Examworthy
Open the appSign inStart free

CCSP domain - 17% of the exam

Cloud Security Operations

Cloud Security Operations is 17% of the CCSP exam. These are the objectives it covers, each with practice questions, with every answer explained.

The domain in numbers

47
Practice questions
6
Objectives
7
Easy
33
Medium
7
Hard

Where people go wrong

  • Confusing the TPM and the HSM

    The wrong answers swap the two hardware roots of trust. Boot integrity measurement and attestation are credited to an HSM, and high-volume shared network cryptography for tenants is credited to a TPM. A TPM sits in the host, records firmware and bootloader measurements in platform configuration registers, and can seal disk keys to a known-good boot state. An HSM is the tamper-resistant boundary where keys are generated, stored and used, exposed to tenants through a network cryptographic API.

    See it in a sample question

  • Substituting a scan or a log for baseline drift monitoring

    The wrong answers reach for a control that sounds close to baseline monitoring. A one-time provisioning scan, network intrusion detection and immutable audit logs are each offered where ongoing drift detection is needed, and vulnerability scanning is confused with it. A hardening baseline is the approved secure configuration standard. Baseline compliance monitoring repeatedly evaluates live hosts against it and flags drift, whereas a provisioning scan checks one point in time, logs support later review, and vulnerability scanning matches versions against published advisories.

    See it in a sample question

  • Handing one ITIL process the job of its neighbour

    Incident management is offered as the owner of a recurring fault, root-cause analysis and implementation are offered as the advisory board's duty, and release, capacity or incident management is offered as the keeper of the baseline record. Incident management restores service as quickly as possible. Problem management investigates the cause behind recurring incidents. A change advisory board assesses risk and authorises a change before implementation. Configuration management maintains the configuration management database of items and their approved baselines.

    See it in a sample question

  • Offering encryption or compression for integrity

    Encryption and compression are offered wherever integrity is needed. Hashing is described as encryption, encryption is offered to maintain chain of custody, and encryption at rest is offered to protect stored logs. Encryption protects confidentiality, and compression saves space. Integrity comes from a cryptographic hash compared at acquisition and again before analysis, from a hash verified at every documented handover, and from write-once, tamper-evident storage for logs.

    See it in a sample question

  • Matching the wrong standard to the subject

    The wrong answers pick a neighbouring standard because it is cloud-related. Asked for a certifiable service management standard covering incident, problem, change and configuration management, they offer ISO/IEC 27017, ISO/IEC 27018 or NIST SP 800-145. ISO/IEC 27017 gives cloud-specific security control guidance, ISO/IEC 27018 covers protection of PII in public clouds, and NIST SP 800-145 only defines cloud computing terms and models. ISO/IEC 20000-1 is the certifiable requirements standard for a service management system.

    See it in a sample question

Objectives in this domain

What to study

The official documents this domain's practice questions cite most.

  • ISO/IEC 27017 cloud security controlscited by 9 questions
  • ISO/IEC 27037 guidelines for identificationcited by 4 questions
  • CSA Cloud Controls Matrixcited by 3 questions
  • ISO/IEC 20000-1 service management systemcited by 3 questions
  • ISO/IEC 27050 electronic discoverycited by 2 questions
  • ISO/IEC 20000-1 service management system requirementscited by 1 question
  • ISO/IEC 27017cited by 1 question
  • ISO/IEC 27018 PII in public cloudscited by 1 question

Sample questions from this domain

Free sampleCloud Security Operationsmedium

A cloud provider offers a dedicated tamper-resistant appliance that generates, stores, and performs cryptographic operations with keys that never leave the device in plaintext, exposing them to tenants through a network cryptographic API. Which statement most accurately describes the primary purpose of a hardware security module (HSM) in this cloud infrastructure?

  • AIt measures the integrity of firmware and boot components during startup so a host can attest to its trusted state before joining a cluster.
  • BIt records signed transaction logs in an append-only ledger so that key usage can be audited by an independent third party later.
  • CIt accelerates bulk symmetric encryption of stored objects so that data-at-rest throughput matches the underlying storage bandwidth.
  • DIt provides a certified boundary for key generation, storage, and use so that private keys are never exposed outside the hardened device. Correct
Identify that an HSM's primary purpose is a tamper-resistant boundary for key generation, storage, and use where keys are never exported in plaintext. An HSM is a validated hardware boundary in which cryptographic keys are generated and exercised so that private key material is never exposed outside the device, which is what separates it from software key stores and from a TPM.

Why A is wrong: Boot integrity measurement and attestation describe a trusted platform module (TPM), not an HSM, so this confuses two distinct hardware roots of trust.

Why B is wrong: Tamper-evident logging is a useful control an HSM may support, but it is not the primary purpose; the core function is protecting keys during generation and use.

Why C is wrong: Some HSMs offer crypto acceleration, but bulk data-at-rest encryption is normally done in software; performance is a side benefit, not the defining purpose.

Why D is correct: This is the defining role of an HSM: a validated, tamper-resistant boundary within which keys are created and used without ever being exported in the clear.

Free sampleCloud Security Operationsmedium

During infrastructure maintenance, an engineer must distinguish baseline compliance monitoring from vulnerability scanning, because leadership keeps conflating the two. Which statement correctly describes what baseline compliance monitoring verifies?

  • AThat installed software has no known exploitable weaknesses, by matching component versions against a catalogue of published advisories.
  • BThat deployed systems still match an approved secure configuration standard, flagging drift from the hardened baseline over time. Correct
  • CThat running workloads behave within expected performance thresholds, alerting operators when latency or throughput degrades.
  • DThat access to systems is limited to authorised identities, by reconciling active sessions against the approved user directory.
Distinguish baseline compliance monitoring, which detects configuration drift from an approved standard, from vulnerability scanning. Baseline compliance monitoring continuously compares a system's actual configuration against an approved hardened standard and reports drift, whereas vulnerability scanning enumerates known weaknesses by version; the two answer different questions and are easily confused.

Why A is wrong: Matching versions against published advisories describes vulnerability scanning; it detects known weaknesses, not deviation from an approved configuration standard.

Why B is correct: Correct: baseline compliance monitoring checks live systems against an approved configuration standard and reports configuration drift, which is its defining purpose.

Why C is wrong: Performance thresholds are the domain of availability and performance monitoring, not configuration compliance against a hardened baseline.

Why D is wrong: Reconciling sessions against a directory is an access-review activity; it is unrelated to verifying that system configuration still matches the secure baseline.

Free sampleCloud Security Operationsmedium

A fintech runs a customer portal on public-cloud PaaS with data classified as confidential. Its security operations team wants an authoritative, continuously maintained record of every deployed component, its approved baseline, and the relationships between components, so that unauthorised drift can be detected. Which operational practice most directly delivers this?

  • ARelease management, coordinating the packaging and deployment of new versions into production
  • BIncident management, logging deviations from expected behaviour as they are reported by users
  • CCapacity management, tracking resource consumption against provisioned platform limits
  • DConfiguration management, maintaining a configuration management database of items and their approved baselines Correct
Identify configuration management as the practice that maintains authoritative baselines and relationships to detect unauthorised drift. Configuration management records configuration items, their approved baselines and interdependencies in a CMDB; comparing the live estate against those baselines is what surfaces unauthorised drift, a capability the other practices do not provide.

Why A is wrong: Release management moves versions into production and is tempting because deployments create configuration items, but it does not itself hold the authoritative baseline record used to spot drift.

Why B is wrong: Incident management reacts to reported service disruptions; it captures symptoms after the fact rather than maintaining the baseline needed to identify configuration drift proactively.

Why C is wrong: Capacity management ensures resources meet demand and involves monitoring, but it tracks utilisation rather than the approved configuration state of components.

Why D is correct: Configuration management maintains the authoritative record of configuration items, their baselines and relationships, which is exactly what is needed to detect drift from the approved state.

Free sampleCloud Security Operationshard

A forensic examiner acquires a disk image from a customer-managed volume in a public cloud and computes a cryptographic hash of the image immediately after acquisition, then again before analysis. What is the primary forensic purpose of comparing these two hash values?

  • ATo encrypt the disk image so that only authorised investigators can open and read its contents
  • BTo compress the disk image so that it can be transferred out of the cloud region more quickly
  • CTo anonymise any personal data on the volume before the image is shared with opposing counsel
  • DTo demonstrate that the image has not been altered between acquisition and analysis, supporting evidential integrity Correct
Understand that matching acquisition and pre-analysis hashes proves a forensic image was not altered. A cryptographic hash yields a fixed digest that changes if even one bit of the image differs, so an identical digest at two points in time demonstrates the evidence was preserved unaltered; this integrity check is distinct from encryption, compression or anonymisation.

Why A is wrong: Hashing is a one-way integrity function, not encryption; confusing hashing with encryption is a classic error, and a hash provides no confidentiality.

Why B is wrong: Hashes produce a fixed-length digest and do not reduce or reconstruct the source data, so they cannot compress an image for transfer.

Why C is wrong: Hashing a whole image does not selectively remove or mask personal fields, so it does not anonymise data; this confuses integrity hashing with data de-identification.

Why D is correct: Correct: matching hashes taken at acquisition and before analysis show the bitstream is unchanged, which is how integrity of the evidence is proven.

Free sampleCloud Security Operationsmedium

An auditor asks a cloud provider which internationally recognised standard specifies the requirements for establishing, operating, and continually improving a service management system covering processes such as incident, problem, change, and configuration management. Which standard is being described?

  • AISO/IEC 27017, the code of practice for information security controls for cloud services
  • BISO/IEC 27018, the code of practice for protecting personally identifiable information in public clouds
  • CNIST SP 800-145, the definition of essential characteristics and models of cloud computing
  • DISO/IEC 20000-1, the requirements standard for a service management system Correct
Match the requirements for a service management system to ISO/IEC 20000-1 rather than to security or definitional standards. ISO/IEC 20000-1 is the certifiable requirements standard for a service management system and directly frames incident, problem, change, and configuration management; the distractors are real standards addressing cloud security controls, PII, and cloud definitions, none of which specify service management requirements.

Why A is wrong: ISO/IEC 27017 is tempting because it is cloud-specific, but it addresses information security controls, not service management system requirements.

Why B is wrong: ISO/IEC 27018 concerns PII protection in public cloud processing, not the operation of a service management system.

Why C is wrong: NIST SP 800-145 only defines cloud computing terms and models; it specifies no service management processes.

Why D is correct: ISO/IEC 20000-1 is the certifiable standard defining service management system requirements, including the named operational processes.

Other domains in this exam

See also the CCSP cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.