Cloud Concepts, Architecture and Design

CCSP · 51 questions

• A developer at a retailer provisions three virtual machines through the cloud provider's web portal at 2 a.m. No ticket is raised, and nobody at the provider or in the retailer's IT team reviews, approves or performs any part of the request. Which essential cloud characteristic does this scenario demonstrate most directly?
• After the holiday peak, an online retailer's web tier shrinks automatically from forty instances to eight, and the next monthly invoice falls in proportion to the reduced usage. Which pair of essential cloud characteristics best explains these two effects?
• During due diligence, a customer asks a public cloud provider to name the physical host and rack that run its virtual machines. The provider replies that workloads are placed dynamically across shared hardware and that the location is not exposed. What does this most directly imply for the customer's security assumptions?
• A manufacturer buys collaboration, CRM and storage services from three different cloud providers through a single intermediary. The intermediary negotiates the provider relationships, combines the services into one integrated offering and sends the manufacturer one consolidated bill. Which cloud role does the intermediary fill?
• A consulting firm is engaged to assess the security controls of a company's cloud deployment and to integrate its identity provider with two SaaS applications. The firm does not host, operate or resell any cloud services. In ISO/IEC 17788 terms, which role does the consulting firm hold?
• A company moves its document management to a SaaS application. During a design review, a project lead argues that because the provider now runs the application, the provider is accountable for deciding how the company's documents are classified. Who retains that accountability?
• A cloud architect is explaining how thousands of tenants can request compute, storage and network resources through an API and receive consistent, correctly connected environments within minutes, with no provider staff involved. Which building block technology chiefly makes this coordinated provisioning possible?
• A firm's staff reach its cloud services from corporate laptops, personal tablets and phones over home, hotel and mobile networks. The security manager wants to address the risk that arises most directly from this broad network access. Which consideration should take priority?
• A tenant administrator at a law firm creates user accounts and assigns application roles inside the firm's SaaS practice-management system, using the administrative console the provider exposes. Under the cloud reference architecture, how should this activity be classified?
• A development team wants to deploy and run its own application code using programming languages, libraries and runtimes that the cloud provider supports, without provisioning or managing servers, operating systems or storage. Which ISO/IEC 17788 cloud capabilities type does this describe?
• An engineering team must control exactly when operating system patches are applied, load custom kernel modules for a specialized network driver, and choose the guest OS hardening baseline. Which cloud service category meets these requirements?
• A company moves all corporate email to a SaaS provider. The CIO tells the board that security is now entirely the provider's job. Which responsibility does the company still clearly retain under the shared responsibility model?
• Five regional hospitals that share the same healthcare regulatory obligations want cloud infrastructure that is provisioned for their exclusive use, governed jointly by them, and not open to other organizations. Which deployment model best fits this requirement?
• An organization runs its analytics platform on one public cloud provider and its customer-facing applications on a second, unrelated public provider, specifically to avoid depending on any single vendor. It operates no private cloud or on-premises data center. Which deployment model describes this arrangement?
• While negotiating a cloud contract, a company insists on a clause stating that when the agreement ends, the provider must return all of the company's data and application artifacts in a usable form and then delete all remaining copies after an agreed period. Which cloud shared consideration does this clause address?
• A company has two separate needs: a virtual machine image must be moved to a second cloud provider and run there without being rebuilt, and two SaaS applications from different vendors must exchange purchase orders automatically and act on them. How should these two needs be classified?
• A retailer moves IoT data processing from a central cloud region to small edge nodes installed in back rooms at four hundred stores, so that inventory sensors can be analyzed locally with low latency. Which new security concern does this design most directly introduce?
• A bank wants to run fraud analytics on sensitive customer data using shared public cloud hosts, but it requires that the data stay protected even from the host operator and hypervisor while it is being processed in memory. Which technology addresses this requirement?
• A regulated asset manager requires that the encryption keys protecting its data in a SaaS application never be in the SaaS provider's custody, so that the provider cannot decrypt the data even if compelled. Which key management approach meets this requirement?
• A government contractor encrypts archives that must stay confidential for thirty years using today's public-key algorithms. A risk review notes that a future cryptographically relevant quantum computer could break those algorithms. What should the organization do now?
• An audit finds that twelve cloud administrators hold standing full administrative rights on the management console at all times, although most of their daily work needs only read access. Which change best reduces this privileged access risk?
• A code review finds that several cloud workloads authenticate to the provider's APIs using long-lived access keys hard-coded in configuration files stored with the application code. Which change best addresses service access for these workloads?
• A company is leaving a public IaaS provider and must sanitize its data on the provider's multi-tenant storage. It cannot access the physical drives, and the provider will not remove or destroy shared media for one customer. Which sanitization method is most appropriate?
• A security review finds that an object storage bucket holding customer records was readable by anyone on the internet for several months. The bucket's access policy had been set to public by the customer's own deployment team during testing and never reverted. How should this threat be categorized?
• An application team assumes that the network security group protecting its web and application subnets will detect and stop malware moving between workloads inside allowed connections. Which statement correctly addresses that assumption?
• A company has staff only in the United States and Canada. After a series of credential-stuffing attempts against its cloud management console from other countries, the security lead wants console sign-ins from any other country blocked. Which control fits best, and what limitation should be planned for?
• A provider discloses a vulnerability in its hypervisor that could allow code running in one guest virtual machine to read the memory of another tenant's guest on the same host. What is the core risk, and what is the primary safeguard?
• A serverless function that processes payment events runs for a few seconds per invocation, and its local log files disappear when the execution environment is torn down. Investigators need those logs for future incident analysis. Which control best preserves the evidence?
• An operations team patches a fleet of long-running cloud servers by hand. Over time their configurations have drifted apart, and no two servers are identical, which makes vulnerability findings hard to remediate consistently. Which practice best addresses this?
• A data owner is setting up a new customer analytics data set in the cloud and asks at which phase of the cloud secure data lifecycle a classification should first be assigned to the data, so that later controls can rely on it. Which phase is correct?
• A company's disaster recovery plan replicates critical workloads from its primary region to a second region of the same public cloud provider. During a risk review, the CISO asks what happens if the provider suffers an outage affecting its control plane across all regions. What is the most accurate assessment?
• A cloud migration team is comparing pilot light, warm standby and active-active disaster recovery designs for the order management system. No one has yet determined how long the business can tolerate the system being down or how much data loss is acceptable. What should happen next?
• A BIA shows that adding a hot-standby environment for an internal reporting system would cost more each year than the annualized loss expectancy it would prevent. No law, regulation or contract requires the hot standby. Using cost-benefit analysis, what is the most appropriate decision?
• An enterprise architect wants a cloud security reference model that organizes required capabilities into domains such as business operation support services, IT operations and services, and security and risk management, so that gaps in a cloud program can be mapped against it. Which reference best fits?
• A new business requirement states that a customer-facing workload must be movable to a different cloud provider within one quarter if commercial or regulatory conditions change. Which design choice best supports this functional security requirement?
• A vulnerability scan of an IaaS virtual machine running a customer's web application reports missing operating system security patches that were released two months ago. Under the shared responsibility model, which party is responsible for applying them?
• A PaaS customer receives two security findings: one in the managed language runtime that the platform provides, and one in a library that the customer's developers bundled into their own application code. How is responsibility for fixing each finding divided?
• An architecture team wants a structured review of a cloud workload's design against defined pillars, including security, reliability, performance efficiency and cost optimization, producing a list of risks and recommended improvements. Which approach best fits?
• A proposed cloud design places a single perimeter firewall in front of every workload and relies on it as the only security control, with flat internal networks, default host configurations and no encryption between tiers. Which secure design principle should the security architect apply?
• A DevOps team runs security scans only once, two days before each quarterly release. Findings regularly arrive too late to fix, so releases ship with known vulnerabilities or slip. Which change best addresses the problem?
• A financial services firm wants assurance about a large public cloud provider's security controls before signing a contract. The provider states that it does not permit individual customers to conduct on-site audits of its data centers. What is the most appropriate way to verify the provider against the firm's criteria?
• A provider offers its ISO/IEC 27001 certificate as proof of sound security. The customer plans to use a data analytics service and a geographic region that the provider launched only last year. What should the customer verify before relying on the certificate?
• A security appliance used in a cloud deployment carries a Common Criteria certification. A manager concludes that the appliance is therefore secure in any configuration the team chooses to deploy. What is the correct interpretation of the certification?
• A federal agency workload must use validated cryptography. The SaaS vendor's sales material states that its encryption module is FIPS compliant. What should the agency's security team require before accepting the claim?
• A machine learning detector analyzing cloud audit logs flags unusual API calls from a service account that normally runs a nightly backup job. The calls began an hour ago and include listing storage buckets the account has never accessed. What should the security analyst do next?
• A security team retrains its cloud threat-detection model weekly using an external indicator feed that it subscribed to from an unverified source. A reviewer warns that the feed could be manipulated to make the model ignore certain attacker behavior. Which control best addresses this risk?
• An analyst proposes a SOAR playbook that automatically deletes any cloud resource associated with a high-severity alert, with no human review, to minimize response time. What is the most appropriate design for the playbook?
• A cloud-hosted machine learning model that recommends whether to approve access requests denies one employee group far more often than others with similar roles, and the team cannot explain why. What is the most appropriate response?
• A multinational firm plans to deploy an AI system in the European Union that will screen job applicants. The compliance lead must determine which obligations under the EU AI Act apply to the firm. How should the analysis begin?
• A company starts using a provider's generative AI service through an API. A product manager assumes that the provider is now responsible for whatever prompts and data the company's employees send to the service. Which statement best reflects shared responsibility?
• A cloud security operations team relies on a machine learning model trained on last year's telemetry to flag anomalous activity. Since the company moved many workloads to serverless functions and opened two new regions, the model's true-positive rate has fallen steadily while false positives keep rising. What is the most appropriate response?