Free CCSP Practice Questions

Q1.A scenario describes a provider's SLA promising rapid support and high uptime, but the customer's biggest long-term concern is being unable to leave affordably. Which SLA and contract elements should the customer scrutinize MOST closely, and why? (Choose TWO.)

• A.Data portability and egress fees
• B.Exit and egress terms including data extraction costs
• C.The headline uptime percentage of nines
• D.Support response-time commitments
• E.Breach notification timelines

Domain: Legal, Risk and Compliance

Q2.A healthcare startup compares Provider A (ISO 27001 certificate plus CSA STAR Level 1 self-assessment) with Provider B (SOC 2 Type II clean opinion, ISO 27018, and CSA STAR Level 2). For sensitive patient data, which provider offers stronger assurance and why?

• A.Provider B, because its attestations are independently verified and cover PII over time
• B.Provider A, because ISO 27001 alone proves the application is flawless
• C.Provider A, because a self-assessment is more current than an audit
• D.Provider B, but only because it lists more total certifications

Domain: Cloud Concepts, Architecture and Design

Q3.An attacker phishes a cloud administrator who had no MFA and held a broad, all-powerful role. The attacker logs into the console, disables logging, copies the database, and deletes backups. Which control would have MOST directly limited the damage from that single stolen credential?

• A.Encrypting the backup storage at rest
• B.Phishing-resistant MFA plus a least-privilege role on the administrator
• C.An intrusion detection system on the production subnet
• D.A web application firewall in front of customer apps

Domain: Cloud Platform and Infrastructure Security

Q4.A financial services firm processing card data wants to minimize its audit footprint while still being able to reverse individual values when a fraud team needs the original. Which design BEST balances scope reduction with authorized reversibility?

• A.Irreversible anonymization of every card number
• B.Tokenization with a secured vault that authorized staff can query for the original
• C.Encryption at rest, which removes the systems from audit scope
• D.Static masking that permanently replaces the card numbers

Domain: Cloud Data Security

Q5.A security architect is describing the ideal request flow in a well-designed cloud-native app. Which sequence BEST reflects secure design?

• A.The client calls services directly, and each service hardcodes its own database password
• B.Client gets a signed token, the gateway verifies and logs the request, then a secrets manager delivers credentials at runtime
• C.Requests skip the gateway for speed, and services trust any caller inside the network
• D.Every service embeds a permanent shared password to avoid runtime lookups

Domain: Cloud Application Security

Q6.A cloud provider offers to collect a memory and disk snapshot of a compromised instance on the customer's behalf during an incident. What is the MOST important governance consideration the customer should have addressed in advance?

• A.Whether the provider's marketing brochure mentions forensics
• B.That forensic-access and evidence-handling terms were negotiated in the contract in advance
• C.That the provider's default settings will surely be adequate
• D.That the customer can wait until the incident to arrange access

Domain: Cloud Security Operations

Q7.An organization is choosing between two providers. Provider A holds a completed CAIQ and a SOC 2 report; Provider B offers only marketing claims of strong security. From a governance perspective, why does Provider A's documentation matter MOST?

• A.They legally transfer the customer's compliance accountability to Provider A
• B.They provide independently verifiable evidence you can check against specific controls
• C.They guarantee Provider A will never suffer a breach
• D.They eliminate the customer's need to audit its own layer of the stack

Domain: Legal, Risk and Compliance

Q8.A designer wants to justify why a single new security appliance is unlikely to fix a cloud design problem that spans strategy, data, applications, and infrastructure. Which framework's layered view BEST supports this reasoning?

• A.SOC 2 Trust Services Criteria
• B.CSA Enterprise Architecture
• C.FIPS 140-3
• D.Common Criteria EAL levels

Domain: Cloud Concepts, Architecture and Design

Q9.A malicious co-tenant infers a neighbor's encryption keys by measuring cache timing on a shared processor, never touching the victim's VM. Which attack is this, and what is the BEST mitigation for the most sensitive workloads?

• A.A VM escape, mitigated by adding a web application firewall
• B.A side-channel attack, mitigated by using dedicated single-tenant hosts
• C.Hyperjacking, mitigated by rotating access tokens
• D.A denial-of-service attack, mitigated by autoscaling

Domain: Cloud Platform and Infrastructure Security

Q10.An automated cloud tiering policy silently moved certain objects toward deletion just as litigation became anticipated, and some were purged. A court is likely to treat this as what, and what was the required action?

• A.A retention-ceiling event that required no action
• B.Acceptable routine housekeeping, since automation is not intentional
• C.Spoliation, because lifecycle automations should have been suspended for the held data
• D.A restorability failure unrelated to legal obligations

Domain: Cloud Data Security