CCSP practice questions
ISC2 · CCSP · 300 questions
Original practice questions for the ISC2 CCSP exam under the exam outline effective 1 August 2026, covering cloud concepts and architecture, cloud data security, platform and infrastructure security, application security, security operations, and legal, risk and compliance. The questions follow ISC2's official domain names and weights (17/20/17/16/17/13), are vendor-neutral, and use NIST, ISO/IEC and CSA terminology, including the outline's new AI/ML topics.
This course contains the use of artificial intelligence.
About the CCSP exam
- Time allowed
- 3 hours
- Questions
- 100-150 (CAT; includes 25 unscored pretest items)
- Passing score
- 700 out of 1000
- Format
- Computerized Adaptive Testing (CAT); multiple choice and advanced item types; no item review
Schedule this exam The certification this earns
Exam details published by the vendor, checked 12 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Cloud Concepts, Architecture and Design · 51 questions
- A developer at a retailer provisions three virtual machines through the cloud provider's web portal at 2 a.m. No ticket is raised, and nobody at the provider or in the retailer's IT team reviews, approves or performs any part of the request. Which essential cloud characteristic does this scenario demonstrate most directly?
- After the holiday peak, an online retailer's web tier shrinks automatically from forty instances to eight, and the next monthly invoice falls in proportion to the reduced usage. Which pair of essential cloud characteristics best explains these two effects?
- During due diligence, a customer asks a public cloud provider to name the physical host and rack that run its virtual machines. The provider replies that workloads are placed dynamically across shared hardware and that the location is not exposed. What does this most directly imply for the customer's security assumptions?
- A manufacturer buys collaboration, CRM and storage services from three different cloud providers through a single intermediary. The intermediary negotiates the provider relationships, combines the services into one integrated offering and sends the manufacturer one consolidated bill. Which cloud role does the intermediary fill?
- A consulting firm is engaged to assess the security controls of a company's cloud deployment and to integrate its identity provider with two SaaS applications. The firm does not host, operate or resell any cloud services. In ISO/IEC 17788 terms, which role does the consulting firm hold?
- A company moves its document management to a SaaS application. During a design review, a project lead argues that because the provider now runs the application, the provider is accountable for deciding how the company's documents are classified. Who retains that accountability?
- A cloud architect is explaining how thousands of tenants can request compute, storage and network resources through an API and receive consistent, correctly connected environments within minutes, with no provider staff involved. Which building block technology chiefly makes this coordinated provisioning possible?
- A firm's staff reach its cloud services from corporate laptops, personal tablets and phones over home, hotel and mobile networks. The security manager wants to address the risk that arises most directly from this broad network access. Which consideration should take priority?
- A tenant administrator at a law firm creates user accounts and assigns application roles inside the firm's SaaS practice-management system, using the administrative console the provider exposes. Under the cloud reference architecture, how should this activity be classified?
- A development team wants to deploy and run its own application code using programming languages, libraries and runtimes that the cloud provider supports, without provisioning or managing servers, operating systems or storage. Which ISO/IEC 17788 cloud capabilities type does this describe?
- An engineering team must control exactly when operating system patches are applied, load custom kernel modules for a specialized network driver, and choose the guest OS hardening baseline. Which cloud service category meets these requirements?
- A company moves all corporate email to a SaaS provider. The CIO tells the board that security is now entirely the provider's job. Which responsibility does the company still clearly retain under the shared responsibility model?
- Five regional hospitals that share the same healthcare regulatory obligations want cloud infrastructure that is provisioned for their exclusive use, governed jointly by them, and not open to other organizations. Which deployment model best fits this requirement?
- An organization runs its analytics platform on one public cloud provider and its customer-facing applications on a second, unrelated public provider, specifically to avoid depending on any single vendor. It operates no private cloud or on-premises data center. Which deployment model describes this arrangement?
- While negotiating a cloud contract, a company insists on a clause stating that when the agreement ends, the provider must return all of the company's data and application artifacts in a usable form and then delete all remaining copies after an agreed period. Which cloud shared consideration does this clause address?
- A company has two separate needs: a virtual machine image must be moved to a second cloud provider and run there without being rebuilt, and two SaaS applications from different vendors must exchange purchase orders automatically and act on them. How should these two needs be classified?
- A retailer moves IoT data processing from a central cloud region to small edge nodes installed in back rooms at four hundred stores, so that inventory sensors can be analyzed locally with low latency. Which new security concern does this design most directly introduce?
- A bank wants to run fraud analytics on sensitive customer data using shared public cloud hosts, but it requires that the data stay protected even from the host operator and hypervisor while it is being processed in memory. Which technology addresses this requirement?
- A regulated asset manager requires that the encryption keys protecting its data in a SaaS application never be in the SaaS provider's custody, so that the provider cannot decrypt the data even if compelled. Which key management approach meets this requirement?
- A government contractor encrypts archives that must stay confidential for thirty years using today's public-key algorithms. A risk review notes that a future cryptographically relevant quantum computer could break those algorithms. What should the organization do now?
- An audit finds that twelve cloud administrators hold standing full administrative rights on the management console at all times, although most of their daily work needs only read access. Which change best reduces this privileged access risk?
- A code review finds that several cloud workloads authenticate to the provider's APIs using long-lived access keys hard-coded in configuration files stored with the application code. Which change best addresses service access for these workloads?
- A company is leaving a public IaaS provider and must sanitize its data on the provider's multi-tenant storage. It cannot access the physical drives, and the provider will not remove or destroy shared media for one customer. Which sanitization method is most appropriate?
- A security review finds that an object storage bucket holding customer records was readable by anyone on the internet for several months. The bucket's access policy had been set to public by the customer's own deployment team during testing and never reverted. How should this threat be categorized?
- An application team assumes that the network security group protecting its web and application subnets will detect and stop malware moving between workloads inside allowed connections. Which statement correctly addresses that assumption?
- A company has staff only in the United States and Canada. After a series of credential-stuffing attempts against its cloud management console from other countries, the security lead wants console sign-ins from any other country blocked. Which control fits best, and what limitation should be planned for?
- A provider discloses a vulnerability in its hypervisor that could allow code running in one guest virtual machine to read the memory of another tenant's guest on the same host. What is the core risk, and what is the primary safeguard?
- A serverless function that processes payment events runs for a few seconds per invocation, and its local log files disappear when the execution environment is torn down. Investigators need those logs for future incident analysis. Which control best preserves the evidence?
- An operations team patches a fleet of long-running cloud servers by hand. Over time their configurations have drifted apart, and no two servers are identical, which makes vulnerability findings hard to remediate consistently. Which practice best addresses this?
- A data owner is setting up a new customer analytics data set in the cloud and asks at which phase of the cloud secure data lifecycle a classification should first be assigned to the data, so that later controls can rely on it. Which phase is correct?
- A company's disaster recovery plan replicates critical workloads from its primary region to a second region of the same public cloud provider. During a risk review, the CISO asks what happens if the provider suffers an outage affecting its control plane across all regions. What is the most accurate assessment?
- A cloud migration team is comparing pilot light, warm standby and active-active disaster recovery designs for the order management system. No one has yet determined how long the business can tolerate the system being down or how much data loss is acceptable. What should happen next?
- A BIA shows that adding a hot-standby environment for an internal reporting system would cost more each year than the annualized loss expectancy it would prevent. No law, regulation or contract requires the hot standby. Using cost-benefit analysis, what is the most appropriate decision?
- An enterprise architect wants a cloud security reference model that organizes required capabilities into domains such as business operation support services, IT operations and services, and security and risk management, so that gaps in a cloud program can be mapped against it. Which reference best fits?
- A new business requirement states that a customer-facing workload must be movable to a different cloud provider within one quarter if commercial or regulatory conditions change. Which design choice best supports this functional security requirement?
- A vulnerability scan of an IaaS virtual machine running a customer's web application reports missing operating system security patches that were released two months ago. Under the shared responsibility model, which party is responsible for applying them?
- A PaaS customer receives two security findings: one in the managed language runtime that the platform provides, and one in a library that the customer's developers bundled into their own application code. How is responsibility for fixing each finding divided?
- An architecture team wants a structured review of a cloud workload's design against defined pillars, including security, reliability, performance efficiency and cost optimization, producing a list of risks and recommended improvements. Which approach best fits?
- A proposed cloud design places a single perimeter firewall in front of every workload and relies on it as the only security control, with flat internal networks, default host configurations and no encryption between tiers. Which secure design principle should the security architect apply?
- A DevOps team runs security scans only once, two days before each quarterly release. Findings regularly arrive too late to fix, so releases ship with known vulnerabilities or slip. Which change best addresses the problem?
- A financial services firm wants assurance about a large public cloud provider's security controls before signing a contract. The provider states that it does not permit individual customers to conduct on-site audits of its data centers. What is the most appropriate way to verify the provider against the firm's criteria?
- A provider offers its ISO/IEC 27001 certificate as proof of sound security. The customer plans to use a data analytics service and a geographic region that the provider launched only last year. What should the customer verify before relying on the certificate?
- A security appliance used in a cloud deployment carries a Common Criteria certification. A manager concludes that the appliance is therefore secure in any configuration the team chooses to deploy. What is the correct interpretation of the certification?
- A federal agency workload must use validated cryptography. The SaaS vendor's sales material states that its encryption module is FIPS compliant. What should the agency's security team require before accepting the claim?
- A machine learning detector analyzing cloud audit logs flags unusual API calls from a service account that normally runs a nightly backup job. The calls began an hour ago and include listing storage buckets the account has never accessed. What should the security analyst do next?
- A security team retrains its cloud threat-detection model weekly using an external indicator feed that it subscribed to from an unverified source. A reviewer warns that the feed could be manipulated to make the model ignore certain attacker behavior. Which control best addresses this risk?
- An analyst proposes a SOAR playbook that automatically deletes any cloud resource associated with a high-severity alert, with no human review, to minimize response time. What is the most appropriate design for the playbook?
- A cloud-hosted machine learning model that recommends whether to approve access requests denies one employee group far more often than others with similar roles, and the team cannot explain why. What is the most appropriate response?
- A multinational firm plans to deploy an AI system in the European Union that will screen job applicants. The compliance lead must determine which obligations under the EU AI Act apply to the firm. How should the analysis begin?
- A company starts using a provider's generative AI service through an API. A product manager assumes that the provider is now responsible for whatever prompts and data the company's employees send to the service. Which statement best reflects shared responsibility?
- A cloud security operations team relies on a machine learning model trained on last year's telemetry to flag anomalous activity. Since the company moved many workloads to serverless functions and opened two new regions, the model's true-positive rate has fallen steadily while false positives keep rising. What is the most appropriate response?
Cloud Data Security · 60 questions
- A manufacturer's data lifecycle mapping shows that engineering files are routinely sent from its cloud storage to external partners for review. Which set of controls is most closely aligned with this phase of the cloud secure data lifecycle?
- A provider's storage service splits each customer object into fragments, computes additional parity fragments, and writes all of them across many devices and facilities so that the object can be rebuilt even if several fragments are lost. What security benefit does this data dispersion technique mainly provide?
- A healthcare company plans to store regulated patient records in a provider's object storage service that disperses fragments of each object across facilities in several countries. Legal counsel raises a concern before approval. Which issue should the cloud security professional address first?
- An organization plans to connect its HR SaaS application to an internal payroll system and to an external benefits administrator. During design review, nobody can say where employee data moves between these parties or where it crosses from one trust domain into another. What should the security architect produce to identify where controls are needed?
- Reporting analysts query a cloud database whose records are encrypted at rest. To compute results, the reporting engine decrypts records and holds them in memory while processing. Which statement best describes the risk in this phase of the data lifecycle and an appropriate control?
- An IaaS workload runs a relational database on a virtual machine that needs a block device formatted with a file system. Nightly backups of that database must go to a highly scalable store that applications reach through HTTP-based APIs. Which storage pairing fits these requirements?
- A batch application writes sensitive intermediate files to the instance-local disk of a virtual machine, which the provider wipes when the instance stops. The team now also plans to keep the only copy of each job's results on that same disk. What is the main concern with this design?
- A company must keep financial records for ten years in a low-cost archival storage tier, encrypted with keys the company manages itself. Which set of threats should the long-term storage design specifically address?
- A security review finds an object storage container whose access policy grants read permission to any authenticated user of the cloud provider, not only to identities in the company's own tenant. What is the most accurate assessment of this finding?
- To troubleshoot a performance problem, an engineer shares a snapshot of a production volume that holds customer data with an external consultant's cloud account. Why is this a significant threat to volume storage?
- A provider encrypts all customer data at rest by default, using keys it creates and manages. A bank's threat model includes malicious provider insiders and compelled disclosure of data by the provider. Which change best addresses that threat?
- An architect explains that large data sets are encrypted locally with data encryption keys, and each data key is then encrypted by a key-encryption key that never leaves the key management service. What is the main reason for this envelope encryption design?
- A company uses envelope encryption for petabytes of object data and must rotate its master key every year without re-encrypting the stored data itself. How is this achieved?
- An organization downloads backup archives from cloud storage to an offline vault. Auditors require proof, at any later date, that each archive has not been altered since it was created. Which technique directly provides this assurance?
- A project team publishes the SHA-256 hash of each signed-off contract and claims this proves which partner sent each document. What should the cloud security professional point out?
- Developers need realistic test data copied from a production cloud database that contains customer PII. The test environment has weaker access controls and monitoring than production. Which approach best fits this requirement?
- An analytics team wants a data set derived from EU customer records that falls outside the scope of GDPR, because no individual can be identified from it by any means reasonably likely to be used. Which technique meets this goal?
- A merchant wants to remove primary account numbers from most of its cloud-hosted applications to shrink the scope of its payment card compliance assessment, while still being able to retrieve the real number when processing refunds. Which approach best fits?
- Monitoring shows employees uploading customer lists from company-managed laptops to personal cloud storage accounts through a web browser. Leadership wants this movement of sensitive data detected and blocked. Where should DLP enforcement be placed?
- A network DLP appliance at the company's internet edge reports no policy violations for the quarter, yet an audit finds that sensitive files were uploaded to an unsanctioned web service over HTTPS during that period. What is the most likely cause and remedy?
- A code scan finds database passwords hard-coded in an application's source, which had been pushed to a public repository. After the exposed credentials are revoked and rotated, what is the best long-term fix?
- A customer portal went offline because a TLS certificate expired without anyone noticing. Certificates across the company are requested and installed manually by different teams. What is the most effective control to prevent a repeat?
- Auditors ask which columns across a company's cloud-hosted relational databases contain national ID numbers. Which data discovery approach is most efficient for this type of data?
- A hospital has thousands of PDFs, scanned forms and text files in cloud object storage that may contain health information. There is no schema, and file names and folders follow no consistent convention. Which data discovery approach fits this situation?
- A company stores application logs as JSON documents in a cloud log service. Email addresses can appear in nested fields whose names differ from one microservice to the next. Which discovery technique is best suited to finding personal data in these logs?
- A data discovery scan reports that nightly backups of a database holding EU customer records are being replicated to a provider region outside the jurisdictions approved in the company's data residency policy. What is the most important implication of this finding?
- A company is migrating legacy file shares to cloud storage. The files carry no classification labels, and their metadata, such as owners, dates and folder names, is known to be unreliable. Which discovery method should be used to find sensitive content?
- A company wants to find sensitive data already stored in a sanctioned SaaS collaboration application, including files uploaded months before any monitoring was in place. Which approach best fits this requirement?
- Two business units disagree about how sensitive a customer analytics data set hosted in the cloud should be considered. The data set belongs to the marketing division, whose director is formally designated as its data owner. Who should assign the classification?
- A research group combines several individually public data sets in a cloud analytics platform: location check-ins, a public staff directory and published event schedules. The combined output reveals the movements of specific executives. What should happen to the classification of the combined data set?
- During a migration from an on-premises CRM to a SaaS application, field names change, for example a column named SSN becomes taxidref. Classification and DLP rules that keyed on the old field names no longer apply. What should the team establish to keep protection consistent?
- A policy states that every cloud storage resource holding confidential data must be encrypted with customer-managed keys. The cloud team wants the policy enforced automatically as resources are created, not discovered months later. Which approach best supports this?
- Files labeled Confidential in a cloud document repository lose that marking when users download or export them, so downstream systems treat the copies as unclassified. What is the best way to fix this?
- A company is drafting the data classification policy for a new cloud program and must decide what should determine the classification level assigned to each data set. Which set of criteria should drive those levels?
- An engineering firm emails CAD drawings to a supplier and needs the drawings to remain protected after they arrive, with the firm still controlling who can open them and what recipients can do. Which technology fits this requirement?
- A partner contract has ended. Design documents previously shared with the partner were protected with IRM, and copies remain on the partner's laptops and file servers. What should the company do to stop further access to those copies?
- A company deploys IRM for files shared with external partners. Partners report they cannot open the protected files because they have no identities in the company's directory. What is the best way to address this?
- Board members must be able to view a quarterly report stored in the cloud, but they must not be able to print it, copy text from it or forward it to anyone else. Which IRM capability satisfies this requirement?
- An IRM deployment allows offline access to protected files. A departing employee's certificate is revoked, yet a protected file cached on the employee's laptop still opens while the laptop stays disconnected from the network. Why does this happen, and how should the design be adjusted?
- A company must set retention periods for invoices, system logs and employee chat messages held in several cloud services. How should the retention period for each kind of record be determined?
- A company keeps every email, file and log in its cloud tenant indefinitely, on the theory that it might need them someday. What is the main risk the security manager should raise about this practice?
- A company must delete a data set from a public cloud provider, including replicas and backups managed by the provider that the customer cannot reach directly. Which method gives the customer the most assurance that the data is unrecoverable?
- At contract termination, a customer needs assurance that its SaaS provider has deleted the customer's data from production systems and backups. What should have been put in place to provide that assurance?
- Encrypted archives must remain readable for seven years. During that period the company expects to replace its encryption tooling and adopt new document formats. What must the archiving procedure ensure?
- Litigation counsel places several executives' mailboxes on legal hold. An automated lifecycle rule in the company's cloud email service is scheduled to delete all mail older than three years next week. What should happen?
- Counsel requires that data under legal hold in cloud object storage cannot be altered or deleted, even by administrators, and that only named members of the legal team can access it. Which combination of controls meets this requirement?
- During an investigation, the incident team can see that a sensitive record was read from a cloud database, but the logs cannot show who read it, from where, or exactly when. Which logging improvement addresses this gap?
- A SaaS application exposes only a limited set of audit logs to customers, omitting file-level access events that the company needs for compliance reporting. What is the best course of action?
- Investigators cannot place events from workloads in three cloud regions in the correct order, because each system logs in its own local time zone and several clocks have drifted. What should be implemented to fix this?
- A review of a company's IaaS environment finds that audit logs for object storage access are written to a bucket in the same account, and the account's administrators can delete that bucket. Leadership worries that an attacker who gains administrator rights could erase the evidence of their own activity. Which design best addresses this concern?
- A company stores engineering documents in a cloud file service. A post-incident review shows that an insider downloaded several gigabytes between 1 a.m. and 3 a.m. over two weeks; the access events were logged the whole time, but no one noticed. What should the security team implement to detect this pattern in the future?
- Log files from a cloud application will be presented as evidence in a lawsuit about unauthorized changes to customer accounts. Opposing counsel is expected to challenge whether the logs were altered after collection. What must the organization be able to demonstrate?
- A finance user denies having changed a payment record in a cloud ERP application. The audit log shows the change under a shared service account that five people use, and log entries are kept as ordinary editable text. Which change would most improve the organization's ability to prove who made such a change in the future?
- A retailer plans to train a recommendation model on a cloud ML platform using purchase histories that include customer names, email addresses and home addresses. The data science team needs only purchase patterns. The privacy officer worries that the model could memorize and later reveal personal details. What is the best first step?
- A health research group will let external analysts query aggregate statistics produced from a cloud-hosted patient data set and the models trained on it. The requirement is that results must not reveal whether any single individual's record is in the data, even to an analyst with outside knowledge. Which technique best meets this requirement?
- An attacker repeatedly submits carefully chosen inputs to a cloud-hosted fraud detection model and studies its confidence scores to determine whether a specific person's transaction record was part of the training data. What type of attack is this?
- A machine learning team wants to deploy a pre-trained model file downloaded from a shared internal model repository that many teams can write to. The security architect notes that model files can be tampered with and that some serialization formats can execute code when loaded. What control should be required before the model is deployed to production?
- After a new third-party data feed was added to a cloud training pipeline, a classification model's accuracy dropped and it began mislabeling one category of inputs. The team suspects some of the new records were deliberately manipulated. Which practice would best have allowed the team to detect and roll back this problem?
- A company exposes its proprietary pricing model through a public inference API. Monitoring shows one client account sending millions of systematically varied queries and storing every response. Which threat does this pattern most indicate, and which control most directly reduces it?
- In a cloud ML environment, data scientists, platform engineers and outside contractors all have write access to the training data store, the pipeline definitions and the production model registry. Which change best protects the integrity of the models that reach production?
Cloud Platform and Infrastructure Security · 51 questions
- A bank evaluating a public cloud provider asks to send its own auditors to inspect the physical controls at the provider's data centers. The provider declines, citing its security policy and the number of customers it serves. How should the bank obtain assurance about the provider's physical environment?
- An architect is explaining software-defined networking (SDN) in a cloud provider's infrastructure, where a central controller programs the forwarding behavior of many switches. What is the most important security implication of separating the control plane from the data plane in this way?
- A tenant running a latency-sensitive service on shared IaaS compute notices that response times degrade whenever other tenants on the same physical hosts run CPU-intensive batch jobs. No data has been exposed. How should the security team classify this issue and address it?
- A private cloud provider is choosing a hypervisor for multi-tenant production workloads. One option installs directly on the server hardware; the other runs as an application on top of a general-purpose host operating system. From a security perspective, why is the first option usually preferred?
- A provider stores many tenants' block volumes on the same physical storage array. A prospective customer asks how the provider prevents one tenant from reading another tenant's data. Which combination best describes the expected protection?
- An attacker obtained the password of a cloud administrator and signed in to the provider's web management console for the company's account. From there the attacker could create, modify or delete any resource. Which statement best describes the risk and the primary control?
- During an investigation, a team needs to know which identity changed the network security group rules in a cloud account last Tuesday and from what IP address. The virtual machine logs show only which traffic was allowed or denied. Which log source should have been enabled and retained to answer this?
- A company connects its data center to its cloud provider through a dedicated private circuit from a telecommunications carrier. The network team says traffic on the circuit does not need encryption because it does not cross the public internet. What is the best response?
- A security review finds that the organization's golden virtual machine image, used to launch hundreds of instances, contains an embedded SSH private key that grants administrative access. What is the best corrective action?
- In a provider's data center design, tenant workloads and the provider's own hypervisor management and storage replication traffic all run on the same flat network segment. Which logical design change best reduces the risk this creates?
- At a cloud provider's facility, a single operations administrator can both approve requests for access to customer equipment racks and issue and activate the badges that grant that access. Which control is missing?
- A provider is evaluating a candidate site for a new data center. The site has low land costs and good power availability, but it lies in a designated flood plain and under an airport approach path. What should the provider do first?
- A company needs private cloud capacity within six months, has limited capital to spend, and must show regulators that strict physical access controls protect its equipment. Leadership is choosing between building its own data center and leasing colocation space. Which approach best fits these requirements?
- Monitoring in a provider's data hall shows server inlet temperatures varying widely between rows, with some racks drawing in hot exhaust air from neighboring racks. Total cooling capacity is sufficient. Which environmental design change best addresses this?
- A cloud provider's data center contracts with two different internet carriers for redundancy. A site survey reveals that both carriers' fiber enters the building through the same underground conduit and the same entry room. What is the most significant resilience problem, and how should it be fixed?
- A provider's data center loses utility power. The standby generators start automatically but take several seconds to reach stable output, and some servers reboot during that gap. Which design element was missing or inadequate?
- A data center design team must ensure the facility keeps full power and cooling capacity if any single chiller or UPS module fails or is taken offline for maintenance. The budget calls for the smallest amount of extra equipment that meets this requirement. Which redundancy model fits best?
- At a provider's data center, visitors and contractors have been observed following employees through the badge-controlled door into the server hall without presenting their own credentials. Which control most directly prevents this?
- A company discovers that several business units opened cloud accounts with corporate credit cards and are running production workloads that IT and security never reviewed. The CISO wants to begin a cloud risk assessment. What should be done first?
- Management wants a quick ranking of the top risks in a new multi-cloud environment so it can prioritize funding next quarter. The organization has little reliable historical loss data for cloud incidents. Which risk analysis approach is most appropriate?
- Each outage of a cloud-hosted order system costs about USD 40,000 in lost sales and recovery, and two outages are expected per year. A safeguard costing USD 30,000 per year would cut the expected rate to one outage per year without changing the loss per outage. Based on annualized loss expectancy, is the safeguard cost-justified?
- A penetration test finds that a management API for a company's cloud workloads is reachable from the internet and accepts requests authenticated only by a static key embedded in a mobile app. How should this finding be categorized, and what is the most appropriate treatment?
- An attacker phishes a cloud administrator's credentials, signs in, launches dozens of large compute instances for cryptocurrency mining, and creates new access keys for later use. Which cloud threat best describes this incident?
- A tenant performing cryptographic operations on shared IaaS hosts is concerned that another tenant's virtual machine on the same physical server could infer its private keys by measuring timing differences in shared CPU caches. Which threat is the tenant describing?
- A company's public web application runs on autoscaling compute billed by usage. A botnet floods it with requests that look legitimate; the service stays online because it scales out, but the monthly bill rises to several times the budget. Which threat does this describe, and what control helps most?
- A company buys cyber insurance that will pay for business losses if its primary cloud provider suffers a prolonged regional outage. Which statement best describes this risk treatment?
- After a risk assessment, leadership decides not to migrate a sensitive research workload to any public cloud because no available provider can meet a data residency requirement, and the workload will remain on premises. Which risk treatment has leadership chosen, and what is its main trade-off?
- After a cloud migration, a residual risk remains that is within the organization's documented risk appetite, and further controls would cost more than the expected loss. Who should formally accept this risk, and how?
- A company runs a hybrid cloud. Most workloads are in a public cloud, but a small on-premises server room hosts identity servers and the routers for private connectivity to the cloud. The provider's SOC 2 report shows strong physical controls. What is true about physical and environmental protection for the server room?
- A vulnerability scan of newly launched IaaS virtual machines shows default services listening on many ports, including remote administration and file sharing services the workload does not use. What is the most appropriate system protection measure?
- Several teams share block volumes and snapshots containing sensitive customer data in an IaaS account. Any engineer in the account can attach a volume to an instance or copy a snapshot to another account. Which control combination best protects this storage?
- Microservices in a company's cloud application communicate with each other over plain HTTP inside a virtual network, on the assumption that the network is private. A threat model notes that a compromised service could impersonate others or read their traffic. Which control best addresses this?
- All twenty engineers on a company's cloud team share the same administrator role, with full rights to every resource in every account, including billing and identity settings. Which change best applies authorization principles to cloud administration?
- Cloud administrators use SMS one-time codes as their second factor for console sign-in. Several recent attacks used fake sign-in pages that relayed both the password and the SMS code to the real console in real time. Which MFA change best defends against this attack?
- A company creates new cloud resources daily, each tagged with a project name and a data sensitivity label. Security wants access to be granted automatically when a user's project attribute matches a resource's project tag, without creating a new role for every project. Which access control model fits best?
- Each of a company's twelve cloud accounts has its own locally created administrator and user identities with separate passwords. Offboarding often misses some accounts, leaving former employees with access. Which change best addresses the root cause?
- In a company's cloud environment, each account keeps its own management plane, network and workload logs locally, and no one reviews them unless an incident is already known. Which audit mechanism should be implemented first?
- An attack moved through three cloud accounts in two regions over several hours. Investigators have logs from all of them, but cannot reconstruct the sequence of events because each source records time differently and uses different field names for the same identity. Which capability is most needed?
- A security team needs full packet capture of traffic to a group of IaaS workloads to investigate suspected command-and-control activity. They cannot attach a physical network tap because the provider owns the switches. What is the most appropriate approach?
- A cloud security team investigating suspected data exfiltration reviews the virtual network flow logs for a compromised workload. The logs show the source, destination, ports, protocol and byte counts of a suspicious session, but the analysts need to see what was actually transmitted. Which capability would have provided that content?
- A payment authorization service runs in a single cloud region. Its business impact analysis requires that customers see no meaningful interruption and lose no committed transactions if that region fails, so both the RTO and the RPO are near zero. The board has approved a large resilience budget. Which disaster recovery strategy best fits?
- An internal reporting application has a business impact analysis showing a maximum tolerable downtime of five days and an acceptable data loss of twenty-four hours. Management wants the least costly disaster recovery approach that still meets these targets. Which strategy should the cloud security professional recommend?
- During business impact analysis for a cloud-hosted order system, the business states it can survive at most eight hours without the system. The IT recovery team then commits to restoring the system to operation within four hours of a disaster being declared. Which recovery metric is the four-hour commitment?
- The finance department of a company running its trading ledger in the cloud states that, after any disaster, no more than fifteen minutes of committed transactions may be lost. Which aspect of the disaster recovery design does this requirement most directly determine?
- While planning disaster recovery for a cloud-hosted customer portal, the business agrees that during a disaster the portal may run at half of its normal capacity until the primary environment is restored. Which planning parameter does this agreement define?
- A regulator requires a financial services firm to show that its critical cloud-hosted workloads could be recovered even if its only cloud service provider suffered a prolonged provider-wide outage or ceased operations. Which disaster recovery design best satisfies this requirement?
- A cloud security professional is drafting a new business continuity and disaster recovery plan for a group of cloud-hosted services. The business impact analysis is complete and recovery strategies have been selected. What must the plan document contain so staff can execute it during a disaster?
- A company wants to verify that its cloud disaster recovery site can actually process real workloads, but management prohibits any test that would interrupt or shift production traffic. Which type of test meets both goals?
- A newly written disaster recovery plan for a cloud-hosted ERP system has never been exercised, and several of the people it names have not yet read it. What should the organization do first to begin validating the plan?
- Eighteen months after a disaster recovery plan was approved, the application it covers was re-architected from virtual machines into containers managed by an orchestration platform. The plan still describes restoring virtual machine images. What should happen next?
- An audit of a cloud-hosted CRM finds that nightly backup jobs have reported success for two years, yet no one has ever restored data from them, and failover is a manual process documented only in one engineer's notes. Which action best addresses the audit finding?
Cloud Application Security · 48 questions
- During a design review for a new PaaS-hosted application, several developers argue that input validation and authorization checks are unnecessary because the cloud service provider secures the platform. What should the cloud security professional advocate?
- Developers migrating an application to the cloud leave calls between internal services unauthenticated, reasoning that only components inside the virtual network can reach them, as was true in the corporate data center. What awareness point should the cloud security professional emphasize?
- A tester for a cloud-hosted billing portal signs in as one customer, changes the numeric invoice identifier in the browser's URL, and is shown another customer's invoice. Under the OWASP Top 10, which risk category does this flaw belong to?
- A mobile app's back-end REST API returns any customer record when the caller supplies its object identifier, checking only that the caller presents a valid session token. Which risk from the OWASP API Security Top 10 does this describe?
- A cloud-hosted support chatbot built on a large language model summarizes documents that customers upload. A tester uploads a file containing hidden text that tells the model to ignore its rules and include a phishing link in its reply, and the chatbot complies. Which OWASP Top 10 for LLM Applications risk does this demonstrate?
- A team building a high-value cloud banking application needs a structured, testable set of security requirements, graded by the application's risk level, that testers can verify control by control. Which resource best fits this need?
- A product team building a cloud-native customer portal has defined its features and plans to 'add security' after launch, once it sees how customers use the service. According to secure SDLC practice, when should security requirements first be defined?
- A development team adopting a secure SDLC for a cloud application asks where threat modeling belongs in its sequence of requirements, design, development, testing, deployment and maintenance. In which phase should threat modeling first be performed?
- An agile team ships a cloud application every two weeks and has no security stage in its process. Leadership asks how to integrate security without returning to a waterfall-style security gate at the end of each release. Which approach best fits?
- A cloud-hosted internal application was released three years ago and is no longer actively developed, though it remains in production and processes employee data. Which secure SDLC activity is most important for it now?
- A healthcare provider is specifying a new cloud application. Its regulatory obligations require that every access to patient records be logged, recording who accessed which record and when. How should this obligation be handled in the SDLC?
- A risk assessment for a multi-tenant SaaS application notes that a vulnerability in the hypervisor or in a shared database engine could expose data belonging to every tenant at once. Which cloud-specific risk category does this describe?
- The threat model for a cloud application that handles trade secrets includes a malicious administrator employed by the cloud service provider. Which mitigation most directly reduces this risk?
- A team running an application on a PaaS offering discovers during an incident investigation that it cannot obtain operating system or platform-level logs, because the provider manages those layers and does not expose them to customers. Which cloud-specific risk has the team encountered?
- An architect designing a cloud application learns that the default storage region for its customer data is in a country whose laws allow broad government access to data held there, while many of the customers are subject to stricter privacy laws. Which SDLC response is most appropriate?
- While threat modeling a cloud trading application with STRIDE, the team finds that a user could submit an order and later credibly deny having done so, because the system keeps no reliable record that ties the action to the user. Which STRIDE category is this?
- After identifying the threats to a cloud API, a team needs to prioritize them by scoring each one on how much harm it could cause, how easily it can be reproduced and exploited, how many users it would affect, and how easily it could be found. Which model is designed for this rating step?
- A business wants a threat modeling methodology for its cloud platform that starts from business objectives and impact and proceeds through staged analysis, including attack simulation, to risk-based countermeasures. Which methodology fits best?
- A code review of a cloud-hosted order service finds SQL statements built by concatenating user-supplied search terms directly into query strings. Which remediation best addresses the root cause, consistent with OWASP ASVS and SAFECode secure coding guidance?
- Engineers at a SaaS company edit infrastructure templates and application configuration directly in production, leaving no record of who changed what, and they cannot roll back reliably when a change fails. Which practice should be introduced?
- A CI/CD pipeline for a cloud application runs unit and integration tests confirming that each feature behaves as specified, but nothing measures response time under load, behavior during failover, or security properties. What is missing from the test strategy?
- A security team wants every commit to a cloud application's repository analyzed for vulnerabilities such as injection flaws and hard-coded secrets before the code is ever compiled or run. Which testing approach fits this requirement?
- Testers are asked to assess a cloud web application from the outside, sending crafted requests to the running application, with no access to its source code or internal design. Which testing approach does this describe?
- A development team installs an agent inside its cloud application's runtime. While the QA team runs normal functional tests, the agent observes code execution and data flows and reports where untrusted input reaches a dangerous function. Which testing approach is this?
- A widely used open-source logging library bundled into a cloud application's build is disclosed to have a critical CVE. The team needs a tool that inventories every third-party dependency, including transitive ones, and flags known vulnerabilities on each build. Which tool category fits?
- Before a penetration test of a cloud application begins, the tester is given the full source code, the architecture diagrams and administrator credentials for the test environment. What kind of test is this?
- To speed up releases of a cloud application, the developers propose to perform and approve their own security testing and to remove the separate quality assurance function from the process. What is the main reason a cloud security professional should object?
- A cloud e-commerce application passed all of its functional tests, yet after launch users discovered they could apply the same single-use discount code thousands of times by replaying the request. Which testing practice would most likely have found this before release?
- A company exposes a public REST API from its cloud platform. A review finds that the API applies no request throttling and passes caller-supplied parameters directly to back-end services without any checks. Which set of controls best addresses these findings?
- A SaaS provider's public API authorizes every request with a single static API key embedded in a partner's application. The partner now needs each of its end users to see only their own data through that API. What should the API's authorization design change to?
- A CI pipeline for a cloud service pulls third-party packages from a public repository, and the security team is concerned that a package could be tampered with between its publication and the download. Which control most directly verifies integrity and authenticity before a package is used?
- A software vendor will supply a component that runs inside a company's cloud application and processes customer personal data. Before the component is approved, which activity is most appropriate as part of software supply-chain management?
- A company plans to distribute a proprietary application that embeds an open-source library released under a strong copyleft license. Which supply-chain risk should be raised before the product is released?
- An audit finds that several commercial off-the-shelf components deployed in a company's cloud workloads appear in no inventory, and no one tracks vendor security advisories for them. What should be established first?
- Developers want to add an obscure open-source package, maintained by a single anonymous contributor and last updated four years ago, to a cloud application that handles payments. What should the cloud security professional require before approval?
- A cloud application must block SQL injection attempts in HTTP traffic, validate the structure of incoming SOAP messages against their schemas, and enforce per-client request quotas on its REST APIs. Which assignment of controls fits these three needs?
- A database administrator at a company using a cloud-hosted relational database has begun running unusual bulk SELECT queries against customer tables late at night. Which control is designed to detect and alert on this activity independently of the administrator's own privileges?
- A cloud load balancer terminates TLS from clients and forwards requests to back-end application instances over unencrypted HTTP within the virtual network. A compliance requirement states that cardholder data must be encrypted throughout transmission. What should be done?
- A multi-tenant SaaS analytics platform lets customers upload their own transformation scripts, which run on the provider's shared worker fleet. Security is concerned that a malicious script could read other tenants' data or tamper with the underlying host. Which architectural control best addresses this risk?
- A review of a cloud container platform finds three issues: application containers run in privileged mode, images are built from public base images that are never scanned, and orchestrator secrets are readable from every namespace. Which remediation plan best addresses all three findings?
- A cloud-native application consists of dozens of microservices. Any workload on the internal cluster network can call any service's API, and services trust requests based only on the caller's source IP range. The architect wants every service-to-service call authenticated and encrypted without rewriting each service. What is the best approach?
- A company's employees need access to a business partner's SaaS application. The partner does not want to manage passwords for the company's staff, and the company wants its own MFA requirements and leaver process to govern that access. Which design best meets both needs?
- An audit finds that terminated employees keep active accounts in several SaaS applications for weeks after leaving, because each application owner removes users manually whenever a ticket eventually arrives. Which control best fixes the root cause?
- After rolling out single sign-on to forty cloud applications, the CISO points out that one phished password would now give an attacker access to all of them. What is the most effective way to reduce this risk while keeping SSO in place?
- A cloud application's sign-in page asks for a password and then for the answer to a personal security question. The vendor markets this as multifactor authentication. How should the security architect assess the claim?
- A security team must scan files already stored in the company's sanctioned SaaS collaboration suite for sensitive data, and also block uploads in real time when users browse to unsanctioned file-sharing sites. Which CASB deployment meets both requirements?
- The CISO suspects that departments are using many cloud applications IT never approved, but there is no inventory of them. What is the best first step to identify which cloud services are actually in use across the organization?
- Developers have embedded a database password in an application's configuration file, which is committed to the source code repository. The application runs on cloud compute instances. What is the best way to supply this credential to the application?
Cloud Security Operations · 51 questions
- A cloud provider's architect needs hardware to generate and protect thousands of tenant master keys with tamper-resistant, high-throughput cryptographic operations. Separately, each hypervisor host must record measurements of its own boot components. Which pairing is correct?
- A cloud platform team discovers that new object storage containers are created publicly readable and unencrypted unless an engineer remembers to change the settings, and several have already been exposed. Which principle should guide the fix?
- A team installs a virtualization management console on a server with a public IP address so administrators can manage hosts from home. The console still uses the vendor's default administrator account. What should the cloud security professional recommend?
- A review of the organization's standard virtual machine template finds virtual floppy, CD-ROM, serial port and USB controllers attached to every image, although no workload uses them. What is the best action?
- On a private cloud virtualization cluster, host management, storage replication, live migration and tenant VM traffic all share one virtual network interface and a single network. What design change best reduces the risk this creates?
- Administrators have been installing guest OS virtualization toolsets, the drivers and agents that integrate VMs with the hypervisor, by downloading them from a third-party mirror site. What should the security policy require instead?
- A cloud provider wants each hypervisor host to prove that it booted untampered firmware, boot loader and kernel before the orchestrator is allowed to schedule tenant workloads onto it. Which mechanism provides this assurance?
- A cloud security review finds that RDP is open to the internet on every Windows VM in the customer's IaaS environment, so administrators can connect from anywhere. What is the best remediation?
- All six administrators of a Linux server fleet in the cloud use the same SSH private key, which is kept on a shared file server. One administrator has just left the company. What is the best long-term fix?
- Engineers sign in to the cloud management console, the monitoring platform and the CI/CD system with separate local accounts, each with its own password. Several accounts belonging to former staff are still active. What should the security team implement?
- In a private cloud, hypervisor management interfaces sit on the same layer 2 broadcast domain as tenant virtual machines, so tenant workloads can reach management services directly. Which network control best addresses this?
- Users of a cloud-hosted service are being sent to a malicious site by forged DNS responses injected into resolver caches. The operations team proposes deploying DNSSEC for the service's zones. What does DNSSEC provide in this case?
- Twelve branch offices must send internal traffic to workloads in the organization's virtual network in a public cloud. That traffic currently crosses the internet unencrypted, and dedicated private circuits are not in the budget. What is the most appropriate solution?
- A cloud security team wants to stop known exploit traffic before it reaches its web servers, and separately wants to study attacker techniques without putting production systems at risk. Which combination fits these goals?
- A quarterly audit finds that many Linux and Windows servers in the organization's cloud environment no longer match the approved hardened build, because settings were changed by hand during troubleshooting. Which approach best prevents this from recurring?
- Monthly patches applied directly to running production servers in the organization's IaaS environment have repeatedly broken applications, and teams now delay patching for months. Which process best balances security and stability?
- A host in the organization's private cloud cluster needs a firmware update that requires a reboot. Tenant workloads on that host have availability commitments. What should the operations team do?
- In a private cloud virtualization cluster, some hosts run at sustained high CPU while others sit nearly idle, and tenant VMs on the busy hosts are suffering slow response times. Which capability addresses this automatically?
- After an outage, operations discovers that several hypervisor hosts had rising fan speeds, high temperatures and disk errors for days beforehand, but nobody noticed. What should be implemented?
- A private cloud team backs up hypervisor host configurations every night, but nobody has ever restored a guest VM from backup, and an auditor questions whether recovery would actually work. What should the team do?
- During an active attack, the SOC needs to block an attacker's IP range at the cloud firewall immediately. The organization's change advisory board normally meets once a week. What is the correct approach?
- An operations team uses the terms release and deployment interchangeably. The service manager wants to separate the two responsibilities in line with ITIL practices. Which distinction is correct?
- Before approving a change to a shared cloud load balancer, the change board cannot tell which applications, certificates and network rules depend on it. Which practice fills this gap?
- The same storage latency outage happens almost every week. Each time, the service desk restarts a service, restores normal operation and closes the ticket, and nothing else is done. Which practice is missing?
- A company relies on a cloud provider for a critical service. Leadership wants regular reports comparing the provider's actual availability and response times with the targets in the contract, and formal reviews whenever targets are missed. Which practice is this?
- A cloud-hosted ordering service never goes down, but response times climb sharply at month-end peaks and customers abandon their orders. Which management practice is primarily responsible for addressing this?
- The business continuity office has published recovery priorities based on its business impact analysis. The cloud operations team must now make sure its IT service recovery plans support those priorities. Which operational practice is responsible?
- An operations director wants a repeatable method to measure cloud service performance, identify improvement opportunities, and track those improvements to completion, instead of fixing issues on an ad hoc basis. Which practice fits this goal?
- A cloud service provider's board wants to adopt a certifiable management system that sets information security objectives, assesses risk, selects controls and drives continual improvement of the security program. Which standard should it adopt?
- A cloud provider already follows ITIL practices and now wants an independent, third-party certification of its IT service management capability that it can show to customers. What should it pursue?
- A CIO wants a framework for the governance and management of enterprise information and technology that aligns IT goals with business objectives and stakeholder value. Other executives have proposed frameworks built for internal control over financial reporting, prioritized technical safeguards, or a catalog of security controls. Which framework fits the CIO's purpose?
- An IaaS virtual machine is confirmed compromised and is still running. The investigation may support legal action, and the responder must choose an evidence collection sequence. Which sequence best preserves the evidence?
- A company suspects that data was exfiltrated through its SaaS customer relationship management application. It has no access to the provider's servers, hypervisors or storage. What most determines what forensic evidence the company can obtain?
- A disk image taken from a cloud VM will pass between three analysts and an external lab over several weeks and may be presented in court. Which practice best demonstrates that the evidence was not altered and is properly accounted for?
- A cloud workload has been confirmed compromised. A junior analyst wants to terminate the instance immediately to stop the attack. What should the incident lead direct instead?
- Investigators need evidence from a shared cloud storage system on which the suspect tenant's data is interleaved with data belonging to many other tenants. What must the evidence acquisition approach account for?
- A forensic team wants an international standard that provides guidelines for identifying, collecting, acquiring and preserving potential digital evidence, including from cloud systems. Which standard should it adopt for these activities?
- A company is negotiating with a SaaS vendor that will process its customers' personal data. The company must meet its own regulatory breach-reporting deadlines. What should the contract specify regarding incident communication?
- A cloud-hosted retailer has confirmed a breach of customer data. The marketing team wants to publish a reassuring public statement immediately, before the facts are verified. What is the best approach to customer communication?
- A company jointly delivers a cloud service with a partner, and each organization operates different components. An incident now affects both organizations. How should communication with the partner be handled?
- An EU-based retailer runs its customer portal on a public cloud platform. Its investigation confirms that personal data of EU residents was exfiltrated and that the breach is likely to result in a risk to those individuals' rights and freedoms. Acting as the controller under the GDPR, which communication obligation applies to the retailer?
- During an active security incident at a SaaS company, journalists and investors begin calling engineers on the response team directly and asking what happened, how many customers are affected and whether data was stolen. What should the incident manager do?
- A security operations center built around network taps and endpoint agents in the company's own data centers must now cover new IaaS and PaaS workloads, where it has no access to the provider's physical network. What should the SOC manager prioritize?
- A SOC receives thousands of static-threshold alerts a day from its cloud workloads. Most are false positives, analysts have begun ignoring whole alert categories, and a recent credential misuse attack went unnoticed among the noise. Which approach best addresses this problem?
- A company sends logs from its cloud management plane, web application firewall, guest operating systems and several SaaS applications to one platform. Each source uses different field names, formats and time zones, so analysts cannot link related events into a single attack sequence. Which SIEM capability addresses this?
- A SIEM alert shows a cloud virtual machine making repeated outbound connections to an external IP address and domain. Analysts cannot tell whether these are known command-and-control servers or a legitimate partner service, so triage takes hours. Which capability would most directly speed up this decision?
- Malware is spreading laterally between virtual machines in a company's IaaS virtual network. An analyst wants to immediately reimage the first infected virtual machine to remove the malware. According to the incident response lifecycle, what should happen before eradication?
- Management plane logs show that a long-lived access key belonging to a service account is being used right now from an unfamiliar IP address to launch compute instances in regions the company never uses. What is the most effective immediate containment step?
- A quarterly vulnerability scan of a company's IaaS Linux instances is run from the network without any credentials. It reports only a handful of low findings, even though the instance images have not been patched in months. What best explains the result, and how should the scanning be improved?
- A company's security team plans a penetration test of its IaaS tenancy and proposes including attacks against the shared storage service and the hypervisor because a weakness there could affect its workloads. What should the team do before testing begins?
- A chief financial officer asks why the company pays for an annual third-party penetration test of its cloud application when the security team already runs weekly automated vulnerability scans of the same environment. Which explanation is most accurate?
Legal, Risk and Compliance · 39 questions
- A cloud provider headquartered in the United States receives a lawful US order under the CLOUD Act to disclose emails of a European customer that are stored only in its EU region. The customer's data protection officer warns that disclosure could breach GDPR transfer restrictions. Which concept best describes this risk?
- A multinational plans to roll out a SaaS human resources system. One country where it operates has a statute requiring that personal data about its citizens be stored and processed only within national borders. Which design response best satisfies this requirement?
- During due diligence, a customer learns that a prospective cloud provider uses subprocessors in several other countries for customer support and backup storage. The standard contract does not name them or their locations. What should the customer do to evaluate this legal risk?
- A multinational wants to anchor its cloud privacy program in internationally recognized principles, such as collection limitation, purpose specification, use limitation, security safeguards and accountability, that have influenced many national privacy laws. Which source best fits this need?
- A company in litigation must identify, preserve, collect and produce email and attachments held in its SaaS collaboration platform. Which approach best aligns with ISO/IEC 27050 and CSA guidance on eDiscovery in the cloud?
- Law enforcement investigating one tenant of a public cloud service proposes seizing the physical server that hosts that tenant's virtual machines. The provider objects. Why is physical seizure problematic in this setting, and what approach is generally preferred?
- Investigators handling a cloud incident need internationally recognized guidelines for the identification, collection, acquisition and preservation of potential digital evidence, including from virtualized systems. Which standard should they consult?
- A forensic laboratory supporting cloud investigations must demonstrate, before relying on a new acquisition tool and procedure, that its investigative methods are suitable and adequate for their purpose. Which standard provides guidance specifically on this assurance?
- A marketing firm receives a client's list of business contacts under a contract that limits how the list may be used, and no statute in its jurisdiction regulates that business contact data. Separately, its clinic subsidiary stores patient health records. Which statement correctly distinguishes the two?
- A US hospital, a HIPAA covered entity, plans to store electronic protected health information with a cloud provider. The data will be encrypted, and the provider states it has no access to the decryption keys. Before migration, what does HIPAA require regarding the provider?
- A US university that receives federal education funding moves student education records, including grades and disciplinary files, into a SaaS learning management system. Which law primarily governs disclosure of these records, and how can the vendor lawfully receive them?
- A Canadian private-sector company collects customers' personal information in the course of commercial activity and plans to have it processed by a cloud provider located in another country. Under PIPEDA, which statement is correct?
- An EU-based controller wants to use a cloud provider located in a third country that does not have an adequacy decision from the European Commission. Which mechanism can lawfully enable the transfer of personal data to that provider under the GDPR?
- A company that serves users in India decides why and how their digital personal data is processed, and it uses a cloud provider that processes that data only on the company's behalf. Under India's Digital Personal Data Protection Act, how are these parties described?
- A public cloud provider that processes personally identifiable information on behalf of its customers wants to adopt an international code of practice that extends ISO/IEC 27002 controls specifically for protecting PII in that processor role. Which standard should it adopt?
- A company is designing a new cloud-based analytics platform that will combine customer purchase histories with location data to build behavioral profiles. Architecture decisions are still open. What should the privacy team do, and when?
- A company's board wants independent assurance on the effectiveness of its cloud security controls that regulators and investors will accept, rather than a review by staff who report to the CIO and help run those controls. What should the company engage?
- An auditor finds that the virtual machines sampled last quarter no longer exist, because the cloud environment autoscales and rebuilds instances from images every day, and the hypervisor layer is not visible to the customer. What is the core assurance challenge, and how should the audit adapt?
- A customer's security team needs a detailed, restricted-use report from an independent auditor on a SaaS provider's controls relevant to security, availability and confidentiality, rather than controls relevant to the customer's financial reporting. Which report should it request?
- A vendor provides a SOC 2 report in which the auditor opines on the suitability of the design of controls as of a single specific date. The customer's risk committee needs evidence that those controls actually operated effectively throughout the past year. What should the customer request?
- A cloud provider headquartered in Europe offers its customers an independent assurance report issued under the international standard for controls at a service organization relevant to user entities' financial reporting. A US customer's auditors ask what this report corresponds to. Which statement is correct?
- A SaaS provider's SOC 2 report states that it uses the carve-out method for the colocation company that operates its data centers, and it lists several complementary user entity controls. What does this mean for the customer relying on the report?
- Before pursuing ISO/IEC 27001 certification, a company wants to compare its current cloud security controls against the standard's requirements to see what is missing, and to have control owners rate how well their own controls work. Which activity fits this need?
- Internal audit is planning an audit of a customer-facing application deployed across three cloud regions in different countries, using a mix of IaaS and SaaS services. What should the audit plan establish first?
- An organization building an internal information security management system is drafting a top-level security policy, functional policies for areas such as access control and data classification, and a policy governing use of cloud services. How should these policies relate to each other?
- A North American electric utility plans to move systems that support real-time monitoring and control of its bulk electric system to a cloud service operated across several regions. Which compliance requirement is most specific to this workload?
- While reviewing a cloud provider's risk management program, a customer finds that the provider accepts certain risks, such as extended patching windows for some platform components, that exceed the customer's own risk appetite for a regulated workload. What should the customer do?
- An online retailer decides which customer data to collect and why, and it uses a cloud provider that stores and processes that data only according to the retailer's documented instructions. Under the GDPR, how should these roles be classified?
- In a company's cloud data program, a database administrator implements backups, encryption and access controls as directed by policy, while a business analyst defines data quality rules, maintains metadata and ensures the data is used appropriately. Which roles do they hold?
- A cloud provider acting as a GDPR processor discovers that personal data it hosts for one of its customers, the controller, has been exfiltrated by an attacker. What is the provider's primary notification obligation under the GDPR?
- A US public company moves its general ledger and financial reporting applications to a SaaS provider. The company's external auditors are preparing their review of internal control over financial reporting. What is the main Sarbanes-Oxley implication of this move?
- A multinational's risk team must select a risk management framework that is an international, principles-based standard applicable to any type of organization and any type of risk, rather than one designed for federal information systems or limited to cloud computing. Which should it choose?
- Leadership wants metrics that warn when the organization's cloud risk exposure is increasing before an incident occurs, such as a rising number of publicly accessible storage buckets or of identities without multifactor authentication. What type of metric should the risk team define?
- A SaaS vendor that hosts several of a company's critical business processes announces layoffs, delays its annual audit report and misses a planned funding round. Which risk assessment activity should the company carry out?
- A procurement team mixes up three cloud contract documents: one sets the overall legal terms such as liability, confidentiality and governing law for every engagement; one defines measurable service commitments such as availability and support response times; and one describes specific deliverables for a migration project. What are these documents, in that order?
- A customer's policy requires the right to audit critical suppliers. A large multi-tenant cloud provider refuses individual on-site customer audits, citing security and the impact on other tenants, but offers current independent attestation reports and certifications. What is the most appropriate approach?
- A company's SaaS contract is silent on what happens to customer data when the agreement ends. Legal counsel wants to close that gap before renewal. Which contract terms should be added?
- A small SaaS vendor provides a custom application that runs a critical business process for the company, and no comparable product exists on the market. The company is concerned the vendor could go out of business and leave it without access to the software. Which contractual mechanism best addresses this risk?
- A company wants an international standard that addresses information security in supplier relationships, including acquiring cloud services, so it can manage security risk across its supply chain throughout the life of each supplier engagement. Which standard should it use?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by ISC2, Inc.