloud is designed for organizations with shared concerns.
Which cloud service model provides the customer with the ability to deploy and run custom applications using the provider's infrastructure, where the customer manages the applications and data, but does not manage the underlying operating system or hardware?
PaaS allows customers to deploy apps without managing underlying OS/hardware.
When evaluating a cloud service provider's SLA, which TWO metrics are MOST relevant for assessing availability and reliability?
Direct availability measure.
Why this answer
Uptime percentage (e.g., 99.9%) and RTO/RPO are key availability and disaster recovery metrics. Latency and throughput are performance, not availability; support response time is operational.
An organization is adopting a hybrid cloud strategy and needs to ensure secure connectivity between on-premises and cloud environments. Which TWO approaches are most appropriate for this purpose?
VPN provides encrypted connectivity over the internet.
Why this answer
VPN and dedicated private connections (like AWS Direct Connect or Azure ExpressRoute) are standard for secure hybrid cloud connectivity. Cloud access security brokers (CASBs) are for monitoring, not connectivity; public internet is not secure; MPLS is a type of private connection but less common in cloud contexts.
A cloud provider offers a service with an SLA of 99.999% availability. What is the maximum allowable downtime per year in minutes? (Assume 365 days)
Correct. 99.999% = 0.001% downtime = 5.256 minutes per year.
Why this answer
99.999% availability means 0.001% downtime per year. Yearly minutes = 365 * 24 * 60 = 525,600. 0.001% of 525,600 = 5.256 minutes.
A financial institution is evaluating a community cloud deployment shared with other banks. Which TWO security considerations are MOST important for this deployment model?
Critical to prevent cross-tenant access.
Why this answer
Community clouds require strong isolation between tenants and compliance with shared regulatory standards. Shared responsibility model still applies, and dedicated hardware is not typical.
A cloud architect is designing a multi-tenant SaaS application. Which TWO isolation mechanisms are essential to prevent tenant data leakage? (Choose two.)
Prevents network-level cross-tenant access.
Why this answer
Logical data isolation and network isolation are key to prevent data leakage.
An organization is designing a multi-cloud strategy using containers to avoid vendor lock-in. Which of the following approaches BEST ensures portability of containerized applications across different cloud providers?
Open standards ensure containers can run across any Kubernetes-compatible environment.
Why this answer
Using open standards like Kubernetes and Docker ensures portability, while using proprietary APIs or nested containers can create lock-in or complexity.
In the NIST SP 800-145 definition of cloud computing, which characteristic is described as the capability to rapidly and elastically provision and release resources, often automatically?
Rapid elasticity allows quick scaling of resources.
Why this answer
Rapid elasticity is the defined characteristic. Measured service is about metering, resource pooling is about sharing, broad network access is about network availability.
A company wants to avoid vendor lock-in when adopting cloud services. Which strategy is most effective for achieving portability?
Open standards facilitate portability and interoperability.
Why this answer
Using open standards and APIs ensures that workloads can be moved between providers. Using proprietary APIs, single provider services, or managed services increases lock-in.
A cloud provider guarantees 99.99% availability for a service. What is the maximum allowed downtime per year (rounded to nearest minute)?
Correct: 0.01% of 525,600 minutes = 52.56 minutes.
Why this answer
99.99% implies 0.01% downtime. 365*24*60 = 525,600 minutes. 0.01% of 525,600 = 52.56 minutes, about 53 minutes.
Which design principle is MOST directly concerned with the ability to move workloads between cloud providers or back on-premises without significant re-architecture?
Portability ensures workloads can run across different environments.
Why this answer
Portability focuses on minimizing vendor lock-in and enabling migration.
An organization is evaluating a cloud service provider and reviewing their SLA. Which THREE metrics are most important for assessing the provider's reliability and accountability? (Choose three.)
Allows customer to monitor compliance.
Why this answer
Uptime guarantee, compensation for failures, and reporting frequency are key SLA metrics.
A cloud security architect is evaluating a CSP for a financial services client. Which of the following audit reports would provide the most comprehensive assurance regarding the CSP's controls over security, availability, processing integrity, confidentiality, and privacy?
SOC 2 Type II covers the five trust service criteria.
Why this answer
SOC 2 Type II reports on controls over security, availability, processing integrity, confidentiality, and privacy over a period.
An organization is adopting a hybrid cloud strategy. Which THREE considerations are vital for maintaining consistent security across environments? (Select THREE.)
Correct. Consistent IAM ensures same policies across clouds.
Why this answer
Consistent identity and access management (IAM) ensures uniform access controls; network segmentation policies prevent unauthorized movement; encryption standards protect data across environments. Patch management is important but not unique to hybrid cloud consistency.
Which cloud design principle ensures that resources can be dynamically adjusted to meet changing demand, often using auto-scaling groups?
Correct. Elasticity allows dynamic resource adjustment.
Why this answer
Rapid elasticity is the ability to scale resources up or down quickly and automatically in response to demand.
Which design principle is most directly aimed at avoiding vendor lock-in and ensuring that workloads can be moved between cloud providers with minimal effort?
Correct. Portability focuses on using open standards to avoid lock-in.
Why this answer
Portability ensures that applications and data can be moved across environments using open standards and APIs, reducing dependence on a single provider.
A cloud provider offers a service with an SLA of 99.9% availability. Which TWO of the following are likely consequences if the provider fails to meet this SLA?
Service credits are a common remedy for SLA breaches.
Why this answer
Typically, SLA violations result in service credits (refunds) and can trigger penalty clauses. Immediate termination is rare, and full refund is not standard. Legal action is possible but less direct.
A company requires that its cloud service provider offers a dedicated environment with no shared infrastructure. Which cloud deployment model should the company choose?
Private cloud is dedicated to a single organization.
Why this answer
Private cloud is dedicated to a single organization, providing exclusive use of infrastructure. Public cloud is shared, community is shared by multiple organizations with common interests, and hybrid combines models.
A company is evaluating cloud providers for a critical workload and requires high availability, disaster recovery, and portability. Which THREE factors should the company prioritize in the provider evaluation?
Open APIs and standards enhance portability and avoid lock-in.
Why this answer
SLA guarantees availability, open APIs and standards enable portability, and audit reports demonstrate security and compliance. Data center locations are important for latency but not directly for portability; support tiers are operational but not strategic for these requirements.
In the shared responsibility model for public cloud, which of the following is typically the responsibility of the cloud customer when using IaaS?
The customer manages the guest OS, including patching.
Why this answer
In IaaS, the customer is responsible for managing the operating system, applications, and data. The provider manages the physical infrastructure.
A company is adopting a hybrid cloud strategy. Which TWO security considerations are most critical for maintaining a consistent security posture across environments? (Choose two.)
Prevents security gaps between environments.
Why this answer
Identity federation and consistent network security policies ensure seamless and secure integration.
A cloud customer is evaluating a provider's service level agreement (SLA) that guarantees 99.99% availability. What is the maximum allowable downtime per year (in minutes) before the SLA is violated?
99.99% uptime allows about 52.56 minutes downtime per year.
Why this answer
99.99% means 0.01% downtime per year. 365 days * 24 hours * 60 minutes = 525,600 minutes. 0.01% of that is 52.56 minutes, approximately 53 minutes.
Which cloud service model allows customers to manage only their data and user access, while the provider manages everything else including the infrastructure, operating system, and applications?
Correct. SaaS customers manage only data and access.
Why this answer
SaaS (Software as a Service) provides a complete application managed by the provider, with the customer responsible only for data and access control.
A company uses a hybrid cloud model where sensitive data resides in a private cloud, while compute-intensive analytics run in a public cloud using anonymized data. What is the primary security consideration for this architecture?
Correct. Consistent policies and secure connections are critical in hybrid cloud.
Why this answer
In hybrid cloud, consistent security policies must apply across both environments, and secure connectivity (e.g., VPN or dedicated connection) is essential to protect data in transit and prevent leakage.
Which of the following is a key benefit of using a hybrid cloud deployment model?
This is a primary use case for hybrid cloud.
Why this answer
Hybrid cloud allows workloads to move between environments, providing flexibility and optimization.
Which of the following is a key benefit of using containers, such as Docker, in a cloud environment to achieve portability?
This portability allows containers to run on any compatible host.
Why this answer
Containers package applications with dependencies, making them portable across different environments. Virtual machines are less portable, APIs enable interoperability but not specifically portability.
In the NIST SP 800-145 definition, which deployment model is described as infrastructure provisioned for exclusive use by a single organization comprising multiple consumers?
Correct. Private cloud is for exclusive use by a single organization.
Why this answer
NIST SP 800-145 defines private cloud as provisioned for exclusive use by a single organization with multiple consumers (e.g., business units).
A cloud customer is reviewing a provider's SOC 2 Type II report. What does this report primarily attest to?
Correct. SOC 2 Type II tests both design and operating effectiveness over time.
Why this answer
SOC 2 Type II reports evaluate the effectiveness of controls related to security, availability, processing integrity, confidentiality, and privacy over a period of time (typically 6-12 months).
Which of the following is an example of a cloud interoperability standard that facilitates portability of containerized applications across different cloud environments?
Correct. Kubernetes enables container portability across environments.
Why this answer
Kubernetes is an open-source container orchestration platform that enables portability of containerized applications across different cloud providers and on-premises environments.
An organization is evaluating cloud service providers and wants to ensure that the provider can demonstrate independent verification of its security controls. Which THREE of the following are recognized cloud security audit reports or certifications?
Correct. ISO 27001 is an international security management standard.
Why this answer
SOC 2 Type II, ISO 27001, and CSA STAR are well-known cloud security certifications/audit reports. FedRAMP is US government specific, and PCI DSS is for payment card industry, not a general cloud security audit.
Which NIST-defined cloud characteristic ensures that resources can be scaled up and down rapidly based on demand?
Elasticity allows scaling resources up and down.
Why this answer
Rapid elasticity is the ability to scale quickly.
Which characteristic of cloud computing allows a user to automatically provision computing resources without requiring human interaction with the service provider?
Correct. This characteristic allows automatic provisioning without human interaction.
Why this answer
On-demand self-service is one of the essential characteristics defined by NIST, enabling users to provision resources automatically.
Which cloud characteristic allows a consumer to automatically provision computing resources, such as server time and storage, as needed without requiring human interaction with the service provider?
On-demand self-service allows automatic provisioning without human interaction.
Why this answer
On-demand self-service enables automatic provisioning. Broad network access is about network availability, resource pooling is about multi-tenancy, rapid elasticity is about scaling.
A cloud architect is designing a multi-tenant SaaS application. Which THREE of the following are essential isolation mechanisms that must be implemented to ensure tenant separation?
Correct. Data isolation ensures tenant data separation.
Why this answer
Multi-tenancy isolation requires separation at the hypervisor, data storage, and network levels to prevent one tenant from accessing another's resources.
A company is considering migrating its customer relationship management (CRM) system to a SaaS provider. Which TWO of the following security responsibilities typically remain with the customer in a SaaS deployment?
Correct. The customer manages user identities and access.
Why this answer
In SaaS, the customer is responsible for data classification and access control, as well as user access management, while the provider manages the application, OS, and infrastructure.
A cloud provider's SLA guarantees 99.95% uptime for a service. Over a one-year period (365 days), what is the maximum allowed downtime in minutes to meet this SLA?
Correct calculation: 525,600 * 0.0005 = 262.8 minutes.
Why this answer
99.95% uptime means 0.05% downtime. 365 days * 24 hours * 60 minutes = 525,600 minutes. 0.05% of 525,600 = 262.8 minutes.
A company wants to migrate its customer relationship management (CRM) system to the cloud and requires that the provider manages the underlying infrastructure, operating system, and middleware, while the company manages only the application and data. Which cloud service model best meets these requirements?
PaaS provides a managed platform where the customer focuses on applications and data.
Which cloud design principle is most directly related to ensuring that an organization can migrate workloads from one cloud provider to another without significant re-engineering?
Correct. Portability ensures minimal re-engineering when moving between providers.
Why this answer
Portability refers to the ability to move workloads and data between cloud environments with minimal friction, often using open standards.
A community cloud is best suited for which scenario?
Community cloud is for organizations with common interests.
Why this answer
Community clouds are used by organizations with shared concerns like compliance, mission, or security requirements. A single organization would use private cloud, general public use is public cloud, hybrid is for combining models.
A cloud architect is designing a solution that must automatically scale compute resources based on real-time demand. The application is stateless and can tolerate brief interruptions. Which cloud design principle is most directly addressed by this requirement?
Rapid elasticity enables automatic scaling based on demand.
Why this answer
Rapid elasticity allows resources to scale up and down automatically to meet demand, which is the principle being applied. This is a key characteristic of cloud computing.
Which cloud service model provides the customer with the most control over the underlying infrastructure, including operating systems and applications?
Correct. IaaS provides the most customer control over OS and apps.
Why this answer
IaaS provides virtualized computing resources where the customer manages OS, middleware, and applications, while the provider manages the physical infrastructure.
In a hybrid cloud deployment, which of the following is a critical security consideration?
Correct. Consistent policies prevent gaps between environments.
Why this answer
Hybrid cloud requires consistent security policies across both public and private environments, typically enforced via secure connectivity and unified management.
An organization is migrating a legacy application to the cloud and wants to minimize vendor lock-in. They plan to use containers orchestrated by Kubernetes. Which design principle is the organization primarily applying?
Using open standards like Kubernetes and containers enhances workload portability across clouds.
Why this answer
Portability focuses on avoiding vendor lock-in by using open standards and technologies like Kubernetes and Docker that can run across different cloud providers.
Which cloud service model provides the consumer with the ability to deploy and run custom applications using the provider's programming languages, libraries, and tools, but does not allow management of the underlying infrastructure?
PaaS allows deployment of custom applications without managing infrastructure.
An organization is evaluating cloud service providers and notices that one provider's SLA offers 99.99% availability for a specific service, while another offers 99.9%. If the service costs $100,000 per month, what is the maximum allowable downtime per month for the 99.99% SLA?
Correct. 99.99% = 0.01% downtime = 4.32 minutes per month.
Why this answer
99.99% availability allows 0.01% downtime. Monthly downtime = 30 days * 24 hours * 60 minutes = 43,200 minutes. 0.01% of 43,200 = 4.32 minutes.
A company is evaluating cloud providers for a global application. They need to ensure high availability and low latency. Which THREE factors are most important to consider during provider evaluation? (Select THREE.)
Correct. Audit reports verify security and operational controls.
Why this answer
SLA guarantees (e.g., 99.99%) affect availability; global data center presence reduces latency; audit reports like SOC 2 demonstrate operational effectiveness, which impacts reliability.
Which TWO of the following are essential characteristics of cloud computing as defined by NIST SP 800-145?
Correct; usage is metered and optimized.
Why this answer
NIST defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Measured service and resource pooling are correct; multitenancy and virtualization are enablers, not characteristics.
Which characteristic of cloud computing allows a user to provision resources automatically without requiring human interaction with the service provider?
Correct. On-demand self-service allows automatic provisioning.
Why this answer
On-demand self-service enables users to provision and manage resources as needed via a web portal or API without manual provider intervention.
A cloud security architect is designing a multi-tenant SaaS application that must ensure strong isolation between tenants. Which TWO mechanisms are most effective for achieving multitenancy isolation?
Hypervisor isolation separates VMs of different tenants.
Why this answer
Network micro-segmentation and hypervisor-level isolation are key for multi-tenant isolation. Encryption at rest protects data but does not isolate compute; database row-level permissions provide logical but not strong isolation; API rate limiting controls usage but not isolation.
In a public cloud IaaS model, which of the following security controls is the cloud customer primarily responsible for implementing?
The customer manages the guest OS, including patching.
Why this answer
The customer is responsible for securing the guest OS and applications.
Which characteristic of cloud computing allows a user to provision computing resources automatically without requiring human interaction with the service provider?
This is the ability to provision resources automatically without human provider interaction.
Why this answer
On-demand self-service enables users to provision resources as needed without manual intervention from the provider. This is a fundamental characteristic defined by NIST.
A company is adopting a hybrid cloud model to run sensitive workloads on-premises and less critical applications in the public cloud. Which security consideration is most critical for this environment?
Consistent policies prevent security gaps in hybrid cloud.
Why this answer
Hybrid cloud requires consistent security policies across environments to avoid gaps. Connectivity is important but policy consistency ensures security controls are uniformly applied.
A cloud architect is designing a multi-tenant SaaS application. Which TWO design principles are critical for ensuring tenant isolation? (Select TWO.)
Correct. Network isolation prevents cross-tenant traffic.
Why this answer
Multitenancy isolation requires strong network isolation (e.g., virtual networks, security groups) and data isolation (e.g., separate databases or encryption per tenant) to prevent one tenant from accessing another's data.
An organization needs to migrate a legacy application to the cloud. The application requires full control over the operating system, middleware, and runtime. The team wants to minimize management overhead while retaining OS-level access. Which cloud service model is most appropriate?
IaaS allows full OS control while the provider manages physical infrastructure.
A company is migrating to a hybrid cloud and needs to ensure consistent security policies across both on-premises and cloud environments. Which of the following is the MOST critical consideration?
Consistent policy enforcement prevents security gaps between environments.
Why this answer
Consistent security policy enforcement is key in hybrid cloud. While identity management and encryption are important, ensuring the same policies apply across environments is the most critical to avoid gaps.
A security auditor is reviewing a cloud provider's controls to ensure that customer data is appropriately isolated. Which design principle is most directly related to this requirement?
Multitenancy isolation ensures separation between tenants.
Why this answer
Multitenancy isolation ensures that resources (compute, storage, network) of different customers are separated. Elasticity is about scaling, portability about moving, reversibility about exiting.
A company plans to deploy a multi-tier application across multiple cloud providers to avoid single points of failure. They need to ensure consistent security policies, including identity federation and network segmentation, across all environments. Which architecture consideration is MOST critical?
A unified tool ensures consistent policies across providers.
Why this answer
Consistent security policy across environments is critical in hybrid/multi-cloud.
Which NIST essential characteristic of cloud computing allows the provider to dynamically assign and reassign resources to multiple tenants, often using a multi-tenant model?
Correct. Pooling supports multi-tenancy and dynamic assignment.
Why this answer
Resource pooling is the characteristic where the provider's computing resources are pooled to serve multiple consumers, with physical and virtual resources dynamically assigned.
Which THREE of the following are valid methods for achieving multitenancy isolation in a public cloud IaaS environment?
Encryption prevents unauthorized access.
Why this answer
Hypervisor isolation, storage network segmentation (e.g., VLANs), and data encryption at rest are all valid isolation methods. Shared memory and single database schema for all tenants would break isolation.
A company is considering moving its customer relationship management (CRM) system to the cloud. The CRM is accessed through a web browser and the provider handles all maintenance, security, and infrastructure. Which cloud service model is being used?
SaaS delivers fully managed software over the internet.
Why this answer
In SaaS, the provider manages everything except user access and data.
An organization is evaluating a cloud provider's SLA for a critical application. The provider offers a 99.95% uptime SLA with a 10% service credit for each 30-minute downtime period exceeding the threshold. The organization's business impact analysis requires a maximum downtime of 4.38 hours per year. Does the provider's SLA meet this requirement, and what is the annual allowed downtime based on the SLA?
Correct calculation: 0.05% of 8760 hours = 4.38 hours.
Why this answer
99.95% uptime allows 0.05% downtime per year. 0.05% of 365 days * 24 hours = 0.05% * 8760 hours = 4.38 hours. Exactly meets the requirement. The service credit mechanism does not change the allowed downtime.
A financial institution is subject to strict regulatory requirements that mandate data residency and physical control over its infrastructure. At the same time, it wants to leverage cloud bursting for peak loads. Which deployment model should the institution adopt?
Hybrid cloud allows the institution to keep sensitive data in a private cloud and use public cloud for bursting.
Why this answer
A hybrid cloud combines a private cloud for sensitive workloads with public cloud resources for elasticity, meeting both regulatory and scalability needs.
Which audit report provides the most comprehensive assurance regarding a cloud provider's controls over a period of time, including controls related to security, availability, processing integrity, confidentiality, and privacy?
Type II assesses controls over a period and covers the trust criteria.
Why this answer
SOC 2 Type II reports cover controls over a period of time and include the five trust service criteria. SOC 2 Type I is a point-in-time report. ISO 27001 is a certification, not a report.
CSA STAR is a self-assessment.
In the shared responsibility model for public cloud IaaS, which of the following is typically the responsibility of the cloud customer?
Correct. The customer is responsible for patching the guest OS.
Why this answer
In IaaS, the customer manages the guest OS, applications, data, and network traffic controls. The provider manages the physical infrastructure, hypervisor, and network.
A financial services company is required to keep customer data within a specific geographic boundary due to regulatory requirements. The company is evaluating cloud deployment models. Which model would best ensure data sovereignty while still providing scalability?
Correct. Community cloud meets shared requirements and can be geo-fenced.
Why this answer
A community cloud can be shared by organizations with common compliance needs, such as financial regulations, and can be deployed in a specific region to meet data sovereignty.
A company is designing a multi-cloud strategy to avoid vendor lock-in and ensure portability. They are considering using containers and an open-source orchestration platform. Which of the following is the BEST choice to achieve workload portability across different cloud providers?
Kubernetes is open-source and supported by all major cloud providers.
Why this answer
Kubernetes is an open-source container orchestration platform that allows portability across clouds.
Which THREE of the following are benefits of using a hybrid cloud deployment model?
Hybrid enables scaling to public cloud.
Why this answer
Hybrid cloud offers flexibility to keep sensitive data on-premises, burst to public cloud for elasticity, and maintain consistent security policies across environments. It does not reduce SLA complexity or eliminate data sovereignty concerns.
An organization is migrating a legacy application to the cloud and requires reversibility. Which THREE of the following should be considered to ensure the application can be migrated away from the cloud provider in the future?
Containers and orchestration improve portability.
Why this answer
Reversibility involves using open standards and APIs, ensuring data portability, and avoiding deep integration with proprietary services. Auto-scaling is a benefit but not a requirement for reversibility.
A healthcare organization is migrating patient records to a public cloud provider. Which of the following is the most critical consideration regarding shared responsibility when using IaaS?
Correct per shared responsibility model for IaaS.
Why this answer
In IaaS, the customer is responsible for securing the OS, applications, and data, while the provider secures the physical infrastructure. Data encryption and access control are customer responsibilities.
A company wants to migrate a legacy application to the cloud with minimal re-architecture. They need control over the operating system and middleware but do not want to manage physical hardware. Which service model is most suitable?
Correct. IaaS provides the flexibility to manage OS and middleware.
Why this answer
IaaS provides virtualized computing resources where the customer manages OS, apps, and data, but not the underlying infrastructure.
Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?
PaaS provides a platform for deploying applications without managing underlying infrastructure.
Why this answer
This is the definition of Platform as a Service (PaaS) per NIST SP 800-145. The consumer manages applications and data, while the provider manages everything else.
In a public cloud IaaS environment, which of the following is the customer responsible for securing, according to the shared responsibility model?
The customer manages OS, apps, and data.
Why this answer
The customer is responsible for securing the operating system, applications, and data they deploy. The provider secures the physical infrastructure, network, and hypervisor.
Which cloud characteristic allows a user to automatically provision computing resources without requiring human interaction with the service provider?
This characteristic allows users to provision resources automatically.
Why this answer
On-demand self-service enables automatic provisioning.
Ready to test yourself?
Try a timed practice session using only Ccsp Cloud Architecture questions.