CCSP 2026 Practice Exam – 192 Questions with Answers & Detailed
Rationales, Cloud Security Architecture, Data Protection, Cloud
Platforms, Risk Management, Legal Compliance & Security
Operations
Domain 1: Cloud Concepts, Architecture and Design (17% — 33 Questions)
Question 1
A multinational corporation is migrating its on-premises email and collaboration suite to a
public cloud provider. The security team needs to understand which party is responsible for
securing the physical servers hosting the email application in a Software as a Service (SaaS)
model.
A. The cloud service customer is responsible for securing the physical servers.
B. The cloud service provider is responsible for securing the physical servers.
C. A third-party data center operator separate from the cloud provider is responsible.
D. Responsibility is shared equally between the customer and provider.
Correct Answer: B
Explanation: In SaaS, the provider owns and secures the entire physical infrastructure
through the application layer. The customer secures only their data and access. This reflects
the fundamental shared responsibility principle.
Question 2
A cloud architect is designing a solution that must support rapid auto-scaling during
unpredictable traffic spikes while maintaining data residency within a specific country. Which
cloud characteristic is MOST directly related to the auto-scaling requirement?
A. Broad network access
,B. Rapid elasticity
C. Measured service
D. Resource pooling
Correct Answer: B
Explanation: Rapid elasticity allows resources to scale dynamically with demand, appearing
unlimited to the consumer. It directly enables auto-scaling to match workload fluctuations
without manual intervention.
Question 3
Which cloud deployment model is MOST appropriate for a group of five hospitals in the
same region that need to share a specialized medical imaging application while maintaining
strict patient data isolation from non-affiliated organizations?
A. Public cloud
B. Private cloud
C. Community cloud
D. Hybrid cloud
Correct Answer: C
Explanation: A community cloud serves a specific group of organizations with shared
concerns, such as healthcare compliance and patient privacy. It provides shared
infrastructure while restricting access to the community members.
Question 4
A security analyst is evaluating a cloud provider's claim that its hypervisor has been certified
under Common Criteria at EAL4+. What does this certification PRIMARILY validate?
,A. The provider's financial stability for long-term contracts
B. The hypervisor's security functionality against an independent evaluation standard
C. The provider's compliance with GDPR data protection requirements
D. The physical security controls of the data center facility
Correct Answer: B
Explanation: Common Criteria certification validates that a product's security features meet
defined assurance levels through independent testing. EAL4+ indicates methodically
designed, tested, and reviewed security functionality.
Question 5
A company's cloud security policy requires that all data encryption keys be generated and
stored in hardware security modules (HSMs) that the company controls, not the provider.
Which cloud service model BEST supports this requirement?
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
D. Function as a Service (FaaS)
Correct Answer: C
Explanation: IaaS provides the greatest customer control over the infrastructure stack,
including the ability to deploy and manage customer-controlled HSMs. SaaS and PaaS
abstract away infrastructure control.
Question 6
A cloud security manager is reviewing a service level agreement (SLA) that guarantees
99.95% uptime. What does this percentage mathematically represent?
, A. The maximum allowed scheduled maintenance window
B. The guaranteed minimum availability percentage over a defined period
C. The percentage of data that will be recoverable after a disaster
D. The provider's profit margin from the service
Correct Answer: B
Explanation: An SLA uptime guarantee of 99.95% means the service will be available for at
least 99.95% of the measurement period. It does not cover maintenance windows or define
recovery objectives.
Question 7
An organization is adopting a multi-cloud strategy to avoid vendor lock-in. Which
consideration is MOST critical for the security architect during design?
A. Ensuring identical security controls and policies across all providers
B. Reducing the number of cloud providers to minimize complexity
C. Standardizing on a single provider's security tools
D. Eliminating encryption to improve interoperability
Correct Answer: A
Explanation: Multi-cloud security requires consistent controls across heterogeneous
environments to prevent gaps. Inconsistent policies create vulnerabilities where weaker
configurations exist. Interoperability and federated identity become essential.
Question 8
Rationales, Cloud Security Architecture, Data Protection, Cloud
Platforms, Risk Management, Legal Compliance & Security
Operations
Domain 1: Cloud Concepts, Architecture and Design (17% — 33 Questions)
Question 1
A multinational corporation is migrating its on-premises email and collaboration suite to a
public cloud provider. The security team needs to understand which party is responsible for
securing the physical servers hosting the email application in a Software as a Service (SaaS)
model.
A. The cloud service customer is responsible for securing the physical servers.
B. The cloud service provider is responsible for securing the physical servers.
C. A third-party data center operator separate from the cloud provider is responsible.
D. Responsibility is shared equally between the customer and provider.
Correct Answer: B
Explanation: In SaaS, the provider owns and secures the entire physical infrastructure
through the application layer. The customer secures only their data and access. This reflects
the fundamental shared responsibility principle.
Question 2
A cloud architect is designing a solution that must support rapid auto-scaling during
unpredictable traffic spikes while maintaining data residency within a specific country. Which
cloud characteristic is MOST directly related to the auto-scaling requirement?
A. Broad network access
,B. Rapid elasticity
C. Measured service
D. Resource pooling
Correct Answer: B
Explanation: Rapid elasticity allows resources to scale dynamically with demand, appearing
unlimited to the consumer. It directly enables auto-scaling to match workload fluctuations
without manual intervention.
Question 3
Which cloud deployment model is MOST appropriate for a group of five hospitals in the
same region that need to share a specialized medical imaging application while maintaining
strict patient data isolation from non-affiliated organizations?
A. Public cloud
B. Private cloud
C. Community cloud
D. Hybrid cloud
Correct Answer: C
Explanation: A community cloud serves a specific group of organizations with shared
concerns, such as healthcare compliance and patient privacy. It provides shared
infrastructure while restricting access to the community members.
Question 4
A security analyst is evaluating a cloud provider's claim that its hypervisor has been certified
under Common Criteria at EAL4+. What does this certification PRIMARILY validate?
,A. The provider's financial stability for long-term contracts
B. The hypervisor's security functionality against an independent evaluation standard
C. The provider's compliance with GDPR data protection requirements
D. The physical security controls of the data center facility
Correct Answer: B
Explanation: Common Criteria certification validates that a product's security features meet
defined assurance levels through independent testing. EAL4+ indicates methodically
designed, tested, and reviewed security functionality.
Question 5
A company's cloud security policy requires that all data encryption keys be generated and
stored in hardware security modules (HSMs) that the company controls, not the provider.
Which cloud service model BEST supports this requirement?
A. Software as a Service (SaaS)
B. Platform as a Service (PaaS)
C. Infrastructure as a Service (IaaS)
D. Function as a Service (FaaS)
Correct Answer: C
Explanation: IaaS provides the greatest customer control over the infrastructure stack,
including the ability to deploy and manage customer-controlled HSMs. SaaS and PaaS
abstract away infrastructure control.
Question 6
A cloud security manager is reviewing a service level agreement (SLA) that guarantees
99.95% uptime. What does this percentage mathematically represent?
, A. The maximum allowed scheduled maintenance window
B. The guaranteed minimum availability percentage over a defined period
C. The percentage of data that will be recoverable after a disaster
D. The provider's profit margin from the service
Correct Answer: B
Explanation: An SLA uptime guarantee of 99.95% means the service will be available for at
least 99.95% of the measurement period. It does not cover maintenance windows or define
recovery objectives.
Question 7
An organization is adopting a multi-cloud strategy to avoid vendor lock-in. Which
consideration is MOST critical for the security architect during design?
A. Ensuring identical security controls and policies across all providers
B. Reducing the number of cloud providers to minimize complexity
C. Standardizing on a single provider's security tools
D. Eliminating encryption to improve interoperability
Correct Answer: A
Explanation: Multi-cloud security requires consistent controls across heterogeneous
environments to prevent gaps. Inconsistent policies create vulnerabilities where weaker
configurations exist. Interoperability and federated identity become essential.
Question 8
