ISC2 CCSP — Certified Cloud Security Professional

Question 1

A development team exposes a REST API for a multi-tenant cloud SaaS. During a security review, a tester finds that by changing the numeric 'accountId' parameter in the URL (e.g., /api/v1/accounts/1042/invoices), they can retrieve invoices belonging to other tenants even though the JWT they present is valid for only their own account. The endpoint authenticates the token correctly but returns data without further checks. Which control best addresses this OWASP API Security Top 10 weakness?

Accepted Answer

Enforce per-object authorization on every request by validating that the authenticated principal is entitled to the specific resource identified in the path or body

Answer

Add rate limiting to the endpoint to slow down automated enumeration of account IDs

Answer

Replace sequential numeric IDs with random UUIDs so identifiers cannot be guessed

Answer

Shorten the JWT expiration time and rotate signing keys more frequently

Question 2

A financial services company exposes internal microservices to trusted partner banks through a cloud API gateway. Security requires that both the calling partner service AND the receiving API prove their identities cryptographically before any request payload is processed, preventing spoofed clients even if a partner's API key were leaked. Which control best satisfies this requirement?

Accepted Answer

Enforce mutual TLS (mTLS) with client and server certificates at the API gateway

Answer

Require an OAuth 2.0 bearer token in the Authorization header for each request

Answer

Rotate partner API keys automatically every 24 hours via the secrets manager

Answer

Add an IP allow-list restricting access to known partner network ranges

Question 3

A financial services company is designing its BCDR strategy for a customer-facing transaction platform hosted in a single cloud region. Business leaders mandate a Recovery Time Objective (RTO) of under 15 minutes and a Recovery Point Objective (RPO) of near-zero data loss, but they also want to avoid the full cost of duplicating the entire production environment continuously. Which cloud BCDR approach BEST meets these requirements?

Accepted Answer

A pilot light configuration where core databases replicate continuously to a second region while application servers remain switched off until failover

Answer

A backup-and-restore approach that stores nightly snapshots in a geographically separate object storage bucket

Answer

A hot site with a fully scaled, always-on duplicate of production running actively in a second region

Answer

A cold site that provisions all infrastructure from templates only after a disaster is declared

Question 4

A hospital is evaluating a new cloud-based scheduling application. The CISO requires that clinicians be able to access the application from hospital workstations, personal tablets, and smartphones, using only a standard browser and standard network protocols, without installing any proprietary client software. Which NIST essential cloud characteristic most directly describes this requirement the CISO is emphasizing?

Accepted Answer

Broad network access

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 5

A cloud operations team runs a customer-facing SaaS platform on autoscaling IaaS. Over three consecutive months, month-end batch processing has caused CPU saturation and degraded response times, even though autoscaling eventually adds capacity. The operations manager wants a repeatable ITIL-aligned process to forecast demand, model future workload growth, and ensure resources are provisioned ahead of predictable spikes rather than reacting to them. Which operational process should the team formalize to address this?

Accepted Answer

Capacity management

Answer

Incident management

Answer

Change management

Answer

Availability management

Question 6

A cloud forensics investigator at a financial services firm is collecting log data from a CSP-managed SIEM to support an anticipated fraud lawsuit. To ensure the collected logs will be admissible and defensible in court, which control is MOST critical for the investigator to establish and document throughout the collection and handling process?

Accepted Answer

An unbroken chain of custody with cryptographic hashing of each log artifact at the point of collection

Answer

A data retention schedule that keeps the logs for at least seven years to satisfy regulatory minimums

Answer

Tokenization of any personally identifiable information contained within the log entries before review

Answer

Encryption of the log repository at rest using customer-managed keys stored in an HSM

Question 7

A cloud operations engineer discovers that a critical authentication microservice is failing intermittently in production due to an expired configuration certificate. Restoring service requires deploying a corrected configuration immediately, but the organization's ITIL-aligned change management process normally requires that all production changes be reviewed and approved by the Change Advisory Board (CAB), which meets weekly. What is the MOST appropriate way for the engineer to proceed while remaining compliant with the change management process?

Accepted Answer

Invoke the emergency change procedure, obtain expedited approval from the emergency change authority (ECAB), deploy the fix, and document it for retrospective CAB review

Answer

Deploy the fix immediately without any approval, since production outages automatically exempt changes from the change management process

Answer

Submit a standard change request and wait for the next scheduled weekly CAB meeting to approve the deployment

Answer

Classify the fix as a pre-approved standard change and deploy it through the normal automated pipeline without additional review

Question 8

A financial services company is preparing for its annual ISO 27001 certification audit of its cloud-hosted trading platform. The compliance manager wants an internal review conducted first to identify areas where current controls fall short of the standard's requirements before the external certification body arrives, so that remediation can occur in advance. Which audit activity best fits this objective?

Accepted Answer

A gap analysis comparing the organization's implemented controls against the ISO 27001 control requirements

Answer

A SOC 2 Type II examination performed by an independent CPA firm

Answer

A full external certification audit conducted by the accredited registrar

Answer

A penetration test of the trading platform's public-facing endpoints

Question 9

A financial services firm is negotiating a contract with a large public IaaS provider. The firm's internal audit team insists on including a traditional 'right-to-audit' clause that would allow their auditors physical, on-site access to the provider's data centers to inspect controls whenever needed. The provider refuses this specific demand, citing the multitenant nature of its facilities. As the cloud security advisor, what should you recommend as the most practical way for the firm to obtain the required assurance over the provider's control environment?

Accepted Answer

Rely on the provider's independent third-party attestations, such as a SOC 2 Type II report and ISO 27001 certification, to evaluate control design and operating effectiveness

Answer

Escalate the negotiation and refuse to sign until the provider grants unrestricted physical audit access to satisfy regulatory obligations

Answer

Accept the provider's marketing materials and published security whitepapers as sufficient evidence of control effectiveness

Answer

Deploy the firm's own monitoring agents across the provider's hypervisor and physical infrastructure to continuously verify controls

Question 10

A financial services firm is being audited against its own controls, many of which now depend on a SaaS provider that hosts customer transaction data. The firm's auditor requests to physically inspect the provider's data centers and run vulnerability scans against the provider's shared infrastructure. The provider refuses both requests, citing multitenancy and its own security policies. What is the MOST appropriate way for the firm to satisfy the auditor's need for assurance over the outsourced controls?

Accepted Answer

Obtain and review the provider's independent third-party attestation (such as a SOC 2 Type II report) and map its relevant controls to the firm's control objectives

Answer

Escalate to the provider's executives and invoke the contract's audit clause to force an on-site inspection, since the firm remains accountable for its data

Answer

Accept the residual risk and document that the outsourced controls cannot be audited in a cloud environment

Answer

Require the provider to migrate the firm's data to a single-tenant environment so that direct scanning and inspection become feasible

Question 11

A financial services company runs its production trading platform in a single cloud region and has configured asynchronous replication of application data to a second region. The BCDR plan documents a failover procedure to the secondary region, but the plan has never been exercised since it was written 18 months ago. During a recent tabletop review, the security team notes that the DNS failover automation, the promotion of the standby database, and the IAM role trust relationships in the secondary region have all changed as the environment evolved. Which action should the team prioritize to give the greatest assurance that the BCDR plan will actually work when needed?

Accepted Answer

Conduct a full failover test to the secondary region and validate application recovery end to end

Answer

Increase the replication frequency between regions to reduce the recovery point objective

Answer

Add a third region to the replication topology to improve overall resilience

Answer

Encrypt the replicated data in transit and at rest in the secondary region

Question 12

A cloud architect is documenting the foundational technologies that allow a provider to pool physical servers and dynamically allocate compute resources to many customers on demand. Which building-block technology most directly enables this abstraction of physical hardware into flexible, shareable resource pools?

Accepted Answer

Virtualization

Answer

Data dispersion

Answer

Federated identity management

Answer

Transport Layer Security (TLS)

Question 13

A retail company runs its e-commerce platform on a private cloud sized for normal traffic. During seasonal sales events, demand spikes to nearly triple the baseline for a few days. Rather than permanently over-provisioning its private infrastructure, the company wants to automatically shift the temporary overflow workload to a public cloud provider only during these peak periods, keeping sensitive customer data on-premises the rest of the time. Which deployment model and technique best describes this approach?

Accepted Answer

A hybrid cloud using cloud bursting

Answer

A community cloud shared with other retailers

Answer

A public cloud with reserved instances

Answer

A private cloud with vertical autoscaling

Question 14

A financial services firm is negotiating a contract with a SaaS provider for a core analytics platform. During legal review, the risk officer wants to ensure the firm can retrieve all its data in a usable, non-proprietary format and migrate to another provider if the relationship ends. Which contractual provision most directly addresses this concern?

Accepted Answer

A data portability and exit (termination assistance) clause specifying export formats and provider transition obligations

Answer

A right-to-audit clause allowing annual on-site inspections of the provider's data centers

Answer

An SLA credit schedule tied to platform availability and response-time thresholds

Answer

A limitation-of-liability clause capping damages in the event of a data breach

Question 15

A financial services company stores highly sensitive customer records in a public cloud IaaS environment. As part of its data governance program, the security team is mapping controls to each phase of the cloud data lifecycle. They are now focused on the final phase, where information that has reached the end of its retention period must be rendered permanently unrecoverable. Because the underlying storage hardware is owned and multi-tenanted by the cloud provider, physical destruction of the media is not possible for the customer. Which technique is the MOST appropriate for the security team to rely on to securely address this lifecycle phase?

Accepted Answer

Crypto-shredding by destroying the encryption keys used to protect the data

Answer

Overwriting the logical volumes with multiple passes of random data (degaussing equivalent)

Answer

Requesting the provider physically shred the specific disks containing the records

Answer

Deleting the storage objects through the provider's management console

Question 16

A U.S. company using a SaaS collaboration platform receives a litigation hold notice requiring it to preserve all relevant emails, chat messages, and shared documents. The legal team is concerned because the data is stored and processed entirely by the cloud provider across multiple regions, and the provider's standard retention policy auto-deletes chat logs after 90 days. What is the MOST important action the company must take to meet its eDiscovery preservation obligations?

Accepted Answer

Ensure the cloud contract and provider capabilities support suspending automated deletion and enabling a legal hold on the relevant data, and coordinate the preservation scope with the provider

Answer

Immediately export all tenant data to on-premises storage so the company has full physical custody of the evidence

Answer

Rely on the provider's SOC 2 Type II report as evidence that data preservation controls are operating effectively

Answer

Terminate the provider's automated deletion job at the infrastructure level using the customer's cloud administrator credentials

Question 17

An investigator at a SaaS customer organization must collect forensic artifacts related to a suspected account compromise. The relevant hypervisor logs, underlying storage snapshots, and network flow data reside entirely within the cloud provider's infrastructure and are not exposed through the customer's tenant console. What is the MOST appropriate first step to lawfully obtain this evidence?

Accepted Answer

Invoke the provider cooperation and data-access terms defined in the cloud contract or SLA, formally requesting the provider preserve and produce the required artifacts

Answer

Deploy a custom agent that scans the hypervisor host directly to extract the logs before they are overwritten

Answer

Issue a subpoena directly to the provider's data center staff to seize the physical drives holding the storage snapshots

Answer

Reconstruct the missing evidence from the customer's own application logs since the provider-side data is inaccessible

Question 18

A SOC analyst is responding to an active compromise of a running IaaS virtual machine. Management wants to preserve evidence for a potential court case while the incident is ongoing. The VM is still powered on and the attacker appears to have an active session. Following forensic best practice and the order of volatility, what should the analyst prioritize acquiring FIRST?

Accepted Answer

The contents of the VM's live memory (RAM), including active network connections and running processes

Answer

A snapshot of the attached persistent block storage volume for later disk imaging

Answer

The cloud provider's monthly billing and metered-usage records for the affected account

Answer

The archived audit logs stored in the immutable long-term retention bucket

Question 19

A development team runs a containerized microservice on a managed Kubernetes cluster in a public cloud. The service needs to read objects from a cloud object storage bucket. Currently, developers have embedded a long-lived cloud access key and secret into the container image's environment variables. A security review flags this as a risk. Which approach BEST remediates the finding while following cloud IAM best practices for application identity?

Accepted Answer

Assign a workload identity (service account bound to a cloud IAM role) to the pod so the application obtains short-lived, automatically rotated credentials via the cloud provider's metadata/token service

Answer

Move the access key and secret from environment variables into a ConfigMap so they are stored outside the container image

Answer

Rotate the long-lived access key manually every 90 days and document the rotation in the change log

Answer

Encrypt the access key with a customer-managed key and decrypt it at container startup using a hardcoded passphrase

Question 20

A mid-sized retailer wants to consume services from three different SaaS providers but lacks the internal expertise to integrate them, manage identity federation across them, and negotiate consolidated billing. They engage a third party that aggregates these services, adds single sign-on, and presents a unified portal and invoice to the retailer. According to the NIST cloud reference architecture, which role is this third party performing?

Accepted Answer

Cloud service broker

Answer

Cloud carrier

Answer

Cloud auditor

Answer

Cloud service provider

Question 21

A large retailer is drafting a governance document to clarify accountability for its cloud initiative. The document must define the entity that periodically reviews cloud service outputs and independently confirms that the provider meets agreed standards and regulatory obligations. Which cloud computing role best matches this responsibility?

Accepted Answer

Cloud auditor

Answer

Cloud service partner

Answer

Cloud service broker

Answer

Cloud service customer

Question 22

A financial services firm is completing a vendor risk assessment on a SaaS provider that will process regulated customer data. During the review, the security team discovers the SaaS provider relies on a separate third-party analytics company to enrich data, and that analytics company in turn uses an offshore IaaS provider for compute. The firm's regulator holds it accountable for the full processing chain. Which action best addresses the enterprise risk this arrangement creates?

Accepted Answer

Require contractual flow-down clauses obligating the SaaS provider to bind its subcontractors to equivalent security, breach-notification, and audit obligations, and to disclose fourth-party dependencies

Answer

Accept the residual risk since the firm's contract is only with the primary SaaS provider and downstream parties are outside the firm's contractual scope

Answer

Terminate the engagement because any use of subcontractors by a SaaS provider is prohibited under standard outsourcing risk frameworks

Answer

Rely solely on the SaaS provider's SOC 2 Type II report, which automatically covers all subcontractors in the processing chain

Question 23

A financial services firm relies on a SaaS trading-analytics platform. During a 14-hour provider outage, the firm lost an estimated $2.3 million in trading opportunities. When the firm reviewed the signed contract to recover damages, it found the SLA guaranteed 99.9% monthly availability with a remedy of 'service credits equal to 10% of the monthly fee for each hour of downtime beyond the commitment.' The firm's risk committee is frustrated that recovery is limited to a few thousand dollars in credits. From an enterprise risk management perspective, what is the MOST important lesson for the firm's future cloud vendor negotiations?

Accepted Answer

SLA service credits are typically the sole and exclusive remedy and do not indemnify the customer for consequential business losses, so residual outage risk must be treated through other controls such as insurance or contractual liability negotiation

Answer

The firm should demand a 100% uptime SLA in all future contracts to eliminate availability risk entirely

Answer

Service credits automatically scale to cover documented business losses once the customer submits evidence of damages

Answer

SLA availability percentages are legally binding guarantees that the provider will never breach, transferring all outage risk to the provider

Question 24

A cloud security architect is procuring a hardware firewall appliance to protect the perimeter of a new private cloud data center. Corporate policy requires that any security product selected must have been independently evaluated for the trustworthiness of its security functions against a standardized, internationally recognized assurance framework, so the assurance rating can be compared across vendors from different countries. Which certification or standard should the architect require the vendor to provide?

Accepted Answer

Common Criteria evaluation with an appropriate Evaluation Assurance Level (EAL)

Answer

FIPS 140-2 validation of the appliance's cryptographic module

Answer

PCI DSS Attestation of Compliance for the appliance

Answer

SOC 2 Type II report covering the vendor's operations

Question 25

Several regional hospitals want to share a common cloud platform to exchange patient records and run shared analytics. They must all comply with the same healthcare privacy regulations and want shared governance and cost-sharing among the participating organizations, but they do not want the platform open to the general public or hosted entirely within a single hospital's data center. Which cloud deployment model best fits these requirements?

Accepted Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Answer

Hybrid cloud

Question 26

A cloud operations team maintains an approved configuration baseline for all production Linux instances, including required kernel hardening parameters and disabled legacy services. During a routine automated scan, the configuration management database (CMDB) reveals that 12 instances in an auto-scaling group have deviated from the baseline: an outdated SSH cipher suite has been re-enabled and a firewall rule was manually modified. The change is not documented in any change ticket. According to sound configuration management practice, what should the team do FIRST?

Accepted Answer

Automatically re-apply the approved baseline configuration to the drifted instances and open a problem record to investigate the source of the unauthorized change

Answer

Update the configuration baseline to reflect the current running state of the 12 instances so the CMDB no longer reports drift

Answer

Immediately terminate the 12 instances and let the auto-scaling group launch fresh replacements from the trusted image

Answer

Submit a retroactive emergency change request to legitimize the modified SSH cipher and firewall rule before the next audit

Question 27

A development team is building a cloud-hosted web application that displays user-submitted comments on a public product page. During a threat modeling review, a security engineer flags that attacker-supplied comment text could be rendered directly into the HTML response, allowing malicious scripts to execute in other users' browsers. Which control most directly mitigates this OWASP-classified vulnerability?

Accepted Answer

Apply context-aware output encoding when rendering user-supplied comment data into the HTML page

Answer

Enforce TLS 1.3 on all connections between the browser and the application load balancer

Answer

Enable parameterized queries in the data access layer that stores the comments

Answer

Rotate the application's session cookies more frequently through the identity provider

Question 28

A financial services company stores seven years of customer transaction archives in a cloud object storage bucket that is shared across multiple tenants under the provider's control. A customer whose retention period has legally expired requests that their specific archived data be rendered permanently unrecoverable. Because the underlying storage media is multitenant and physical destruction is impossible, which approach BEST guarantees the data is effectively destroyed?

Accepted Answer

Encrypt each customer's data with a unique key and destroy that customer's encryption key (crypto-shredding)

Answer

Overwrite the customer's objects multiple times with random data (data wiping) before issuing the delete command

Answer

Delete the object metadata pointers so the storage system can no longer locate the archived files

Answer

Apply data masking to the archived records so the original values can no longer be read

Question 29

During an active incident, a cloud SOC analyst confirms that customer PII stored in a multi-tenant SaaS database was accessed by an unauthorized party. The incident response plan is in the containment phase, and regulatory breach-notification clocks may soon start. The analyst wants to alert affected customers immediately via a mass email to demonstrate transparency. According to sound incident management and stakeholder communication practice, what should the analyst do FIRST?

Accepted Answer

Route communications through the designated incident commander and follow the plan's pre-approved communication and escalation procedures

Answer

Send the mass notification email immediately to all customers to maintain transparency and trust

Answer

Post the details on the company status page so customers and the public are informed simultaneously

Answer

Wait until the eradication and recovery phases are fully complete before informing any stakeholder

Question 30

A financial services firm must archive customer transaction records for seven years to meet regulatory requirements. The archived data is stored encrypted in a cloud object storage tier and is rarely accessed. During a compliance audit in year four, the security team discovers that some older archives cannot be decrypted because the encryption keys used to protect them were rotated and the previous key versions were destroyed after the standard 90-day key retention window. What is the MOST important consideration the team overlooked when designing the Archive phase of the data lifecycle?

Accepted Answer

Encryption keys must remain available and recoverable for the entire retention period of the data they protect

Answer

Archived data should be moved to a warmer storage tier to allow faster decryption during audits

Answer

Archives should have been tokenized instead of encrypted to avoid key dependency

Answer

The 90-day key rotation policy should be eliminated to prevent all future key loss

Question 31

A cloud security engineer is designing the logging architecture for a regulated healthcare SaaS platform. Auditors require that once an access log entry is written, no administrator — including those with root-level cloud console privileges — can alter or delete individual records without detection during the mandated retention window. Which control BEST satisfies this requirement?

Accepted Answer

Store logs in a write-once-read-many (WORM) object storage bucket configured with immutability/object-lock in compliance mode for the retention period

Answer

Encrypt the log files at rest with a customer-managed key stored in an HSM and restrict decryption to auditors

Answer

Forward all logs to a SIEM and configure hourly automated backups to a separate region

Answer

Apply strict IAM role-based access controls so only the security team can modify the log repository

Question 32

A financial services firm has completed a data discovery scan across its cloud environment and produced a classification catalog tagging datasets as Public, Internal, Confidential, and Restricted. The security architect now wants to ensure that the classification effort produces measurable security value rather than remaining a compliance artifact. Which action best leverages the completed classification to strengthen data protection?

Accepted Answer

Automatically apply differentiated controls—such as stronger encryption and stricter access policies for Restricted data—based on the assigned classification labels

Answer

Re-run the discovery scan monthly to confirm that the total count of classified records continues to increase over time

Answer

Encrypt every dataset with a single organization-wide key regardless of its classification to simplify key management

Answer

Archive all classified datasets to cold storage immediately to reduce the attack surface of the production environment

Question 33

A financial services company is preparing to deploy an information rights management (IRM) solution across its SaaS collaboration platform to enforce persistent protections such as document expiration and copy/print restrictions. During planning, the security architect insists that a specific activity must be completed first to ensure the IRM policies apply the correct level of protection to each document. Which activity should be completed before the IRM controls can be effectively configured?

Accepted Answer

Data discovery and classification to identify and label sensitive content

Answer

Tokenization of all structured database fields containing account numbers

Answer

Establishing a chain-of-custody log for all archived records

Answer

Defining the data retention and deletion schedule for expired documents

Question 34

A cloud security architect is deploying a data discovery solution across a large object storage repository containing millions of unstructured files uploaded by many business units. The organization needs to identify files containing PII even when the files were never tagged, poorly named, or stored in unexpected buckets. Which data discovery approach BEST meets this requirement?

Accepted Answer

Content-based discovery that inspects the actual data within files using pattern matching and lexical analysis

Answer

Metadata-based discovery that relies on file names, extensions, and storage tags to locate sensitive data

Answer

Label-based discovery that reads classification labels applied by users during the create phase

Answer

Location-based discovery that scans only the buckets designated for regulated data

Question 35

A cloud architect is designing an object storage system for a healthcare provider. The security requirement is that no single storage node holds a complete, readable copy of any patient record, so that theft of a single disk or compromise of one node does not expose usable data, while still providing resilience against node failure. Which cloud data security technique BEST satisfies this requirement?

Accepted Answer

Data dispersion using erasure coding that splits data into fragments distributed across multiple nodes

Answer

Full-disk encryption applied uniformly to every storage node

Answer

Nightly replication of complete object copies to a geographically separate region

Answer

Dynamic data masking applied to records as they are read by applications

Question 36

A financial services company is implementing a cloud data governance program. Their data discovery tool has scanned an object storage repository and identified thousands of files. The security architect wants to ensure that once data is discovered, appropriate handling controls (encryption requirements, access restrictions, and retention rules) can be automatically enforced by downstream tools such as the IRM and DLP systems. Which activity is the essential next step that enables those downstream controls to function correctly?

Accepted Answer

Apply consistent classification labels or tags to the discovered data based on defined sensitivity categories

Answer

Immediately encrypt all discovered files with a single organization-wide symmetric key

Answer

Move all discovered data into a separate archive tier to reduce active storage costs

Answer

Configure crypto-shredding to guarantee secure deletion at end of the retention period

Question 37

A financial services company is designing a data governance program for its new cloud analytics platform. Security architects want to ensure that appropriate protection controls (encryption levels, access restrictions, and retention rules) are automatically applied to each dataset the moment it enters the platform. During which phase of the cloud data lifecycle should classification tags be assigned to maximize the effectiveness of downstream security controls?

Accepted Answer

The Create phase, when data is first generated or ingested

Answer

The Store phase, once the data has been written to persistent storage

Answer

The Use phase, when analysts begin querying the datasets

Answer

The Archive phase, before data is moved to long-term retention

Question 38

A financial analytics firm stores customer records in a cloud data warehouse. During a quarterly review, the security team maps controls to each phase of the cloud data lifecycle. They note that while data is actively being queried and processed by analysts and BI tools, the primary risk is unauthorized viewing or manipulation by users who have legitimate system access but should not see certain fields. Which control set is MOST appropriate to emphasize for this specific lifecycle phase?

Accepted Answer

Fine-grained access controls, DLP monitoring, and dynamic data masking based on user role

Answer

Crypto-shredding and secure overwrite procedures tied to retention expiry

Answer

Immutable object storage with versioning and erasure coding for durability

Answer

Data classification labeling and tagging performed at record creation

Question 39

A healthcare SaaS provider must supply realistic data to an offshore development team for building a new reporting feature. The dataset contains patient records with PHI. Developers need referential integrity across tables and must run repeatable test cases, but they should never see real patient identifiers, and the masked copy will be stored in a persistent non-production database. Which data protection approach best fits these requirements?

Accepted Answer

Static data masking that irreversibly substitutes PHI with consistent surrogate values before the dataset is loaded into the non-production environment

Answer

Dynamic data masking applied at query time against the production database so developers query live data with masked results

Answer

Format-preserving encryption of the PHI columns with the decryption keys shared with the offshore team

Answer

Row-level access control policies that hide PHI columns from the developers' database role

Question 40

A healthcare analytics team needs to run aggregate statistical queries on a large patient dataset stored in a cloud data warehouse. Regulators require that individual patient identifiers be irreversibly obscured before analysts access the data, and the analysts must still be able to count distinct patients across queries. Which data protection technique best satisfies both the irreversibility requirement AND the need to correlate the same patient across records?

Accepted Answer

Deterministic one-way hashing of the patient identifier with a secret salt

Answer

Format-preserving encryption applied to the patient identifier field

Answer

Dynamic data masking that redacts identifiers at query time

Answer

Reversible tokenization using a secure token vault

Question 41

A healthcare organization must retain patient imaging records in cloud archive storage for 25 years to meet regulatory requirements. The compliance team is drafting the data retention and archiving policy. Which consideration is MOST critical to ensuring the archived data remains usable and defensible throughout the entire retention period?

Accepted Answer

Ensuring the data format and the technology/keys needed to read it remain accessible and non-obsolete for the full retention duration

Answer

Selecting the lowest-cost cold storage tier to minimize total storage expenditure over 25 years

Answer

Configuring automatic deletion of the records immediately after the 25-year period expires

Answer

Replicating the archive across three geographic regions for maximum availability

Question 42

A retail analytics team stores customer purchase records across two cloud databases. To comply with PCI DSS, primary account numbers (PANs) must be removed from the analytics environment, but analysts still need to join transactions belonging to the same card across both databases and count distinct cardholders. The security architect wants to preserve this ability without exposing any actual PAN values. Which data protection approach best meets these requirements?

Accepted Answer

Deterministic tokenization, which consistently produces the same token for a given PAN

Answer

Non-deterministic (randomized) tokenization that generates a unique token each time a PAN is submitted

Answer

Dynamic data masking applied at query time to hide the PAN digits

Answer

Format-preserving encryption with a rotating data encryption key per record

Question 43

A cloud security architect is reviewing the virtual network design for a new multi-tier IaaS application. During threat modeling, the team identifies that a compromised tenant VM on a shared virtual subnet could potentially advertise a false gateway address to redirect and intercept traffic from neighboring VMs on the same broadcast domain. Which control most directly mitigates this specific Layer 2 threat within the cloud provider's virtual network?

Accepted Answer

Enable per-port MAC/IP address spoofing protection (source/destination filtering) on the virtual NICs

Answer

Deploy a web application firewall in front of the presentation tier

Answer

Require TLS 1.3 for all inter-tier application traffic

Answer

Configure a network security group to deny inbound traffic on unused ports

Question 44

A forensic investigator is responding to a confirmed compromise of a cloud-hosted Linux virtual machine that is still running. The investigator has provider cooperation and legal authority to collect all available artifacts. To preserve the most fragile evidence first, in what order should the investigator prioritize collection of the following data sources?

Accepted Answer

CPU registers and cache, then RAM contents and running process state, then disk-based logs, then archived snapshots in object storage

Answer

Archived snapshots in object storage, then disk-based logs, then RAM contents, then CPU registers and cache

Answer

Disk-based logs, then archived snapshots, then RAM contents, then CPU registers and cache

Answer

RAM contents, then CPU registers and cache, then archived snapshots, then disk-based logs

Question 45

A financial services company running its trading platform in a public IaaS environment discovers evidence of a potential insider fraud incident. Legal counsel instructs the cloud security team to preserve all relevant digital evidence for a possible court case. Some critical evidence resides in provider-managed logs (e.g., hypervisor and storage-layer activity) that the customer cannot directly access. What is the MOST appropriate action for the security team to ensure this evidence is admissible and properly preserved?

Accepted Answer

Submit a formal evidence preservation request to the cloud provider through the contractually defined channel and document the request as part of the chain-of-custody record

Answer

Immediately reimage the affected virtual machines to capture a clean forensic snapshot before the attacker can cover their tracks

Answer

Rely solely on the customer-accessible application logs, since provider-managed logs are not legally usable in court

Answer

Publicly disclose the incident to regulators before consulting legal counsel to demonstrate good-faith transparency

Question 46

A financial services company runs a multi-tier application (web, application, and database tiers) across many virtual machines in a single IaaS virtual network. During a tabletop exercise, the security team notes that if any single web-tier VM is compromised, an attacker could freely reach the database VMs because all internal traffic between VMs is currently unrestricted. Perimeter firewalls only inspect north-south (ingress/egress) traffic. Which control best reduces the risk of lateral (east-west) movement between the tiers?

Accepted Answer

Implement micro-segmentation with per-workload security groups that permit only required flows between tiers

Answer

Enable full-disk encryption on all VM volumes to protect data if a host is breached

Answer

Deploy a web application firewall (WAF) in front of the public web tier

Answer

Increase the logging retention period on the perimeter firewalls to support forensics

Question 47

A financial services company migrates a customer-facing application to a public IaaS provider. After implementing all agreed technical and contractual controls, the risk assessment shows a small amount of remaining risk related to a rare provider outage scenario. The cost of further mitigation would exceed the projected loss, and the residual risk falls within the board-approved risk appetite. According to enterprise risk management principles, what is the appropriate next step for handling this remaining risk?

Accepted Answer

Formally document the residual risk and have the accountable business owner accept it in writing

Answer

Transfer the remaining risk entirely to the cloud provider by demanding a stronger SLA

Answer

Continue adding controls until the risk is reduced to zero before going live

Answer

Avoid the risk by cancelling the migration and keeping the application on-premises

Question 48

A US-headquartered company is subject to a US court order requiring production of documents stored by its cloud provider in a data center located in France. Company counsel notes that French blocking statutes and EU data protection law restrict the transfer of the requested personal data outside the EU. What is the MOST appropriate first step for the organization to take when responding to the eDiscovery request?

Accepted Answer

Seek to narrow the request and pursue a recognized lawful transfer mechanism (such as the Hague Evidence Convention or a court-supervised protective order) while consulting counsel in both jurisdictions

Answer

Immediately export and produce all responsive data to the US court to avoid contempt sanctions, since a valid court order overrides foreign privacy law

Answer

Refuse to produce any data and rely solely on the French blocking statute, since EU law always takes precedence over foreign court orders

Answer

Instruct the cloud provider to permanently delete the responsive French-hosted data so it cannot be compelled by either jurisdiction

Question 49

A financial services company deploys a dozen SaaS applications for its employees and wants to centralize authentication so users log in once with corporate credentials. The security team implements SAML-based federation with the corporate identity provider (IdP) issuing assertions to each SaaS relying party. During a design review, an architect warns that this federation model introduces a specific risk that must be mitigated. Which risk is MOST directly created by this federated SSO design, and what is the appropriate mitigation?

Accepted Answer

The IdP becomes a high-value single point of compromise; mitigate by hardening the IdP with strong MFA, monitoring, and short assertion lifetimes.

Answer

Each SaaS provider must store user passwords locally; mitigate by rotating those passwords frequently across all providers.

Answer

Federation eliminates the ability to enforce authorization, so RBAC cannot be applied; mitigate by disabling SSO for privileged users.

Answer

SAML assertions are transmitted unencrypted by design; mitigate by switching all applications to OAuth client credentials grant.

Question 50

A financial services company is migrating a payment processing application to a public cloud IaaS provider. Regulatory requirements mandate that the cryptographic modules used to protect and store encryption keys be independently certified to a U.S. government standard for physical and logical security of cryptographic hardware. Which certification should the security architect require the cloud provider's key management hardware to hold?

Accepted Answer

FIPS 140-2 (validated cryptographic module)

Answer

Common Criteria EAL4+ (evaluation assurance level)

Answer

ISO/IEC 27001 (information security management system)

Answer

SOC 2 Type II (service organization controls report)

Question 51

A European retailer engages a cloud-based marketing analytics SaaS to run campaigns. The retailer decides which customer datasets to upload, the campaign objectives, and the retention periods. The SaaS provider stores and processes the data strictly according to the retailer's documented instructions and does not use the data for its own purposes. Under GDPR, how should the parties' roles be classified, and what is the primary compliance consequence?

Accepted Answer

The retailer is the data controller and the SaaS provider is the data processor; a written data processing agreement (Article 28) defining the processor's obligations is required.

Answer

Both parties are joint controllers because the provider physically holds the data, so each independently owes the same direct obligations to data subjects.

Answer

The SaaS provider is the controller because it operates the infrastructure that determines how the processing physically occurs.

Answer

The retailer is a processor and the SaaS provider is a sub-processor, so no formal contract between them is necessary.

Question 52

A European healthcare company processes patient PII in a SaaS platform hosted in the EU. The vendor announces that it will begin replicating backup data to a data center in a country that the European Commission has NOT recognized as providing adequate data protection. The company's DPO must ensure the transfer remains lawful under GDPR. Which action is the MOST appropriate to enable this cross-border transfer to proceed?

Accepted Answer

Execute Standard Contractual Clauses (SCCs) with the vendor and conduct a transfer impact assessment before replication begins

Answer

Rely on the data subjects' implied consent since they already agreed to the SaaS platform's terms of service

Answer

Encrypt the backup data at rest, which exempts the transfer from GDPR cross-border requirements

Answer

Notify the supervisory authority within 72 hours of the replication, treating it as a reportable event

Question 53

A European retailer (the data controller) uses a SaaS marketing platform (the data processor) to store customer contact details subject to GDPR. The processor detects unauthorized access to a database containing this personal data. Under GDPR, what is the processor's primary legal obligation regarding this incident?

Accepted Answer

Notify the controller without undue delay after becoming aware of the personal data breach

Answer

Notify the relevant supervisory authority within 72 hours of discovering the breach

Answer

Notify each affected data subject directly within 72 hours

Answer

Conduct a data protection impact assessment before disclosing the breach to anyone

Question 54

A data subject in the EU submits a valid GDPR Article 17 (right to erasure) request to an online retailer that operates entirely on a public cloud SaaS platform. The privacy officer confirms the request is legitimate and that no legal exemption to retain the data applies. When the DPO instructs the operations team to comply, the team reports that the customer's personal data also exists in encrypted incremental backups that are retained on a 90-day rolling cycle and cannot be selectively edited without corrupting the backup chain. What is the MOST appropriate way to handle the erasure obligation with respect to these backups?

Accepted Answer

Erase the data from production systems now, and document a defensible process ensuring the backup copies are put beyond use and destroyed on the normal rolling retention cycle

Answer

Immediately restore, delete the record, and re-create every backup so the data is purged from all retained copies at once

Answer

Deny the erasure request because immutable backups qualify as a technical impossibility exemption under GDPR

Answer

Transfer the backups to the cloud provider so that erasure becomes the provider's sole responsibility as data controller

Question 55

A cloud provider must apply an urgent security patch to the hypervisor kernel across a cluster of hosts running thousands of tenant VMs. The security team requires that the patch be applied without extended tenant downtime and without exposing running workloads to the unpatched code. Which capability of the underlying virtualization infrastructure BEST enables the provider to meet this requirement?

Accepted Answer

Live migration of running VMs to already-patched hosts before patching the source host

Answer

Ballooning to reclaim guest memory and reduce the hypervisor's exposed footprint

Answer

Snapshotting each VM to disk and restoring it after the host reboots

Answer

Enabling nested virtualization so guests run on an isolated secondary hypervisor

Question 56

A security review of a cloud-native microservices application finds that database credentials and third-party API keys are stored in plaintext within environment variables defined in the container image's Dockerfile and committed to the source code repository. The DevOps team needs a remediation approach that removes long-lived secrets from code while enabling automatic rotation and audited retrieval at runtime. Which approach best addresses these requirements?

Accepted Answer

Integrate a managed secrets management service (vault) that the application authenticates to at runtime via workload identity to fetch secrets, with rotation and access logging enabled

Answer

Move the secrets into an encrypted .env file that is decrypted by the container entrypoint script at startup using a passphrase baked into the image

Answer

Base64-encode the credentials and store them as Kubernetes ConfigMaps referenced by the deployment manifests

Answer

Restrict repository access to the DevOps team and rotate the committed credentials manually every 90 days

Question 57

A cloud provider's security team wants to detect malware and rootkits running inside customer VMs on their Type 1 hypervisor platform without installing any agent inside the guest operating systems, which tenants control. They need a mechanism that observes guest memory and process state from a trusted vantage point outside the VM. Which technology best meets this requirement?

Accepted Answer

Virtual machine introspection (VMI) implemented at the hypervisor layer

Answer

Host-based intrusion detection agents pushed to each guest OS

Answer

A network intrusion detection system on the virtual switch

Answer

Enabling full-disk encryption on each VM's virtual volumes

Question 58

A cloud provider is designing a new multi-tenant IaaS platform and must select a virtualization approach for its compute hosts. The security architect insists that the virtualization layer expose the smallest possible attack surface and not depend on a general-purpose host operating system that could be exploited to compromise all tenant VMs. Which choice best satisfies this requirement?

Accepted Answer

Deploy a Type 1 (bare-metal) hypervisor installed directly on the host hardware

Answer

Deploy a Type 2 (hosted) hypervisor running as an application on a full host OS

Answer

Run each tenant workload in OS-level containers sharing a single host kernel

Answer

Use nested virtualization by layering a Type 2 hypervisor inside guest VMs

Question 59

A mid-sized retailer currently runs a self-managed relational database on IaaS virtual machines. The DBA team spends significant time on OS patching, database engine upgrades, backup scripting, and replication configuration. Leadership asks the cloud architect to reduce operational overhead while keeping the same database engine, but they are concerned about losing low-level control. As part of a cost-benefit analysis, which trade-off should the architect present as the PRIMARY consideration when recommending a move to the provider's managed PaaS database service?

Accepted Answer

The managed PaaS service transfers operational tasks like patching, backups, and replication to the provider, reducing labor cost but removing OS-level and some engine configuration control.

Answer

The managed PaaS service eliminates all shared responsibility, making the provider fully accountable for data classification and access control.

Answer

The managed PaaS service always costs less per month than IaaS regardless of workload, so cost is never a trade-off.

Answer

The managed PaaS service requires the retailer to switch to a different database engine, so application code must be fully rewritten.

Question 60

A media company distributes confidential pre-release films to external review partners using an Information Rights Management (IRM) solution. Executives require that a reviewer's access to a downloaded film be automatically revoked the moment their contract ends, even if the file already resides on the reviewer's laptop. During testing, the security team discovers that some reviewers can still open protected files days after their contract termination date. Which IRM configuration issue is the MOST likely root cause?

Accepted Answer

The IRM policy allows cached license tokens with a long validity period, permitting offline playback without re-checking the license server

Answer

The films were encrypted with symmetric keys instead of asymmetric keys, weakening the protection

Answer

The IRM solution applied static data masking to the film metadata rather than the content

Answer

The reviewers' devices lacked a FIPS 140-2 validated HSM to store the content encryption keys

Question 61

A media company distributes pre-release film scripts to external partners as PDF files. Executives are concerned that once a script leaves the corporate network, they lose all control over who can open it and for how long. They want the ability to revoke access to already-distributed copies and prevent printing or copying, even after files have been downloaded to partner devices. Which technology BEST addresses these requirements?

Accepted Answer

Information Rights Management (IRM) with policies enforced by the document itself

Answer

Data loss prevention (DLP) applied at the corporate network egress point

Answer

Transparent database encryption on the content management system

Answer

Tokenization of sensitive fields within the script documents

Question 62

A media company distributes pre-release film scripts to external contractors through a SaaS collaboration platform. Recently, a leaked script appeared online after a contractor downloaded and forwarded the file outside the platform. Management wants a control that keeps access restrictions and usage policies attached to the document even after it leaves the company's storage environment. Which technology best satisfies this requirement?

Accepted Answer

Information Rights Management (IRM) with persistent policy enforcement

Answer

Transparent data-at-rest encryption on the SaaS storage volumes

Answer

Dynamic data masking applied to the script fields

Answer

Network data loss prevention (DLP) at the corporate egress gateway

Question 63

A financial services company is negotiating with a cloud IaaS provider and wants third-party assurance that the provider has implemented cloud-specific security controls beyond the generic information security controls found in ISO/IEC 27002. The procurement team asks the security architect which certification or standard specifically extends the baseline controls with cloud-oriented implementation guidance and additional controls for both providers and customers. Which standard best meets this requirement?

Accepted Answer

ISO/IEC 27017, a code of practice that provides cloud-specific implementation guidance and additional controls for cloud service providers and customers

Answer

ISO/IEC 27018, a code of practice focused solely on protection of PII in public clouds acting as PII processors

Answer

ISO/IEC 27001, the certifiable management system standard that defines requirements for an ISMS without cloud-specific control guidance

Answer

ISO/IEC 27701, the privacy information management extension focused on establishing a PIMS

Question 64

A healthcare analytics company is evaluating a SaaS provider that will process regulated patient PII on the company's behalf. The compliance officer wants independent, standards-based assurance that the provider has implemented specific controls for protecting personally identifiable information as a processor in the public cloud — including restrictions on using PII for the provider's own marketing and commitments to notify the customer of any government data disclosure requests. Which assurance artifact BEST demonstrates that these specific PII-processing controls are in place?

Accepted Answer

Certification against ISO/IEC 27018

Answer

A completed CSA CAIQ self-assessment questionnaire

Answer

Certification against ISO/IEC 27001

Answer

A SOC 1 Type II report

Exam domain	Exam weight	Practice
Cloud Concepts, Architecture and Design	17%	Practice this topic
Cloud Data Security	20%	Practice this topic
Cloud Platform and Infrastructure Security	17%	Practice this topic
Cloud Application Security	17%	Practice this topic
Cloud Security Operations	16%	Practice this topic
Legal, Risk and Compliance	13%	Practice this topic

ISC2 CCSP — Certified Cloud Security Professional (CCSP) practice exam & study guide

Start studying CCSP

All CCSP study resources

CCSP exam domains

Sample CCSP questions

Key CCSP terms

CCSP frequently asked questions

Cloud Concepts, Architecture and Design (17%)

Cloud Data Security (20%)

Cloud Platform and Infrastructure Security (17%)

Cloud Application Security (17%)

Cloud Security Operations (16%)

Legal, Risk and Compliance (13%)