How should I use these Cloud Concepts, Architecture and Design practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CCSP · topic practice

Cloud Concepts, Architecture and Design practice questions

Q: Can I practise just Cloud Concepts, Architecture and Design questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Cloud Concepts, Architecture and Design domain.

Practise Certified Cloud Security Professional CCSP Cloud Concepts, Architecture and Design practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Cloud Concepts, Architecture and Design

Practice 10 questions Browse domain →

What the exam tests

What to know about Cloud Concepts, Architecture and Design

Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.

IaaS, PaaS and SaaS responsibilities and examples.

Public, private, hybrid and community cloud deployment models.

On-premises vs cloud trade-offs: cost, control, scalability.

How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.

Watch out for

Common Cloud Concepts, Architecture and Design exam traps

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Practice set

Cloud Concepts, Architecture and Design questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A healthcare organization is migrating sensitive patient data to a public cloud. The compliance team requires that data be encrypted at rest and in transit, and that the cloud provider cannot access the encryption keys. Which cloud service model should the organization use to maintain sole control over encryption keys?

Trap 1: Software as a Service (SaaS)

SaaS providers typically manage encryption and may have access to keys.

Trap 2: Hybrid Cloud

Hybrid is a deployment model, not a service model, and does not directly address key control.

Trap 3: Platform as a Service (PaaS)

PaaS abstracts the underlying infrastructure, often limiting customer control over encryption keys.

Study all Cloud Concepts, Architecture and Design common traps →

A
Software as a Service (SaaS)
Why wrong: SaaS providers typically manage encryption and may have access to keys.
B
Infrastructure as a Service (IaaS)
IaaS gives the customer control over the OS, storage, and encryption keys.
C
Hybrid Cloud
Why wrong: Hybrid is a deployment model, not a service model, and does not directly address key control.
D
Platform as a Service (PaaS)
Why wrong: PaaS abstracts the underlying infrastructure, often limiting customer control over encryption keys.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full NAT/PAT explanation →

A company is designing a multi-tier application in the cloud. The web tier must automatically scale based on CPU utilization, while the database tier should remain fixed to maintain data consistency. Which architectural pattern best meets these requirements?

Trap 1: Manual scaling for both tiers

Manual scaling does not provide the required automatic response.

Trap 2: Vertical scaling of all tiers

Vertical scaling limits scalability and is less cost-effective.

Trap 3: Single-tier architecture with auto-scaling

Single-tier mixes concerns and complicates scaling.

Study all Cloud Concepts, Architecture and Design common traps →

A
Horizontal auto-scaling for the web tier and a fixed database tier
This pattern separates stateless and stateful components appropriately.
B
Manual scaling for both tiers
Why wrong: Manual scaling does not provide the required automatic response.
C
Vertical scaling of all tiers
Why wrong: Vertical scaling limits scalability and is less cost-effective.
D
Single-tier architecture with auto-scaling
Why wrong: Single-tier mixes concerns and complicates scaling.

Full breakdown with real-world context →

Question 3hardmultiple choice

Study the full ACL explanation →

A financial services firm is designing a cloud environment that must comply with PCI DSS. The security architect proposes using a virtual private cloud (VPC) with subnets, security groups, and network ACLs. However, the compliance officer is concerned about the risk of data exposure due to misconfiguration. Which additional control would BEST address this concern?

Trap 1: Use a Web Application Firewall (WAF)

WAF protects web apps from attacks, not network misconfigurations.

Trap 2: Implement a Security Information and Event Management (SIEM) system

SIEM analyzes logs for threats but does not proactively prevent misconfigurations.

Trap 3: Deploy Data Loss Prevention (DLP) tools

DLP protects data in use/motion but does not fix configuration errors.

Study all Cloud Concepts, Architecture and Design common traps →

A
Use a Web Application Firewall (WAF)
Why wrong: WAF protects web apps from attacks, not network misconfigurations.
B
Implement a Security Information and Event Management (SIEM) system
Why wrong: SIEM analyzes logs for threats but does not proactively prevent misconfigurations.
C
Integrate Cloud Security Posture Management (CSPM)
CSPM automates monitoring and remediation of misconfigurations.
D
Deploy Data Loss Prevention (DLP) tools
Why wrong: DLP protects data in use/motion but does not fix configuration errors.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

A cloud architect is tasked with designing a disaster recovery plan for a critical application. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. The application runs on IaaS with data stored in a relational database. Which replication strategy is MOST cost-effective while meeting the objectives?

Trap 1: Daily full backups to another region

Daily backups result in up to 24 hours of data loss, exceeding the 15-minute RPO.

Trap 2: Synchronous database mirroring across regions

Synchronous mirroring is expensive and may impact performance.

Trap 3: Multi-region active-active deployment with load balancing

Active-active is complex and costly; not necessary for the given RTO/RPO.

Study all Cloud Concepts, Architecture and Design common traps →

A
Daily full backups to another region
Why wrong: Daily backups result in up to 24 hours of data loss, exceeding the 15-minute RPO.
B
Synchronous database mirroring across regions
Why wrong: Synchronous mirroring is expensive and may impact performance.
C
Multi-region active-active deployment with load balancing
Why wrong: Active-active is complex and costly; not necessary for the given RTO/RPO.
D
Asynchronous storage-level replication with 15-minute snapshots
Asynchronous replication with frequent snapshots meets the RPO cost-effectively.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Cloud Concepts, Architecture and Design explanation →

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Trap 1: Location independence

While cloud offers location independence, it is not one of the five NIST essential characteristics; 'resource pooling' is the characteristic.

Trap 2: Dedicated hardware per tenant

Cloud computing uses shared resources, not dedicated hardware per tenant.

Study all Cloud Concepts, Architecture and Design common traps →

A
Broad network access
Resources are available over the network and accessed through standard mechanisms.
B
On-demand self-service
Users can provision resources automatically without human interaction.
C
Location independence
Why wrong: While cloud offers location independence, it is not one of the five NIST essential characteristics; 'resource pooling' is the characteristic.
D
Dedicated hardware per tenant
Why wrong: Cloud computing uses shared resources, not dedicated hardware per tenant.
E
Rapid elasticity
Capabilities can be elastically provisioned and released to scale rapidly.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive documents that should only be accessible from the internal network (10.0.0.0/24) and only over HTTPS. What is the most likely effect of this policy?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/24"
        }
      }
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}
```

Trap 1: The policy allows access from any IP if the request uses HTTPS.

The Allow statement restricts the source IP to 10.0.0.0/24, so external IPs are not allowed.

Trap 2: The policy allows access from any IP in 10.0.0.0/24, but blocks…

The policy allows access from the specified IP range, not blocks it.

Trap 3: The policy denies all access to the bucket because of the explicit…

The Deny only applies to non-HTTPS requests; HTTPS requests are allowed from the specified IP range.

Study all Cloud Concepts, Architecture and Design common traps →

A
The policy allows access from any IP if the request uses HTTPS.
Why wrong: The Allow statement restricts the source IP to 10.0.0.0/24, so external IPs are not allowed.
B
The policy allows GetObject from the internal network only when using HTTPS.
The Allow with IP condition permits internal requests, and the Deny on non-SecureTransport blocks HTTP requests, effectively requiring HTTPS.
C
The policy allows access from any IP in 10.0.0.0/24, but blocks access from the VPC.
Why wrong: The policy allows access from the specified IP range, not blocks it.
D
The policy denies all access to the bucket because of the explicit Deny statement.
Why wrong: The Deny only applies to non-HTTPS requests; HTTPS requests are allowed from the specified IP range.

Full breakdown with real-world context →

Question 7mediummultiple choice

Review the full routing breakdown →

Your company, a global e-commerce platform, operates on a multi-cloud environment with workloads in AWS and Azure. You are the lead cloud architect. The platform experiences peak traffic during promotional events, with traffic spikes up to 10x normal. The application is composed of microservices running in containers orchestrated by Kubernetes on both clouds. Each cloud provider's Kubernetes cluster uses cluster autoscaler and horizontal pod autoscaler. Recently, during a flash sale, the AWS cluster failed to scale adequately, causing latency spikes and timeouts. AWS support indicated that the cluster hit a service quota limit for EC2 instances. You need to prevent this from recurring. You have the following options: A) Implement a multi-region deployment on AWS to distribute load. B) Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first. C) Migrate all workloads to Azure to simplify management. D) Use a global load balancer to route traffic to the cloud with the most available capacity. Which option is the best course of action?

Trap 1: Migrate all workloads to Azure to simplify management.

Migration is complex and does not guarantee avoiding similar quota issues in Azure.

Trap 2: Use a global load balancer to route traffic to the cloud with the…

A global load balancer can help but does not fix the underlying scaling limitation; it may just shift traffic to another cloud that could also hit quotas.

Trap 3: Implement a multi-region deployment on AWS to distribute load.

Multi-region can help distribute load but does not address the root cause of hitting service quotas in a specific region.

Study all Cloud Concepts, Architecture and Design common traps →

A
Migrate all workloads to Azure to simplify management.
Why wrong: Migration is complex and does not guarantee avoiding similar quota issues in Azure.
B
Use a global load balancer to route traffic to the cloud with the most available capacity.
Why wrong: A global load balancer can help but does not fix the underlying scaling limitation; it may just shift traffic to another cloud that could also hit quotas.
C
Implement a multi-region deployment on AWS to distribute load.
Why wrong: Multi-region can help distribute load but does not address the root cause of hitting service quotas in a specific region.
D
Pre-warm the AWS environment by requesting a service quota increase and using a pod priority class to ensure critical pods scale first.
Addresses the quota limit directly and uses priority classes to manage scaling of critical services.

Full breakdown with real-world context →

Question 8mediumdrag order

Read the full Cloud Concepts, Architecture and Design explanation →

Drag and drop the steps for performing a cloud migration using the 'lift and shift' strategy into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 9mediumdrag order

Read the full Cloud Concepts, Architecture and Design explanation →

Drag and drop the steps for implementing a data retention policy for cloud storage (e.g., Amazon S3) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediummatching

Read the full Cloud Concepts, Architecture and Design explanation →

Match each NIST SP 800-53 control family to its focus area.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Access Control

Audit and Accountability

System and Communications Protection

System and Information Integrity

Physical and Environmental Protection

Question 11mediummatching

Read the full Cloud Concepts, Architecture and Design explanation →

Match each cloud auditing term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Service organization control report for security

Assessment of cloud provider controls

Analysis of logs for incident investigation

Real-time assessment of security controls

Question 12easymultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

A company is migrating to the cloud to reduce capital expenditures. They want to pay only for the resources they consume with no upfront investment. Which financial model does this describe?

Trap 1: Amortization

Amortization is an accounting method for spreading costs over time, not a cloud consumption model.

Trap 2: Capex

Capex involves upfront capital investment, which the company wants to avoid.

Trap 3: Leasing

Leasing is not a standard cloud financial model; it typically involves fixed payments over time.

Study all Cloud Concepts, Architecture and Design common traps →

A
Amortization
Why wrong: Amortization is an accounting method for spreading costs over time, not a cloud consumption model.
B
Capex
Why wrong: Capex involves upfront capital investment, which the company wants to avoid.
C
Leasing
Why wrong: Leasing is not a standard cloud financial model; it typically involves fixed payments over time.
D
Opex
Opex is the pay-as-you-go model that aligns with variable costs and no upfront investment.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

A healthcare provider is subject to HIPAA regulations. They are planning to use a public cloud provider. Which design consideration is most important to ensure compliance?

Trap 1: Containerization

Containerization is a deployment technology, not a compliance control.

Trap 2: Cost optimization

Cost optimization is important but not the primary compliance driver.

Trap 3: Multi-cloud strategy

Multi-cloud strategy can offer flexibility but is not a direct compliance requirement.

Study all Cloud Concepts, Architecture and Design common traps →

A
Containerization
Why wrong: Containerization is a deployment technology, not a compliance control.
B
Cost optimization
Why wrong: Cost optimization is important but not the primary compliance driver.
C
Multi-cloud strategy
Why wrong: Multi-cloud strategy can offer flexibility but is not a direct compliance requirement.
D
Data residency
Data residency ensures data is stored in approved locations, meeting HIPAA requirements.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full NAT/PAT explanation →

An organization is designing a cloud application that must remain available even if an entire AWS availability zone fails. Which architecture pattern should they implement?

Trap 1: Single region with multiple AZs active-standby

Active-standby introduces failover time that may not meet stringent availability requirements.

Trap 2: Active-passive in a single region

This pattern does not survive an AZ failure if both are in the same AZ.

Trap 3: Multi-region active-active

This is overkill for AZ failure and incurs higher cost and latency.

Study all Cloud Concepts, Architecture and Design common traps →

A
Single region with multiple AZs active-active
This pattern distributes workloads across AZs, ensuring continued availability if one AZ fails.
B
Single region with multiple AZs active-standby
Why wrong: Active-standby introduces failover time that may not meet stringent availability requirements.
C
Active-passive in a single region
Why wrong: This pattern does not survive an AZ failure if both are in the same AZ.
D
Multi-region active-active
Why wrong: This is overkill for AZ failure and incurs higher cost and latency.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

A company wants to ensure that their cloud deployment has the highest level of isolation between tenants. Which deployment model is most appropriate?

Trap 1: Public cloud

Public cloud shares resources among many tenants, reducing isolation.

Trap 2: Hybrid cloud

Hybrid cloud combines models but does not guarantee highest isolation.

Trap 3: Community cloud

Community cloud is shared among a specific group, not fully isolated.

Study all Cloud Concepts, Architecture and Design common traps →

A
Public cloud
Why wrong: Public cloud shares resources among many tenants, reducing isolation.
B
Hybrid cloud
Why wrong: Hybrid cloud combines models but does not guarantee highest isolation.
C
Private cloud
Private cloud is dedicated to a single organization, providing maximum isolation.
D
Community cloud
Why wrong: Community cloud is shared among a specific group, not fully isolated.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full NAT/PAT explanation →

A developer is designing a microservices-based application in the cloud. They need to ensure communication between services is loosely coupled and resilient to failures. Which design pattern should they implement?

Trap 1: API gateway

API gateway is typically used for external-facing services and does not guarantee loose coupling between internal services.

Trap 2: Service mesh

Service mesh manages service-to-service communication but does not inherently provide loose coupling.

Trap 3: Database per service

Database per service addresses data isolation, not communication coupling.

Study all Cloud Concepts, Architecture and Design common traps →

A
API gateway
Why wrong: API gateway is typically used for external-facing services and does not guarantee loose coupling between internal services.
B
Event-driven messaging
Event-driven messaging uses asynchronous messages, enabling loose coupling and resilience to failures.
C
Service mesh
Why wrong: Service mesh manages service-to-service communication but does not inherently provide loose coupling.
D
Database per service
Why wrong: Database per service addresses data isolation, not communication coupling.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

Trap 1: System description

The system description outlines the system but not control effectiveness.

Trap 2: Opinion letter

The opinion letter provides the auditor's conclusion but not detailed effectiveness evidence.

Trap 3: Management's assertion

Management's assertion is a statement, not independent verification of effectiveness.

Study all Cloud Concepts, Architecture and Design common traps →

A
System description
Why wrong: The system description outlines the system but not control effectiveness.
B
Description of tests and results
This section details the tests performed and their outcomes, proving controls operated effectively over the period.
C
Opinion letter
Why wrong: The opinion letter provides the auditor's conclusion but not detailed effectiveness evidence.
D
Management's assertion
Why wrong: Management's assertion is a statement, not independent verification of effectiveness.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

Trap 1: Backup and restore

Backup and restore typically has RTO of hours and RPO of hours, far exceeding requirements.

Trap 2: Pilot light

Pilot light can achieve RPO of minutes but RTO is often longer than 15 minutes.

Trap 3: Warm standby

Warm standby can achieve RPO of minutes and RTO of minutes, but RPO may be close to 5 minutes and RTO may exceed 15 minutes.

Study all Cloud Concepts, Architecture and Design common traps →

A
Multi-region active-active
Multi-region active-active provides continuous replication and instant failover, meeting both RTO and RPO.
B
Backup and restore
Why wrong: Backup and restore typically has RTO of hours and RPO of hours, far exceeding requirements.
C
Pilot light
Why wrong: Pilot light can achieve RPO of minutes but RTO is often longer than 15 minutes.
D
Warm standby
Why wrong: Warm standby can achieve RPO of minutes and RTO of minutes, but RPO may be close to 5 minutes and RTO may exceed 15 minutes.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

A small business wants to use a cloud service but has limited in-house IT expertise. Which cloud service model requires the least customer management responsibility?

Trap 1: IaaS

IaaS requires customer to manage OS, middleware, and applications.

Trap 2: PaaS

PaaS reduces management but still requires application-level management.

Trap 3: FaaS

FaaS (Functions as a Service) still requires function code management.

Study all Cloud Concepts, Architecture and Design common traps →

A
IaaS
Why wrong: IaaS requires customer to manage OS, middleware, and applications.
B
SaaS
SaaS is fully managed; customer only uses the application.
C
PaaS
Why wrong: PaaS reduces management but still requires application-level management.
D
FaaS
Why wrong: FaaS (Functions as a Service) still requires function code management.

Full breakdown with real-world context →

Question 20hardmultiple choice

Read the full Cloud Concepts, Architecture and Design explanation →

During a cloud migration, a company decides to move a legacy application with no code changes. Which migration strategy are they using?

Trap 1: Refactor

Refactoring requires significant code changes to optimize for cloud.

Trap 2: Repurchase

Repurchasing means replacing with a SaaS or new product.

Trap 3: Replatform

Replatforming involves making minor modifications to take advantage of cloud features.

Study all Cloud Concepts, Architecture and Design common traps →

A
Refactor
Why wrong: Refactoring requires significant code changes to optimize for cloud.
B
Repurchase
Why wrong: Repurchasing means replacing with a SaaS or new product.
C
Replatform
Why wrong: Replatforming involves making minor modifications to take advantage of cloud features.
D
Rehost (lift and shift)
Rehosting migrates the application as-is, requiring no code changes.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Cloud Concepts, Architecture and Design sessions

Start a Cloud Concepts, Architecture and Design only practice session

Every question in these sessions is drawn from the Cloud Concepts, Architecture and Design domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Cloud Concepts, Architecture and Design questions →Mixed CCSP session

Frequently asked questions

What does the CCSP exam test about Cloud Concepts, Architecture and Design?: Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Cloud Concepts, Architecture and Design questions in a focused session?: Yes — the session launcher on this page draws every question from the Cloud Concepts, Architecture and Design domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CCSP topics?: Use the topic links above to move to related areas, or go back to the CCSP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CCSP exam covers. They are not copied from any real exam or dump site.

Cloud Concepts, Architecture and Design only

10 questions 20 questions 30 questions 50 questions

Mixed CCSP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CCSP questions Cloud Concepts, Architecture and Design domain overview CCSP exam guide

Exam traps to avoid

▸IaaS gives you infrastructure control; SaaS gives you only the application.
▸Hybrid cloud combines on-premises and public cloud — not two public clouds.
▸Cloud does not automatically mean cheaper or more secure.
▸Management responsibility shifts with each service model (IaaS → PaaS → SaaS).

Cloud Concepts, Architecture and Design practice questions

What to know about Cloud Concepts, Architecture and Design

Common Cloud Concepts, Architecture and Design exam traps

Cloud Concepts, Architecture and Design questions

A company is designing a multi-tier application in the cloud. The web tier must automatically scale based on CPU utilization, while the database tier should remain fixed to maintain data consistency. Which architectural pattern best meets these requirements?

Which THREE of the following are key characteristics of cloud computing as defined by NIST SP 800-145?

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket contains sensitive documents that should only be accessible from the internal network (10.0.0.0/24) and only over HTTPS. What is the most likely effect of this policy?

Exhibit

Drag and drop the steps for performing a cloud migration using the 'lift and shift' strategy into the correct order.

Drag and drop the steps for implementing a data retention policy for cloud storage (e.g., Amazon S3) into the correct order.

Match each NIST SP 800-53 control family to its focus area.

Match each cloud auditing term to its definition.

A company is migrating to the cloud to reduce capital expenditures. They want to pay only for the resources they consume with no upfront investment. Which financial model does this describe?

A healthcare provider is subject to HIPAA regulations. They are planning to use a public cloud provider. Which design consideration is most important to ensure compliance?

An organization is designing a cloud application that must remain available even if an entire AWS availability zone fails. Which architecture pattern should they implement?

A company wants to ensure that their cloud deployment has the highest level of isolation between tenants. Which deployment model is most appropriate?

A developer is designing a microservices-based application in the cloud. They need to ensure communication between services is loosely coupled and resilient to failures. Which design pattern should they implement?

An auditor is reviewing a cloud provider's SOC 2 Type II report. Which aspect of the report is most relevant for assessing the effectiveness of controls over a period?

A cloud architect is designing a disaster recovery plan for a financial application with RTO of 15 minutes and RPO of 5 minutes. Which recovery strategy is most appropriate?

A small business wants to use a cloud service but has limited in-house IT expertise. Which cloud service model requires the least customer management responsibility?

During a cloud migration, a company decides to move a legacy application with no code changes. Which migration strategy are they using?

Track your progress over time

Start a Cloud Concepts, Architecture and Design only practice session

Related CCSP topic practice pages

Cloud Application Security practice questions

Cloud Security Operations practice questions

Legal, Risk and Compliance practice questions