Free PECB Certified Lead Cloud Security Manager Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified Lead Cloud Security Manager practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Under NIST's IaaS model, which capability distinguishes the consumer's use of the service?

   1. A.Deploy arbitrary software including an operating systemCorrect answer: A
   2. B.Use only provider-created applications through a browser
   3. C.Deploy applications only on a provider-managed runtime
   4. D.Manage the physical servers underlying the service

   Explanation: NIST states: "processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications". IaaS supports deployment of operating systems, unlike the provider applications of SaaS or the provider-supported platform of PaaS. The consumer does not manage the underlying cloud infrastructure.

   Reference: The NIST Definition of Cloud Computing — Section 2, Service Models and Deployment Models

2. 2An access-control policy for cloud services specifies who approves access and who administers accounts. Which policy element is it describing?

   1. A.Scope of the policy
   2. B.Purpose of the policy
   3. C.Roles and responsibilitiesCorrect answer: C
   4. D.Policy review frequency

   Explanation: NIST states: "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance". Approval and administration assignments describe roles and responsibilities; purpose, scope, and review frequency answer different questions.

   Reference: Security and Privacy Controls for Information Systems and Organizations — AC-1, Policy and Procedures

3. 3A manager scopes an assessment of a proposed cloud service. Which set of boundaries should be identified under NIST's assessment preparation guidance?

   1. A.Organizational applicability, time frame, and technology considerationsCorrect answer: A
   2. B.Threat intent, target selection, and attacker capability
   3. C.Risk acceptance, mitigation, and transfer decisions
   4. D.Impact ratings, likelihood ratings, and risk scores

   Explanation: NIST states: "Identify the scope of the risk assessment in terms of organizational applicability, time frame supported, and architectural/technology considerations." Threat characteristics, response choices and risk ratings are important assessment inputs or outputs but are not these scope boundaries.

   Reference: Guide for Conducting Risk Assessments — 3.1, Task 1-2

4. 4An organization applying ISO/IEC 27017:2026 selects controls for a private cloud. Which basis should guide selection?

   1. A.Only the provider's advertised control list
   2. B.Its risk assessment and relevant requirementsCorrect answer: B
   3. C.The assumption that private clouds have no shared responsibilities
   4. D.A requirement to implement every control identically

   Explanation: The source states: "Its controls should be selected and applied according to the organization’s risk assessment and any relevant legal, regulatory, contractual or cloud-specific security requirements.". Selection depends on risk and applicable requirements, not on advertising, an assumption of no shared responsibilities, or identical application.

   Reference: ISO/IEC 27017:2026 Information security controls for cloud services — What is ISO/IEC 27017?

5. 5A cloud training manager must prepare learning for both general users and privileged administrators. What principle should guide the material?

   1. A.Choose material without considering the audience's responsibilities
   2. B.Provide only general-user material to the privileged administrators
   3. C.Provide only administrator material to general users
   4. D.Match the material to the knowledge and duties of each audienceCorrect answer: D

   Explanation: The source states: "Facilitate the development of learning material that is appropriate and timely for the intended audiences". NIST recommends appropriate and timely materials for the intended audiences; providing only the wrong audience's material or ignoring duties defeats tailoring.

   Reference: Building a Cybersecurity and Privacy Learning Program — 1.6.3, CPLP Managers

6. 6A cloud workload is compromised and the team needs to prevent the incident spreading to other workloads. Which response objective does isolating the compromised workload serve?

   1. A.Eradication
   2. B.ContainmentCorrect answer: B
   3. C.Recovery
   4. D.Post-incident reporting

   Explanation: NIST states: "Containment refers to preventing the expansion of an incident.". Isolation limits expansion, the goal of containment; eradication removes persistence, recovery restores operations, and reporting communicates findings.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Table 3, RS.MI, Incident Mitigation

7. 7A customer authorizes testing of its cloud systems hosted on a network owned by a separate third party. Under NIST guidance, whose written consent is usually also needed?

   1. A.The assessor who is preparing the final report
   2. B.An ordinary user of the customer's application
   3. C.The owner of the third-party networkCorrect answer: C
   4. D.An unrelated tenant of the same cloud service

   Explanation: The source states: "the owner of the other network usually must also consent in writing to the assessment plan.". When the organization does not control part of the network, the other network's owner usually must also consent in writing to the plan.

   Reference: Technical Guide to Information Security Testing and Assessment — 6.5, Assessment Plan Development

8. 8Under NIST's PaaS model, what control does the consumer have over the cloud environment?

   1. A.Control over physical servers and the underlying network
   2. B.Control over deployed applications and possibly hosting configurationCorrect answer: B
   3. C.Control over the host operating system and provider storage
   4. D.Control limited to using the provider's finished applications

   Explanation: NIST states: "The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications". PaaS also permits possible control of hosting configuration; physical resources and the host OS remain outside consumer control, and using provider applications describes SaaS.

   Reference: The NIST Definition of Cloud Computing — Section 2, Service Models and Deployment Models

9. 9A cloud access policy omits responsibilities for newly introduced cloud accounts, and an audit reports the omission. Which action addresses the policy gap?

   1. A.Treat the earlier approval as sufficient despite the new roles
   2. B.Update the policy to assign the missing responsibilitiesCorrect answer: B
   3. C.Update only the account inventory without reviewing the policy
   4. D.Defer policy consideration until after the next cloud migration

   Explanation: The source states: "Events that may precipitate an update to access control policy and procedures include assessment or audit findings". An audit finding can prompt policy review and update; prior approval, inventory alone or deferral does not resolve missing role assignments.

   Reference: Security and Privacy Controls for Information Systems and Organizations — AC-1, Policy and Procedures

10. 10An assessor has limited information about a new cloud service and makes assumptions about adversary capability. Why document those assumptions?

    1. A.To establish that the assumed capabilities are verified facts
    2. B.To increase clarity and reproducibility of assessment resultsCorrect answer: B
    3. C.To avoid reassessing the service when new evidence emerges
    4. D.To eliminate the need for a defined risk model

    Explanation: NIST states: "By making assumptions and constraints explicit, there is greater clarity in the risk model selected for the risk assessment, increased reproducibility/repeatability of assessment results". Explicit assumptions make the basis of results clearer and repeatable; they do not verify the assumed facts or prevent updates.

    Reference: Guide for Conducting Risk Assessments — 3.1, Task 1-3