Free CCSP Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CCSP Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which description matches the NIST definition of cloud computing?

   1. A. Network access to a shared resource pool that can be rapidly provisioned and released
   2. B. Dedicated hardware assigned permanently to one customer and changed by manual request
   3. C. A remote server whose capacity is fixed for the full length of a contract
   4. D. A managed network link that provides access without pooled computing resources

   Answer: A

   Explanation: NIST defines cloud computing as "on-demand network access to a shared pool of configurable computing resources" that "can be rapidly provisioned and released with minimal management effort or service provider interaction." The defining model includes shared, readily adjustable resources, which the other descriptions omit.

   Reference: The NIST Definition of Cloud Computing — Section 2, The NIST Definition of Cloud Computing, p. 2

2. 2A cloud team is documenting the lifecycle of a training dataset. Which sequence of activities should its lifecycle policy account for through final disposition?

   1. A. Creation, use, transfer, retention, archival, and deletion
   2. B. Creation, encryption, replication, retention, backup, and monitoring
   3. C. Creation, labeling, transfer, restoration, archival, and backup
   4. D. Creation, validation, backup, access review, replication, and deletion

   Answer: A

   Explanation: The CSA guidance says to "Define lifecycle stages clearly: creation, use, transfer, retention, archival, and deletion." A lifecycle policy must cover use and movement as well as retention and final disposition; backup and encryption are controls rather than a complete sequence of lifecycle stages.

   Reference: AICM v1.1 Implementation Guidelines for Cloud Service Providers — Data lifecycle management, Implementation Guidelines for Cloud Service Providers, Policy Development & Documentation

3. 3A cloud host runs multiple virtual machines on the same server. Which infrastructure component supplies the software abstraction that supports those VMs?

   1. A. Hypervisor
   2. B. Physical switch
   3. C. Storage drive
   4. D. Facility power unit

   Answer: A

   Explanation: NIST names "hypervisors, virtual machines, virtual data storage" as resource abstraction components. The hypervisor is the component associated with virtualizing the physical compute host.

   Reference: NIST Cloud Computing Reference Architecture — Section 3.2 Service Orchestration, Resource Abstraction and Control Layer, p. 13

4. 4What training approach should a cloud application team use for people with different secure-development responsibilities?

   1. A. Give each role training tied to its security responsibilities
   2. B. Train only the final release approver in application security
   3. C. Use the same infrastructure-only material for every role
   4. D. Wait for a vulnerability before assigning any training

   Answer: A

   Explanation: NIST SSDF says "Provide role-based training for all personnel with responsibilities that contribute to secure development." Role-specific coverage includes everyone who contributes, not just the release approver.

   Reference: NIST SP 800-218, Secure Software Development Framework Version 1.1 — PO.2.2, Provide Role-Based Training

5. 5In AWS KMS, which hardware component generates and protects KMS key material?

   1. A. A trusted platform module
   2. B. A hypervisor management controller
   3. C. A hardware security module
   4. D. A secure boot verification chip

   Answer: C

   Explanation: AWS says KMS key material "is generated in and protected by hardware security modules (HSMs)." The HSM is the hardware component for the stated key-protection function.

   Reference: AWS KMS Developer Guide: Key stores — Key stores, introduction

6. 6A cloud customer must verify that regulated records remain in an approved location. What provider practice most directly complicates that verification?

   1. A. Using redundant physical sites without disclosing detailed data locations
   2. B. Using a consistent record format across all approved sites
   3. C. Documenting the location of each approved storage site
   4. D. Giving the customer read access to its own records

   Answer: A

   Explanation: NIST notes that cloud data may be "stored redundantly in multiple physical locations" and that detailed location information may be "unavailable or not disclosed to the service consumer." This makes location-based compliance hard to verify.

   Reference: NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing — Section 4.2, Data Location, p. 17

7. 7A customer provisions server capacity automatically without a provider employee handling each request. Which essential cloud characteristic does this illustrate?

   1. A. Rapid elasticity
   2. B. On-demand self-service
   3. C. Measured service
   4. D. Resource pooling

   Answer: B

   Explanation: NIST states, "On-demand self-service. A consumer can unilaterally provision computing capabilities" and do so "without requiring human interaction with each service provider." The decisive feature is the customer's unilateral provisioning, not metering, scaling, or shared assignment.

   Reference: The NIST Definition of Cloud Computing — Section 2, Essential Characteristics, On-demand self-service, p. 2

8. 8A cloud data inventory lists storage accounts but cannot show where copies of a dataset reside in a hybrid, multi-cloud deployment. What concept should the inventory address?

   1. A. Physical and virtual data dispersion across environments
   2. B. Only the primary region named in the service contract
   3. C. Only the network route used by the latest transfer
   4. D. Only the logical owner of the original dataset

   Answer: A

   Explanation: CSA instructs providers to "Ensure visibility into multi-cloud and hybrid setups to identify where data resides physically and virtually." Data dispersion includes copies and locations beyond a single primary region; a route or owner alone does not locate the data.

   Reference: AICM v1.1 Implementation Guidelines for Cloud Service Providers — Data Inventory & Flow Mapping

9. 9A cloud platform must assign pooled compute capacity to tenants and monitor its consumption. Which part of its infrastructure performs those functions?

   1. A. Resource control software
   2. B. Physical facility cooling
   3. C. Persistent disk media
   4. D. External network carrier

   Answer: A

   Explanation: NIST says the control aspect of the abstraction layer covers "resource allocation, access control, and usage monitoring." These are control software functions over pooled resources, not tasks performed by cooling or media hardware.

   Reference: NIST Cloud Computing Reference Architecture — Section 3.2 Service Orchestration, Resource Abstraction and Control Layer, p. 13

10. 10A cloud application's development stack changes substantially. What should its secure-development awareness program do with existing training?

    1. A. Treat completed training as permanently sufficient
    2. B. Replace training with a one-time code scan
    3. C. Review proficiency and update role-based training as needed
    4. D. Limit future training to the operations team

    Answer: C

    Explanation: NIST SSDF directs teams to "Periodically review personnel proficiency and role-based training, and update the training as needed." Stack changes make that review relevant; a past course or code scan does not confirm current proficiency.

    Reference: NIST SP 800-218, Secure Software Development Framework Version 1.1 — PO.2.2, Provide Role-Based Training