CCSP - Cloud Concepts, Architecture and Design (17% of the exam) - Section 1.4
Understand design principles of secure cloud computing.
Cloud secure data lifecycle, business continuity and disaster recovery planning, cost-benefit analysis, functional security requirements such as portability and vendor lock-in, and DevOps security.
cloud secure data lifecyclebusiness continuity and disaster recovery planningvendor lock-in and portabilityinteroperabilityDevSecOps
Practice question for this objective
lock_openFree sampleCloud Concepts, Architecture and Designmedium
A cloud architect is documenting the secure data lifecycle for a new workload. During which phase are controls such as encryption, tokenisation, and data classification labelling first applied to newly generated records?
AThe Create phase, when the data first comes into existence or is significantly modifiedcheck_circle Correct
BThe Store phase, when records are committed to persistent storage such as object or block volumes
CThe Use phase, when applications and users read and process the data in memory
DThe Share phase, when the data is exchanged with external parties or other systems
Recognise that data classification and protective controls in the cloud secure data lifecycle are established during the Create phase. The cloud secure data lifecycle runs Create, Store, Use, Share, Archive, Destroy. Classification assigned at Create determines the encryption, tokenisation, and handling controls applied through every subsequent phase, so setting it late leaves data unprotected.
Why A is correct: Create is where data originates or is materially changed, so classification and the resulting protective controls must be set here to govern every later phase.
Why B is wrong: Storage-layer protections do apply during Store, but classification and protective controls are decided at creation; treating Store as the first point leaves data unprotected in transit to storage.
Why C is wrong: Use is tempting because protections are exercised when data is accessed, but applying classification only at Use ignores data created and stored beforehand.
Why D is wrong: Share requires controls like rights management, but it is late in the lifecycle; deferring classification to Share leaves earlier phases ungoverned.
Exam traps in Cloud Concepts, Architecture and Design
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
The 15 minutes is the recovery time objective and the 2 hours is the recovery point objective
errorWhy it is wrong: This reverses the two metrics; a candidate who confuses which figure measures data loss versus restoration time will pick it, but RPO is the data-loss figure, not the time-to-restore.
The ability of components from different providers to exchange information and function together through common interfaces
errorWhy it is wrong: This describes interoperability, which is easily confused with portability, but it concerns systems working together rather than moving a workload elsewhere.
Design for interoperability so the system can exchange data with the provider's native monitoring services in real time
errorWhy it is wrong: Interoperability concerns systems working together and exchanging data, which is valuable but does not address the ability to relocate the whole workload to a different provider.