CCSP - Cloud Concepts, Architecture and Design (17% of the exam) - Section 1.3
Understand security concepts relevant to cloud computing.
Cryptography and key management, access control, data and media sanitisation, network security, virtualisation security, common threats, and security hygiene applied to a cloud context.
cryptography and key managementidentity and access controldata and media sanitisationvirtualisation securitycommon cloud threats
Practice question for this objective
lock_openFree sampleCloud Concepts, Architecture and Designmedium
A national charity adopts a public SaaS customer-relationship platform to hold donor records classified as personal data. The provider controls the application, the operating system and the infrastructure. Leadership asks the security lead which safeguard the charity can still directly implement to reduce the risk of unauthorised access to donor records. Which measure is within the customer's control in this SaaS model?
ARewriting the application's authentication module to enforce stronger password hashing algorithms
BConfiguring user access, roles and multi-factor authentication within the platform's administration settingscheck_circle Correct
CApplying security patches to the operating system that runs beneath the SaaS application
DSegmenting the provider's internal network to isolate the multi-tenant database from other tenants
In SaaS the customer's residual control is largely limited to data governance and identity and access management within the platform's settings. SaaS pushes the abstraction line to the top, leaving the customer with configuration of its own users, roles and access policies plus data governance. Managing identities and MFA is the practical control the tenant retains.
Why A is wrong: The SaaS provider owns the application code, so the customer cannot rewrite its authentication module; this control sits beyond the customer boundary.
Why B is correct: Identity and access management, including role assignment and MFA configuration, is exposed to the SaaS tenant as an administrative control, making it the customer's most direct lever over access risk.
Why C is wrong: OS patching is the provider's responsibility in SaaS; the customer has no access to the underlying operating system, so it cannot own this task.
Why D is wrong: Tenant isolation and internal network segmentation are architected and operated by the provider in SaaS, so this is outside the charity's control despite sounding protective.
Exam traps in Cloud Concepts, Architecture and Design
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Provider-managed keys give the customer cryptographic assurance that the provider can never technically access the plaintext
errorWhy it is wrong: This is tempting because managed encryption is convenient, but when the provider manages the keys it retains the technical means to decrypt, so it does not deliver that assurance.
Degaussing the drives to disrupt the magnetic domains that hold the stored data
errorWhy it is wrong: Degaussing is a valid media sanitisation method, but it requires physical access to provider-owned hardware and is ineffective against solid-state media, so it does not fit a multi-tenant cloud constraint.
Encrypt the database volumes using the provider's managed encryption service with provider-held keys.
errorWhy it is wrong: Provider-managed keys are convenient and protect against physical media theft, but the provider holds the key material, so its staff or a legal order served on it could still yield plaintext, which is exactly what the policy forbids.