ISC2 Certified Cloud Security Professional (CCSP) practice questions

A cloud team must let a downstream analytics service keep processing customer card numbers in the same fixed length and character layout, while ensuring the stored values can be swapped back to the originals only by an authorised service holding a mapping. Which technique meets this requirement?

• ATokenisation that replaces each card number with a surrogate of the same length and format, resolvable only through a protected token vaultcheck_circle Correct
• BFormat-preserving encryption applied with a shared symmetric key printed in the application configuration
• COne-way salted hashing of each card number before it is written to the analytics store
• DStatic data masking that overwrites the middle digits with a fixed character while leaving the last four visible

Why A is correct: Tokenisation substitutes a format-matching surrogate that carries no mathematical relationship to the original, and only the vault holding the mapping can reverse it, satisfying both the format and controlled-reversal requirements.

Why B is wrong: Format-preserving encryption does keep the layout and is reversible, but storing the key in plaintext application config defeats the protection, so this is the weaker choice the requirement does not describe.

Why C is wrong: Hashing preserves neither the format in a useful way nor reversibility, so the originals could never be recovered, which contradicts the stated need to swap values back.

Why D is wrong: Masking is deliberately irreversible for the masked characters, so although it preserves the display format it cannot be swapped back to the original value as required.

A cloud provider allows tenants to view and adjust their allocated storage and compute through a self-service portal at any time, without contacting a sales or support representative. Which essential characteristic of cloud computing does this describe?

• ABroad network access, where capabilities are available over the network and reached through standard client platforms such as browsers and mobile devices
• BMeasured service, where resource use is monitored, controlled, and reported to give transparency for both the provider and the consumer
• COn-demand self-service, where a consumer can provision computing capabilities unilaterally as needed without human interaction with the providercheck_circle Correct
• DRapid elasticity, where capabilities can be scaled outward and inward automatically to match demand and appear effectively unlimited

Why A is wrong: Broad network access concerns reachability across varied devices; it is tempting because a portal runs over the network, but the scenario stresses provisioning without staff, not device reach.

Why B is wrong: Measured service covers metering and billing transparency; the tenant does see usage, but the defining point here is unattended self-provisioning, not metering.

Why C is correct: The portal lets the tenant provision and adjust resources unilaterally with no provider staff involved, which is exactly the on-demand self-service characteristic in the NIST definition.

Why D is wrong: Rapid elasticity is about automatic scaling to demand; a candidate may confuse manual portal adjustment with elasticity, but the scenario describes human-initiated self-service rather than automatic scaling.

In cloud infrastructure, which statement most accurately describes the management plane and why it is treated as a high-value target?

• AIt is the aggregation of physical network switches and routers that carry east-west traffic between virtual machines within a single host.
• BIt is the set of orchestration and administrative interfaces used to provision, configure and control the underlying compute, storage and network resources.check_circle Correct
• CIt is the tenant-facing application layer where end users authenticate and consume the running workloads deployed on top of the platform.
• DIt is the encrypted data-at-rest tier where tenant volumes and object stores are persisted across availability zones.

Why A is wrong: This describes elements of the underlying physical network fabric, not the management plane; the fabric moves workload traffic but does not orchestrate provisioning or configuration.

Why B is correct: The management plane provides the administrative and orchestration control over the whole environment, so compromise of it grants broad authority over provisioning and configuration, making it a prime target.

Why C is wrong: This describes the application or workload layer that consumers interact with, whereas the management plane sits beneath it and controls the resources rather than serving the application to users.

Why D is wrong: This describes storage services, not the control interface; the management plane can configure storage but is not itself the persistence tier.