CCSP domain - 17% of the exam

Cloud Platform and Infrastructure Security

Cloud Platform and Infrastructure Security is 17% of the ISC2 Certified Cloud Security Professional (CCSP) exam. These are the objectives it covers, each with practice questions, with every answer explained.

Objectives in this domain

Sample question from this domain

Free sampleCloud Platform and Infrastructure Securitymedium

In cloud infrastructure, which statement most accurately describes the management plane and why it is treated as a high-value target?

  • AIt is the aggregation of physical network switches and routers that carry east-west traffic between virtual machines within a single host.
  • BIt is the set of orchestration and administrative interfaces used to provision, configure and control the underlying compute, storage and network resources. Correct
  • CIt is the tenant-facing application layer where end users authenticate and consume the running workloads deployed on top of the platform.
  • DIt is the encrypted data-at-rest tier where tenant volumes and object stores are persisted across availability zones.
Identify the management plane as the orchestration and control layer whose compromise yields broad authority over cloud resources. The management plane exposes the administrative and orchestration APIs and consoles that create, configure and destroy compute, storage and network resources, so control of it means control of the entire environment, which is precisely why it is guarded so heavily.

Why A is wrong: This describes elements of the underlying physical network fabric, not the management plane; the fabric moves workload traffic but does not orchestrate provisioning or configuration.

Why B is correct: The management plane provides the administrative and orchestration control over the whole environment, so compromise of it grants broad authority over provisioning and configuration, making it a prime target.

Why C is wrong: This describes the application or workload layer that consumers interact with, whereas the management plane sits beneath it and controls the resources rather than serving the application to users.

Why D is wrong: This describes storage services, not the control interface; the management plane can configure storage but is not itself the persistence tier.

Other domains in this exam

See also the CCSP cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.