Questions & answers (free, no sign-in needed)
- View
10 beginner questions across the six CCSP domains: cloud service models and essential characteristics, cryptographic erase and tokenization, recovery objectives, STRIDE and static testing, central log analysis, independent assurance reports and cross-border data transfers.
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
A development team wants to deploy its own web application to the cloud without managing servers, operating systems or storage, while still controlling the application and its hosting settings. Which cloud service model fits best?
- A. Infrastructure as a Service (IaaS)
- B. Platform as a Service (PaaS) ✔ correct
- C. Software as a Service (SaaS)
- D. Desktop as a Service (DaaS)
Answer: B. In NIST's definition of PaaS, the consumer deploys its own applications onto the provider's platform and controls them, but does not manage the underlying network, servers, operating systems or storage. With IaaS the customer still manages the OS; SaaS delivers the provider's application.
Source: csrc.nist.gov/pubs/sp/800/145/final · Domain: Cloud Concepts, Architecture and Design
Which two are essential characteristics of cloud computing in the NIST definition? (Select TWO)
- A. On-demand self-service ✔ correct
- B. Measured service ✔ correct
- C. Single-tenant hardware
- D. Mandatory multi-factor authentication
- E. Guaranteed data residency
Answer: A, B. NIST SP 800-145 lists five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. Resource pooling is multi-tenant, so single-tenant hardware is not one of them; MFA and residency are security or legal choices.
Source: csrc.nist.gov/pubs/sp/800/145/final · Domain: Cloud Concepts, Architecture and Design
A company is ending its contract with a cloud storage provider and must make sure its data cannot be recovered. It has no physical access to the provider's disks. Which sanitization method is the most practical?
- A. Degaussing the provider's hard drives
- B. Renaming the storage buckets before closing the account
- C. Cryptographic erase by destroying the encryption keys ✔ correct
- D. Reformatting the virtual machines that used the storage
Answer: C. Cryptographic erase destroys the keys that protect encrypted data, making the data unreadable. NIST SP 800-88r2 notes that for logical or virtual storage such as cloud storage, it may be the only viable purge option because the customer cannot reach the physical media.
Source: csrc.nist.gov/pubs/sp/800/88/r2/final · Domain: Cloud Data Security
An online shop replaces each stored card number with a random surrogate value. Only a secured central system can map the surrogate back to the real number. What is this technique called?
- A. Tokenization ✔ correct
- B. Hashing
- C. Data masking
- D. Compression
Answer: A. Tokenization replaces sensitive data such as a card number (PAN) with a surrogate value called a token; de-tokenization redeems the token for the original value through a protected data vault. A hash cannot be mapped back, and masking only hides part of a value.
Source: www.pcisecuritystandards.org/documents/Tokenization_Guidelines_Info_Supplement.p · Domain: Cloud Data Security
A business decides that after an outage it can lose at most the last 15 minutes of order data. Which recovery metric does this 15-minute limit define?
- A. Recovery time objective (RTO)
- B. Mean time between failures (MTBF)
- C. Maximum tolerable downtime (MTD)
- D. Recovery point objective (RPO) ✔ correct
Answer: D. The RPO is the point in time to which data must be recovered, so it sets how much recent data may be lost and drives backup or replication frequency. The RTO is how long recovery may take, which is a different question.
Source: csrc.nist.gov/glossary/term/recovery_point_objective · Domain: Cloud Platform & Infrastructure Security
During threat modeling with STRIDE, a team notes that a user could perform an action in the cloud application and later deny it, because the action is not logged. Which STRIDE category is this?
- A. Spoofing
- B. Repudiation ✔ correct
- C. Tampering
- D. Elevation of privilege
Answer: B. Repudiation threats are about users denying actions when the system cannot prove otherwise; logging and non-repudiation controls counter them. Tampering is malicious modification of data, and spoofing is using someone else's identity.
Source: learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats · Domain: Cloud Application Security
Static application security testing (SAST) analyzes source code or compiled code for security flaws without needing to run the application.
- A. True ✔ correct
- B. False
Answer: A. True. SAST tools inspect source or compiled code to find flaws such as injection or buffer overflows early in development. Dynamic testing (DAST), by contrast, tests the running application from the outside.
Source: owasp.org/www-community/Source_Code_Analysis_Tools · Domain: Cloud Application Security
A security operations team wants to collect logs from cloud workloads, identity services and firewalls in one place so it can correlate events and spot incidents. Which tool is designed for this?
- A. A web application firewall (WAF)
- B. A hardware security module (HSM)
- C. A security information and event management (SIEM) system ✔ correct
- D. A cloud access security broker (CASB) in API mode
Answer: C. NIST SP 800-92 describes SIEM software as centralized logging software: it collects logs from many sources, stores them and analyzes them, including correlating entries from multiple logs that relate to the same event. A WAF filters web traffic, an HSM protects cryptographic keys and a CASB governs the use of cloud services.
Source: csrc.nist.gov/pubs/sp/800/92/final · Domain: Cloud Security Operations
A customer cannot audit its cloud provider's data centers directly but needs independent assurance about the provider's security and availability controls. What should it ask the provider for?
- A. A SOC 2 report from a CPA's examination of the provider's controls ✔ correct
- B. The provider's marketing white paper about its security features
- C. A copy of the provider's internal firewall rule base
- D. A signed statement from the provider's sales team
Answer: A. A SOC 2 report is a CPA's examination of a service organization's controls relevant to security, availability, processing integrity, confidentiality and privacy. It gives customers assurance when a direct audit is not possible.
Source: www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2 · Domain: Legal, Risk and Compliance
Under EU data protection rules, personal data transferred from the EU to a country outside the European Economic Area must stay protected, for example through an adequacy decision or standard contractual clauses.
- A. True ✔ correct
- B. False
Answer: A. True. EU rules require that protection travels with the data. Transfer tools include adequacy decisions, standard contractual clauses, binding corporate rules and other mechanisms, which matters when choosing cloud regions.
Source: commission.europa.eu/law/law-topic/data-protection/international-dimension-data- · Domain: Legal, Risk and Compliance
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public ISC2 exam objectives (CCSP Certification Exam Outline effective 2026-08-01 (EXAMS-CCSP-Exam-Outline-English-01-2026-V2)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by ISC2; exam names are trademarks of their owners. Official exam page: www.isc2.org/certifications/ccsp/ccsp-certification-exam-outline.