CCSP Practice Questions

Correct answer: B. Measured service

NIST SP 800-145 lists five essential characteristics. Measured service is the one that makes usage transparent to both provider and customer — and therefore billable and chargeable.

• A (incorrect)Elasticity is about scaling capacity up and down quickly, not about metering what was used.
• B (correct)Correct. Resource usage is monitored, controlled and reported, which is the basis for chargeback and pay-per-use billing.
• C (incorrect)Pooling describes the provider serving many tenants from shared resources; it does not by itself report consumption per consumer.
• D (incorrect)This describes access over the network from many client types, not usage reporting.

Reference: NIST SP 800-145, The NIST Definition of Cloud Computing (opens in a new tab)

Correct answer: C. Securing the application code and configuring access to its data

The further up the stack a service goes (IaaS → PaaS → SaaS), the more the provider manages. In PaaS, the customer's responsibility shrinks to the application, its configuration, access management and the data.

• A (incorrect)In PaaS the provider manages the operating system, so patching it is the provider's job.
• B (incorrect)Physical security is always the provider's responsibility in public cloud service models.
• C (correct)Correct. In PaaS the customer still owns the application, its configuration, its identities and the data it processes.
• D (incorrect)The virtualization layer is part of the provider's infrastructure in every public cloud service model.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Recovery point objective (RPO)

RPO answers 'how much data can we lose?' and drives backup and replication frequency. RTO answers 'how fast must we be back?' and drives the recovery architecture.

• A (incorrect)RTO is the target time to restore the service, not the amount of data that may be lost.
• B (correct)Correct. RPO is the maximum tolerable data loss, expressed as a point in time before the incident.
• C (incorrect)MTD is how long the business function can be unavailable before the damage becomes unacceptable.
• D (incorrect)An SLA is a contractual commitment; it may contain RPO/RTO values but is not itself the metric.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: A. Validating the training data before each retraining, for example against a trusted baseline with review of unexpected drift

When a model learns from data an attacker can influence, the training data becomes an attack surface. Data source validation, baselining and human review of drift are the relevant controls.

• A (correct)Correct. This is a training-data poisoning attack; checking what goes into the training set addresses the root cause.
• B (incorrect)Encryption at rest protects the confidentiality of the stored model file, but the poisoned data arrives through the legitimate training pipeline.
• C (incorrect)MFA protects analyst accounts; the attacker never needs analyst access to influence the telemetry.
• D (incorrect)A larger model learns the poisoned pattern just as well; capacity is not a security control.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: A. Create

Classification drives everything downstream — encryption, access, retention, deletion. The earliest point, creation, is therefore the right one.

• A (correct)Correct. Classifying data when it is created or first acquired means the right controls can follow it through every later phase.
• B (incorrect)Storage controls depend on the classification, so classification should already exist when data is stored.
• C (incorrect)By the time data is shared, a missing classification may already have led to the wrong controls.
• D (incorrect)Archiving relies on the classification for retention decisions; it is far too late to classify then.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: C. Tokenization

The key phrases are 'no mathematical relationship' and 'separate store to look up the original'. That is the definition of tokenization with a token vault.

• A (incorrect)A hash is mathematically derived from the original and cannot be reversed to look up the original value.
• B (incorrect)The ciphertext is mathematically derived from the original using a key — exactly what the requirement excludes.
• C (correct)Correct. In vault-based tokenization, tokens are random substitutes and the mapping to the original lives only in a separate, secured token vault.
• D (incorrect)Masking replaces or hides values permanently; there is no secured store to look up the original.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Cryptographic erasure — destroying the keys used to encrypt the data

In the cloud, crypto-shredding is the practical sanitisation method. It only works if all copies of the data were encrypted from the start and every copy of the key can be verifiably destroyed, which is easiest when the customer controls the keys.

• A (incorrect)The customer has no physical access to multi-tenant media, and degaussing does not work on SSDs anyway.
• B (correct)Correct. If all copies were encrypted and every copy of the key is destroyed, the remaining ciphertext is unreadable.
• C (incorrect)A logical delete may leave recoverable data remnants on the underlying storage.
• D (incorrect)On virtualised, distributed storage the customer cannot verify that every physical copy and block was overwritten.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Suspend deletion for the data in scope of the hold until Legal releases it

Retention policies must provide a way to exempt data from deletion when a legal hold applies — and to release it again when the hold ends.

• A (incorrect)Deleting data under a legal hold can amount to destruction of evidence; the hold takes precedence.
• B (correct)Correct. A legal hold overrides normal retention and deletion for the data it covers.
• C (incorrect)Changing location is fine only if integrity and the chain of custody are preserved — deleting originals as part of a workaround risks both.
• D (incorrect)Backups may not exist or be complete, and intentional deletion would still breach the hold.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: A. They run directly on the hardware, so there is no general-purpose host operating system to attack

A Type 2 hypervisor runs as an application on a host OS, which adds that OS and everything running on it to the attack surface. A bare-metal Type 1 hypervisor avoids that layer.

• A (correct)Correct. Removing the host OS layer reduces the attack surface.
• B (incorrect)Memory encryption depends on specific hardware and configuration; it is not a property of Type 1 hypervisors as such.
• C (incorrect)Every hypervisor has vulnerabilities and must be patched.
• D (incorrect)Direct memory sharing between tenants would weaken isolation, not strengthen it.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: C. Tier III

The key words are 'planned maintenance without affecting operations' — concurrent maintainability, which is Tier III. Fault tolerance would point to Tier IV.

• A (incorrect)Tier I is basic capacity without redundant components; maintenance usually requires a shutdown.
• B (incorrect)Tier II adds redundant capacity components, but the distribution path is not concurrently maintainable.
• C (correct)Correct. Tier III is defined as concurrently maintainable.
• D (incorrect)Tier IV adds fault tolerance, which goes beyond what the requirement asks for.

Reference: Uptime Institute — Tier Classification System (opens in a new tab)

Correct answer: C. Risk mitigation

Adding redundancy is a classic mitigation: the risk still exists, but its likelihood of causing an outage or its impact is reduced.

• A (incorrect)Transfer shifts the financial impact to a third party, for example through insurance or contract terms.
• B (incorrect)Avoidance would mean not running the workload in that environment at all.
• C (correct)Correct. The company adds a control that reduces the impact of the risk.
• D (incorrect)Acceptance would mean taking no further action and living with the risk.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Parallel test

Parallel tests give real evidence that the recovery site works without putting production at risk. Full interruption tests give the strongest evidence but carry real business risk.

• A (incorrect)A tabletop walks through the plan in discussion; no systems are actually brought up.
• B (correct)Correct. Recovery systems are activated and run alongside production, which is not interrupted.
• C (incorrect)Here production is actually shut down and operations move to the recovery site — the most disruptive option.
• D (incorrect)A checklist review only verifies that the plan's contents and contact details are complete and current.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: C. Repudiation

Repudiation threats are countered with non-repudiation controls: reliable, tamper-evident audit logs and, where needed, digital signatures.

• A (incorrect)Spoofing is pretending to be someone else, for example with stolen credentials.
• B (incorrect)Tampering is unauthorised modification of data or code.
• C (correct)Correct. Repudiation is the ability to deny an action because there is no reliable evidence of it.
• D (incorrect)Information disclosure means exposing data to people who should not see it.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Software composition analysis (SCA)

Third-party and open-source components are part of the software supply chain. SCA — ideally together with a software bill of materials — makes that supply chain visible.

• A (incorrect)SAST analyses your own source code for insecure patterns; it is not designed to inventory third-party libraries against vulnerability databases.
• B (correct)Correct. SCA inventories dependencies and matches them against known vulnerabilities and licence data.
• C (incorrect)DAST tests the running application from the outside and cannot reliably name the vulnerable library version.
• D (incorrect)Fuzzing feeds unexpected input to find unknown flaws; it does not check dependencies against known vulnerabilities.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Service provider (relying party)

In federated identity, the identity provider authenticates and asserts; the service provider (relying party) trusts the assertion and authorises access.

• A (incorrect)The identity provider is the company system that authenticates users and issues assertions.
• B (correct)Correct. The SaaS application relies on assertions from the identity provider instead of authenticating users itself.
• C (incorrect)A CASB sits between users and cloud services to enforce policy; it is not a party in the SAML trust relationship described.
• D (incorrect)A certificate authority issues certificates; it does not consume authentication assertions.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: C. Abuse case testing

Abuse (or misuse) cases describe how features can be used against the business. They complement functional tests, which only prove that the feature works as intended.

• A (incorrect)Regression testing checks that existing functionality still works after a change.
• B (incorrect)Load testing measures performance under volume; the goal here is misuse, not performance.
• C (correct)Correct. The tester deliberately misuses a legitimate feature to see whether business rules can be bypassed.
• D (incorrect)Unit tests check individual functions in isolation, usually written by developers for expected behaviour.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Problem management

Incidents are about restoring service; problems are about the cause. Recurring incidents are the typical trigger for a problem record.

• A (incorrect)Incident management restores service as quickly as possible; it did that each time.
• B (correct)Correct. Problem management identifies and removes the underlying root cause of recurring incidents.
• C (incorrect)Release management plans and controls the rollout of releases.
• D (incorrect)Capacity management ensures there are enough resources; it may contribute, but finding the root cause is problem management.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Capture memory and a disk snapshot, and record hashes of what was collected

Collect in order of volatility and document everything. In IaaS, memory capture and snapshots are the customer's main tools, ideally alongside isolating the instance's network access. Anything at or below the hypervisor depends on the provider.

• A (incorrect)Terminating the instance destroys volatile evidence and possibly the disk.
• B (correct)Correct. This preserves volatile and persistent evidence and supports the chain of custody.
• C (incorrect)A reboot wipes memory contents, which often hold the most valuable evidence.
• D (incorrect)Restoring overwrites the evidence before it has been collected.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. Review the provider's penetration testing policy and obtain any approvals it requires

In the cloud you test your own resources within the provider's rules. Ignoring them can breach the contract and, in the worst case, affect other customers.

• A (incorrect)Even scans may be restricted by the provider's terms; check the rules before testing anything.
• B (correct)Correct. The provider's terms define what may be tested, how, and whether notification or approval is needed.
• C (incorrect)Testing the provider's shared infrastructure is normally prohibited and could affect other tenants.
• D (incorrect)Customers cannot identify co-tenants, and testing must not target them in the first place.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. The customer, as the controller

Communication duties follow data roles. That is why contracts with cloud providers must define how and how quickly the provider reports incidents to the customer.

• A (incorrect)As a processor, the provider must inform the controller without undue delay — the notification to the authority is the controller's duty.
• B (correct)Correct. Under GDPR Article 33, the controller notifies the supervisory authority; the processor must inform the controller.
• C (incorrect)GDPR obligations can apply regardless of where the data is stored.
• D (incorrect)Data subjects must be informed by the controller when the breach is likely to result in a high risk (Article 34), but they do not notify the authority.

Reference: GDPR, Articles 33 and 34 (opens in a new tab)

Correct answer: C. SOC 2 Type II

Two questions decide the report: what is covered (SOC 1 financial reporting, SOC 2 trust services criteria such as security) and when (Type I a point in time, Type II a period).

• A (incorrect)SOC 1 covers controls relevant to financial reporting, and Type I only looks at one point in time.
• B (incorrect)Type I assesses the design of controls at a single point in time, not their operation over a period.
• C (correct)Correct. SOC 2 covers security-related trust services criteria, and Type II tests operating effectiveness over a period.
• D (incorrect)A SOC 3 is a short general-use summary without the detailed test results.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. The retailer is the controller and the CRM provider is the processor

Accountability stays with the controller even when processing is outsourced. That is why the contract (a data processing agreement) and the provider's assurance reports matter.

• A (incorrect)The roles are reversed: the party that decides purposes and means is the controller.
• B (correct)Correct. The retailer decides why and how the data is processed; the provider processes it on the retailer's behalf.
• C (incorrect)Joint control requires both to determine purposes and means together, which is not the case here.
• D (incorrect)Data subjects are the individuals the data is about — here, the retailer's customers.

Reference: GDPR, Article 4 (definitions) and Article 28 (opens in a new tab)

Correct answer: D. ISO/IEC 27050

Several 270xx standards appear in cloud security work. Knowing which one covers what — 27017 cloud controls, 27018 PII in public cloud, 27037 evidence handling, 27050 eDiscovery — helps you pick the right standard in a scenario.

• A (incorrect)ISO/IEC 27017 gives information security controls for cloud services.
• B (incorrect)ISO/IEC 27018 covers the protection of personally identifiable information in public clouds.
• C (incorrect)ISO/IEC 27037 covers identifying, collecting, acquiring and preserving digital evidence — related, but not eDiscovery.
• D (correct)Correct. The ISO/IEC 27050 series addresses electronic discovery.

Reference: ISC2 CCSP exam outline (opens in a new tab)

Correct answer: B. The customer should obtain other assurance for the IaaS provider, such as that provider's own report

Always read the scope section of an audit report. Carved-out subservice organisations and complementary user entity controls show where your own assurance work starts.

• A (incorrect)That describes the inclusive method. With carve-out, the subservice organisation's controls are excluded.
• B (correct)Correct. The carved-out controls are outside the auditor's opinion, so the customer needs separate assurance for them.
• C (incorrect)Carve-out is a recognised and common method; it limits the scope but does not invalidate the report.
• D (incorrect)The controls exist; they simply were not tested in this report.

Reference: ISC2 CCSP exam outline (opens in a new tab)