Free CCSP practice questions

A cloud team must let a downstream analytics service keep processing customer card numbers in the same fixed length and character layout, while ensuring the stored values can be swapped back to the originals only by an authorised service holding a mapping. Which technique meets this requirement?

• ATokenisation that replaces each card number with a surrogate of the same length and format, resolvable only through a protected token vaultcheck_circle Correct
• BFormat-preserving encryption applied with a shared symmetric key printed in the application configuration
• COne-way salted hashing of each card number before it is written to the analytics store
• DStatic data masking that overwrites the middle digits with a fixed character while leaving the last four visible

Why A is correct: Tokenisation substitutes a format-matching surrogate that carries no mathematical relationship to the original, and only the vault holding the mapping can reverse it, satisfying both the format and controlled-reversal requirements.

Why B is wrong: Format-preserving encryption does keep the layout and is reversible, but storing the key in plaintext application config defeats the protection, so this is the weaker choice the requirement does not describe.

Why C is wrong: Hashing preserves neither the format in a useful way nor reversibility, so the originals could never be recovered, which contradicts the stated need to swap values back.

Why D is wrong: Masking is deliberately irreversible for the masked characters, so although it preserves the display format it cannot be swapped back to the original value as required.

An organisation wants to move a dataset outside the scope of data protection law by processing it so that no individual can be re-identified, even by combining it with other data the organisation holds. Which outcome distinguishes this approach from pseudonymisation?

• AAnonymisation encrypts the identifying fields with a customer-managed key, so the data can be restored by anyone holding that key
• BAnonymisation irreversibly removes the link to any individual, so the data is no longer personal data; pseudonymisation only replaces identifiers while a re-identification key still existscheck_circle Correct
• CAnonymisation replaces direct identifiers with consistent tokens so records can still be joined across datasets on the token
• DAnonymisation masks the data only in non-production copies while production retains the original values

Why A is wrong: This describes a reversible, key-based transformation, which is closer to encryption or pseudonymisation; genuine anonymisation leaves no key that can restore identity.

Why B is correct: True anonymisation destroys the ability to re-identify, taking the data out of scope, whereas pseudonymised data remains personal data because a separately held key can restore the link, which is the defining difference.

Why C is wrong: Consistent tokens that allow joining preserve a re-identification path through linkage, which is pseudonymisation, not anonymisation, so this fails the no-re-identification test.

Why D is wrong: Environment-specific masking of copies is a de-identification control for test data, not a property of anonymisation, and it leaves fully identifiable production data in scope.

A finance team wants a cloud provider to run aggregate calculations directly on encrypted salary figures and return an encrypted total, without the provider ever decrypting the individual values. Which technology is designed to make this possible?

• ATransparent data encryption on the database volume, so the figures are protected at rest
• BTokenisation of each salary figure before the provider performs the sum on the tokens
• CHomomorphic encryption, which permits defined computations on ciphertext and yields an encrypted result that decrypts to the correct answercheck_circle Correct
• DA hardware security module that stores the encryption keys separately from the data

Why A is wrong: Transparent data encryption protects data at rest but the engine decrypts values in memory before any computation, so the provider would still see cleartext during processing.

Why B is wrong: Tokens carry no arithmetic relationship to the originals, so summing them produces a meaningless result; tokenisation supports substitution, not computation on protected values.

Why C is correct: Homomorphic encryption is specifically constructed so that operations performed on ciphertext correspond to operations on the plaintext, letting the provider compute an encrypted total it can never read, which is exactly the requirement.

Why D is wrong: An HSM safeguards keys but does not let arithmetic run on ciphertext; the data would still have to be decrypted somewhere before the total could be computed.

A cloud provider allows tenants to view and adjust their allocated storage and compute through a self-service portal at any time, without contacting a sales or support representative. Which essential characteristic of cloud computing does this describe?

• ABroad network access, where capabilities are available over the network and reached through standard client platforms such as browsers and mobile devices
• BMeasured service, where resource use is monitored, controlled, and reported to give transparency for both the provider and the consumer
• COn-demand self-service, where a consumer can provision computing capabilities unilaterally as needed without human interaction with the providercheck_circle Correct
• DRapid elasticity, where capabilities can be scaled outward and inward automatically to match demand and appear effectively unlimited

Why A is wrong: Broad network access concerns reachability across varied devices; it is tempting because a portal runs over the network, but the scenario stresses provisioning without staff, not device reach.

Why B is wrong: Measured service covers metering and billing transparency; the tenant does see usage, but the defining point here is unattended self-provisioning, not metering.

Why C is correct: The portal lets the tenant provision and adjust resources unilaterally with no provider staff involved, which is exactly the on-demand self-service characteristic in the NIST definition.

Why D is wrong: Rapid elasticity is about automatic scaling to demand; a candidate may confuse manual portal adjustment with elasticity, but the scenario describes human-initiated self-service rather than automatic scaling.

Several unrelated tenants run workloads on the same physical servers of a public cloud provider, yet each tenant can see and manage only its own data and configuration. Which cloud property makes this shared-hardware, isolated-tenant arrangement possible?

• AResource pooling with multitenancy, where physical and virtual resources are shared among tenants who remain logically isolated from one anothercheck_circle Correct
• BBroad network access, where the pooled services are reachable from a wide range of standard client devices over the network
• CRapid elasticity, where capacity is added and removed quickly so the pool appears effectively unlimited to each tenant
• DMeasured service, where each tenant's consumption of the shared pool is metered and reported for billing

Why A is correct: Multitenancy on pooled resources is precisely what lets many tenants share physical hardware while each is logically separated and sees only its own environment.

Why B is wrong: Broad network access describes how services are reached, not how tenants share hardware while staying isolated, so it does not explain the arrangement.

Why C is wrong: Elasticity addresses scaling capacity up and down; a candidate may link shared capacity to elasticity, but it does not account for the tenant isolation described.

Why D is wrong: Measured service explains how usage is tracked and billed, which is tempting given shared resources, but it does not create the logical separation between tenants.

In cloud computing terminology, which party purchases and consumes cloud services under an agreement, while another organisation makes those services available? Identify the role that consumes the services.

• AThe cloud service provider, which makes the service available and is responsible for operating the underlying infrastructure
• BThe cloud service broker, which negotiates relationships and can aggregate or intermediate services between parties
• CThe cloud auditor, which conducts an independent examination of controls to give assurance over the service
• DThe cloud service customer, which maintains a business relationship with the provider to use the offered cloud servicescheck_circle Correct

Why A is wrong: The provider supplies the service rather than consuming it; the role names are easy to reverse, but the question asks specifically for the consuming party.

Why B is wrong: A broker intermediates or aggregates services and does not simply consume them; it is a plausible distractor because brokers sit between customer and provider.

Why C is wrong: An auditor assesses controls and reports on them rather than consuming the service, so it does not fit the consuming role even though it is a defined cloud role.

Why D is correct: The cloud service customer is the party that enters an agreement with the provider specifically to use and consume the cloud services, which matches the role described.

In cloud infrastructure, which statement most accurately describes the management plane and why it is treated as a high-value target?

• AIt is the aggregation of physical network switches and routers that carry east-west traffic between virtual machines within a single host.
• BIt is the set of orchestration and administrative interfaces used to provision, configure and control the underlying compute, storage and network resources.check_circle Correct
• CIt is the tenant-facing application layer where end users authenticate and consume the running workloads deployed on top of the platform.
• DIt is the encrypted data-at-rest tier where tenant volumes and object stores are persisted across availability zones.

Why A is wrong: This describes elements of the underlying physical network fabric, not the management plane; the fabric moves workload traffic but does not orchestrate provisioning or configuration.

Why B is correct: The management plane provides the administrative and orchestration control over the whole environment, so compromise of it grants broad authority over provisioning and configuration, making it a prime target.

Why C is wrong: This describes the application or workload layer that consumers interact with, whereas the management plane sits beneath it and controls the resources rather than serving the application to users.

Why D is wrong: This describes storage services, not the control interface; the management plane can configure storage but is not itself the persistence tier.

A hypervisor that installs directly onto the server hardware without a general-purpose host operating system beneath it is best described as which type, and what is the main security consequence?

• AA type 2 (hosted) hypervisor, which reduces the attack surface because the host operating system isolates guests from the hardware.
• BA type 1 (bare-metal) hypervisor, which increases the attack surface because it inherits every vulnerability of the underlying host operating system.
• CA type 1 (bare-metal) hypervisor, which reduces the attack surface because there is no separate host operating system layer to compromise.check_circle Correct
• DA type 2 (hosted) hypervisor, which increases the attack surface because it exposes hardware pass-through directly to each guest.

Why A is wrong: A type 2 hypervisor runs on top of a host operating system, so this mislabels the architecture; the host operating system actually adds an attack surface rather than removing one.

Why B is wrong: The type identification is correct but the reasoning is wrong, because a type 1 hypervisor has no underlying host operating system to inherit vulnerabilities from.

Why C is correct: A type 1 hypervisor runs directly on the hardware, so it removes the additional host operating system layer that a type 2 hypervisor depends on, giving it a smaller attack surface.

Why D is wrong: Both the label and the reasoning are wrong; a hosted hypervisor sits on a host operating system rather than on bare metal, and hardware pass-through is not what defines the type.

Under a serverless (function-as-a-service) compute model, which security responsibility remains with the customer rather than shifting to the cloud provider?

• ASecuring the function code, its dependencies and the identity permissions granted to each function.check_circle Correct
• BPatching and hardening the operating system that hosts each function invocation.
• CMaintaining the physical security of the data centres where the function runtime executes.
• DScaling the underlying execution fleet up and down to match the volume of incoming invocations.

Why A is correct: Even when the provider runs the platform, the customer still writes the function code, chooses its dependencies and defines the permissions it holds, so application and identity security stays with the customer.

Why B is wrong: This is tempting because patching matters everywhere, but in serverless the provider manages the underlying operating system and runtime host, so this responsibility shifts away from the customer.

Why C is wrong: Physical data-centre security is always the provider's responsibility across every cloud service model, so it is never the customer's task under serverless.

Why D is wrong: Automatic scaling of the execution infrastructure is a core provider-managed feature of serverless, so the customer does not own it.

A security engineer is deciding between a trusted platform module (TPM) and a hardware security module (HSM) for a specific need on new hypervisor hosts. The requirement is to bind disk encryption keys to a known-good boot state so the volume unlocks only when firmware and boot components are unchanged. Which component fits this requirement, and why?

• AThe TPM, because it stores platform configuration measurements and can seal keys so they release only when the measured boot state matches expected values.check_circle Correct
• BThe HSM, because it is validated to a higher assurance level and therefore supersedes the TPM for any host-based key binding requirement.
• CThe HSM, because it can attest to firmware integrity across the fleet and release keys centrally once each host reports a clean boot.
• DThe TPM, because it performs high-volume network cryptographic operations for many tenants while keeping keys inside a shared boundary.

Why A is correct: Sealing a key to platform configuration register values so it releases only under a known-good boot state is exactly what a TPM provides on a host.

Why B is wrong: Higher validation assurance does not give an HSM measured-boot sealing; that capability is specific to the TPM, so assurance level is the wrong basis for the choice.

Why C is wrong: Firmware measurement and boot-state sealing are TPM functions performed on the host itself; an HSM does not measure a server's boot sequence.

Why D is wrong: High-volume shared network crypto for tenants describes an HSM; a TPM is a low-throughput per-host root of trust, so the reasoning is inverted.

A cloud provider offers a dedicated tamper-resistant appliance that generates, stores, and performs cryptographic operations with keys that never leave the device in plaintext, exposing them to tenants through a network cryptographic API. Which statement most accurately describes the primary purpose of a hardware security module (HSM) in this cloud infrastructure?

• AIt measures the integrity of firmware and boot components during startup so a host can attest to its trusted state before joining a cluster.
• BIt records signed transaction logs in an append-only ledger so that key usage can be audited by an independent third party later.
• CIt accelerates bulk symmetric encryption of stored objects so that data-at-rest throughput matches the underlying storage bandwidth.
• DIt provides a certified boundary for key generation, storage, and use so that private keys are never exposed outside the hardened device.check_circle Correct

Why A is wrong: Boot integrity measurement and attestation describe a trusted platform module (TPM), not an HSM, so this confuses two distinct hardware roots of trust.

Why B is wrong: Tamper-evident logging is a useful control an HSM may support, but it is not the primary purpose; the core function is protecting keys during generation and use.

Why C is wrong: Some HSMs offer crypto acceleration, but bulk data-at-rest encryption is normally done in software; performance is a side benefit, not the defining purpose.

Why D is correct: This is the defining role of an HSM: a validated, tamper-resistant boundary within which keys are created and used without ever being exported in the clear.

During the build of a private cloud, an operations team applies a documented set of configuration settings to every hypervisor host before it enters production: disabling unused services, closing unneeded ports, enforcing password policy, and removing default accounts. Which term best describes what the team is establishing?

• AA recovery point objective, defining the maximum tolerable data loss for each host measured against the last known-good backup.
• BA hardening baseline, defining the minimum secure configuration state that every host must meet before it is placed into service.check_circle Correct
• CA residual risk register, recording the risk that remains on each host after all planned security controls have been applied.
• DA configuration drift report, listing where each host's current settings have diverged from an approved standard over time.

Why A is wrong: A recovery point objective concerns tolerable data loss in continuity planning, not the secure configuration state of a host, so it is unrelated to this build activity.

Why B is correct: A hardening baseline is precisely a documented minimum secure configuration standard applied uniformly to systems of a given type before production.

Why C is wrong: A residual risk register captures leftover risk after controls, whereas the team is defining the control configuration itself, so this names the wrong artefact.

Why D is wrong: A drift report measures divergence from a standard after deployment; the team is first establishing that standard, so this confuses the baseline with detection of departures from it.

A team lead wants developer training to focus on the most common categories of web application security risk. Which resource is specifically designed to catalogue those widespread risks for awareness and training?

• AThe OWASP Top 10, a consensus list of the most critical web application security risks.check_circle Correct
• BThe shared responsibility model, which allocates security duties between the cloud provider and the customer.
• CA service level agreement, which defines the availability and performance commitments of a cloud service.
• DA recovery time objective, which sets the maximum tolerable duration to restore a service after disruption.

Why A is correct: Correct. The OWASP Top 10 is a widely used awareness document that ranks the most common and impactful web application security risks.

Why B is wrong: Tempting because it is central to cloud security, but it divides operational responsibility rather than cataloguing common application vulnerabilities.

Why C is wrong: Tempting because it governs the provider relationship, but an SLA sets service commitments and does not list web application risks.

Why D is wrong: Tempting because it is a familiar security metric, but an RTO is a continuity target and has nothing to do with cataloguing application risks.

A cloud provider runs annual secure development training for its engineers. Which outcome best describes the primary purpose of building application security awareness across a development team?

• AIt transfers legal liability for any breach from the provider to the individual developers who wrote the vulnerable code.
• BIt removes the need for penetration testing because trained developers no longer introduce exploitable defects.
• CIt guarantees compliance with every applicable data protection regulation once all staff complete the course.
• DIt shifts the identification of security weaknesses earlier in the development lifecycle, so defects are caught before they reach production.check_circle Correct

Why A is wrong: Tempting because training assigns responsibility, but awareness programmes do not reassign legal liability to individuals; accountability stays organisational.

Why B is wrong: Tempting because training reduces defects, but it never eliminates them, so independent testing remains necessary rather than optional.

Why C is wrong: Tempting because training supports compliance, but completing a course does not by itself guarantee regulatory conformance across all controls.

Why D is correct: Correct. Awareness and secure coding training aim to build security thinking into design and coding, catching flaws early when they are cheapest to fix.

During onboarding, new developers on a SaaS product are taught about a cloud development pitfall where secrets such as API keys are committed into source code repositories. Which practice does secure development training promote to address this pitfall?

• AEncoding the API keys in Base64 before committing them so they are not stored as readable plaintext.
• BStoring credentials in a dedicated secrets manager and referencing them at runtime rather than embedding them in code.check_circle Correct
• CCommitting the keys only to private repositories, since access control on the repository keeps the secrets safe.
• DRotating the committed keys on a fixed monthly schedule so that any exposed key becomes stale quickly.

Why A is wrong: Tempting because it obscures the value, but Base64 is reversible encoding not protection, so the secret is still exposed in the repository.

Why B is correct: Correct. Externalising secrets to a managed vault keeps them out of source control and out of version history, which is the trained practice.

Why C is wrong: Tempting because privacy seems sufficient, but hardcoded secrets persist in history and are exposed if the repository is later cloned, forked, or leaked.

Why D is wrong: Tempting because rotation is good hygiene, but rotating a still-hardcoded secret leaves a live credential in the code between rotations.

A security architect is distinguishing data sovereignty from data residency while planning a multi-region public cloud deployment for a regulated client. Which statement best captures data sovereignty?

• AData must simply be stored and processed within a specified geographic boundary chosen by the customer.
• BThe cloud customer, rather than the provider, must hold and manage the encryption keys protecting the data.
• CData is subject to the laws and governance of the country in which it is physically located, regardless of who owns it.check_circle Correct
• DData must be replicated across at least two national regions to guarantee availability during an outage.

Why A is wrong: Tempting because it sounds like a location rule, but this describes data residency, which is only about where data physically sits, not which laws govern it.

Why B is wrong: This describes customer-managed key control, a technical safeguard, not the legal concept of which nation's laws apply to the data.

Why C is correct: Correct. Data sovereignty is the principle that data falls under the legal jurisdiction of the nation where it resides, so local law can compel access or restrict transfer.

Why D is wrong: This describes a resilience or availability requirement, which is unrelated to the jurisdictional meaning of sovereignty.

A European organisation stores its customers' personal data with a public cloud provider whose parent company is headquartered in another country and is subject to that country's lawful government access demands. Which unique cloud legal risk does this scenario most directly illustrate?

• AConflicting international legislation, where obeying one jurisdiction's access demand would breach another jurisdiction's protection law.check_circle Correct
• BVendor lock-in, where proprietary services make it costly to migrate the data to an alternative provider.
• CMulti-tenancy commingling, where another tenant on shared infrastructure could reach the organisation's data.
• DData residency failure, where the provider has stored the data outside the customer's chosen geographic region.

Why A is correct: Correct. A foreign access demand can force disclosure that violates local data protection restrictions, the classic conflict-of-laws risk unique to cross-border cloud.

Why B is wrong: Lock-in is a real cloud concern, but it relates to portability and cost, not to competing legal obligations across borders.

Why C is wrong: Commingling is a technical isolation risk of shared tenancy, not the cross-border legal conflict the scenario describes.

Why D is wrong: Tempting because jurisdiction is involved, but nothing states the data left its region; the issue is a foreign law reaching data lawfully held in place.

A cloud customer facing litigation needs an international standard to structure how electronically stored information held by its provider is identified, preserved and produced. Which statement most accurately describes ISO/IEC 27050?

• AIt defines the cloud-specific security controls that providers and customers implement under a shared responsibility model.
• BIt specifies how personally identifiable information is protected by processors acting as PII handlers in public clouds.
• CIt sets the mandatory breach notification timelines a provider must meet after detecting a security incident.
• DIt provides guidance on electronic discovery, including the identification, preservation, collection and production of electronically stored information.check_circle Correct

Why A is wrong: Tempting because it is a cloud-relevant ISO/IEC standard, but this describes ISO/IEC 27017, not the eDiscovery standard.

Why B is wrong: This describes ISO/IEC 27018 on PII protection in public clouds, which is a different standard focused on privacy, not discovery.

Why C is wrong: Breach notification timelines come from data protection law and contracts, not from the ISO/IEC 27050 eDiscovery guidance.

Why D is correct: Correct. ISO/IEC 27050 addresses electronic discovery processes, giving a common framework for handling electronically stored information across custodians and providers.