Question bank
ISC2 CCSP
42 ISC2 CCSP questions with the correct answer and a written explanation, organised across 6 exam domains.
- 42 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Cloud Application Security
7 questions in this domain
- Question 1Single Choice
What does a secure software development lifecycle embed into every phase of the software engineering process?
- ASecurity activities and checkpointsCorrect answer
- BNetwork firewalls only
- CFinal penetration tests
- DCompliance audits only
Why this is the answer
SSDLC embeds security activities and checkpoints into every phase, shifting security left and making it continuous rather than an isolated add-on.
- Question 2Multiple Select
Which are recognized benefits of shifting security left in the secure software development lifecycle for cloud application delivery?
- ALower cost of remediationCorrect answer
- BEarlier vulnerability identificationCorrect answer
- CEliminates the need for runtime monitoring
- DContinuous security feedbackCorrect answer
Why this is the answer
Early security reduces cost, finds flaws sooner, and creates continuous feedback. Runtime monitoring remains necessary for defense-in-depth.
- Question 3Interactive
Review the pipeline declaration in the code block. Which security testing tool is executed during the Commit stage?
- ASASTCorrect answer
- BDAST
- CRASP
- DWAF
Why this is the answer
SAST runs on committed source code before compilation, providing fast feedback on static vulnerabilities in the CI pipeline.
- Question 4Single Choice
What does static application security testing (SAST) analyze without executing the application?
- ASource code and binariesCorrect answer
- BLive network traffic
- CRuntime user sessions
- DProduction log files
Why this is the answer
SAST is a white-box technique that inspects source, bytecode, or binary artifacts without executing the application.
- Question 5Multiple Select
Which components are foundational elements of secure application design for cloud-native architectures?
- AIdentity-centric access controlsCorrect answer
- BData classification and encryptionCorrect answer
- CA single edge firewall
- DThreat modeling with STRIDECorrect answer
Why this is the answer
Secure cloud design includes identity, data protection, and threat modeling. A single edge firewall is insufficient because cloud architecture assumes no trusted network.
- Question 6Interactive
Inspect the cloud bucket policy in the code block. Which security principle is being violated by this access configuration?
- ALeast privilegeCorrect answer
- BEncryption in transit
- CAvailability
- DImmutability
Why this is the answer
The policy allows any principal to read objects, violating least privilege and potentially exposing sensitive data to unauthorized users.
- Question 7Single Choice
What does the term shift left mean in a secure software development lifecycle for cloud applications?
- APerforming security early in the lifecycleCorrect answer
- BDeploying to a left-side cloud region
- CReviewing code from left to right
- DOutsourcing security to a third party
Why this is the answer
Shift left means moving security to early SDLC phases, reducing cost and preventing design flaws from reaching production.
Cloud Concepts, Architecture and Design
7 questions in this domain
- Question 8Single Choice
According to NIST SP 800-145, what is the definition of cloud computing?
- AOn-demand access to shared configurable resourcesCorrect answer
- BVirtualized servers in a data center
- COutsourced IT infrastructure with fixed capacity
- DPay-per-use billing for hosted services
Why this is the answer
NIST defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources.
- Question 9Multiple Select
Which two are essential characteristics of cloud computing per NIST?
- ARapid elasticityCorrect answer
- BMeasured serviceCorrect answer
- CMulti-tenancy
- DHybrid deployment
Why this is the answer
Rapid elasticity and measured service are NIST essential characteristics; multi-tenancy and hybrid deployment are not listed as essential characteristics.
- Question 10Interactive
Based on the provisioning configuration shown, which essential characteristic is not satisfied?
- AOn-demand self-serviceCorrect answer
- BBroad network access
- CResource pooling
- DRapid elasticity
Why this is the answer
Requiring a helpdesk ticket means the consumer cannot provision without human interaction, so on-demand self-service is not met.
- Question 11Single Choice
What does on-demand self-service allow a cloud consumer to do?
- AProvision resources without provider interactionCorrect answer
- BAccess resources through any proprietary protocol
- CReserve dedicated physical servers
- DEliminate all identity controls
Why this is the answer
On-demand self-service lets consumers unilaterally provision computing capabilities without human interaction with the provider.
- Question 12Multiple Select
Which two statements describe rapid elasticity?
- AScales outward and inward automaticallyCorrect answer
- BResources may appear unlimitedCorrect answer
- CRequires manual capacity planning
- DProvides fixed, non-reversible capacity
Why this is the answer
Rapid elasticity means automatic, reversible scaling and resources often appear unlimited to the consumer.
- Question 13Interactive
Which essential characteristic is best demonstrated by the resource pool shown?
- AResource poolingCorrect answer
- BMeasured service
- CBroad network access
- DOn-demand self-service
Why this is the answer
Multiple tenants share resources with logical isolation and location independence, which is resource pooling.
- Question 14Single Choice
What does measured service do in cloud computing?
- AAutomatically controls and reports resource usageCorrect answer
- BOnly calculates the monthly bill
- CProvides unlimited bandwidth
- DGuarantees physical server location
Why this is the answer
Measured service meters resource usage for monitoring, control, reporting, and transparency, not only billing.
Cloud Data Security
8 questions in this domain
- Question 15Single Choice
During which cloud data lifecycle phase must data classification and labeling be performed to enable later security controls?
- AData creationCorrect answer
- BData archival
- CData destruction
- DData sharing
Why this is the answer
Classification and labeling are applied when data is created because later retention, encryption, and access policies depend on these initial attributes.
- Question 16Multiple Select
Which techniques are commonly used to implement data dispersion in cloud storage? Select all that apply.
- AErasure codingCorrect answer
- BShardingCorrect answer
- CCryptographic splittingCorrect answer
- DIdentical replication
Why this is the answer
Data dispersion uses erasure coding, sharding, or cryptographic splitting to distribute fragments so a single fragment reveals no usable information.
- Question 17Interactive
Refer to the provided JSON snippet. Which cloud data lifecycle phase does this event represent?
- AData creationCorrect answer
- BData storage
- CData sharing
- DData archival
Why this is the answer
The snippet shows a file upload event with classification metadata, which corresponds to data creation and classification in the lifecycle.
- Question 18Single Choice
Which primary control is typically applied to protect data during the cloud storage phase?
- AEncryption at restCorrect answer
- BData masking on query
- CDLP inline scanning
- DLegal hold suspension
Why this is the answer
The storage phase focuses on persisted data, so encryption at rest is the primary control; masking and DLP apply during use or sharing.
- Question 19Multiple Select
Which controls should be implemented during the data sharing phase to prevent unauthorized exposure? Select all that apply.
- AData loss prevention scanningCorrect answer
- BAccess revocation capabilityCorrect answer
- CShared link expiry policiesCorrect answer
- DErasure coding on every object
Why this is the answer
Sharing requires DLP scanning, access revocation, and expiry policies. Dispersion is a storage architecture control, not a sharing control.
- Question 20Interactive
Based on the JSON snippet, how many fragments are required to reconstruct the original data?
- A4Correct answer
- B6
- C2
- D10
Why this is the answer
The reconstruction_threshold value of 4 means any four of the six fragments can rebuild the original data.
- Question 21Single Choice
Why would an organization move rarely accessed data to an archival storage tier?
- AReduce storage cost while retaining dataCorrect answer
- BImmediately delete all copies
- CIncrease real-time query performance
- DBypass encryption requirements
Why this is the answer
Archival tiers provide lower-cost, higher-latency storage for data that is rarely accessed while preserving it for compliance and retention.
- Question 22Multiple Select
Which methods are recognized forms of secure data destruction in cloud environments? Select all that apply.
- ACryptographic erasureCorrect answer
- BMedia sanitizationCorrect answer
- CSecure key deletionCorrect answer
- DLogical delete only
Why this is the answer
Secure destruction includes cryptographic erasure, media sanitization, and key deletion. Logical deletion merely removes pointers and does not destroy data.
Cloud Platform & Infrastructure Security
7 questions in this domain
- Question 23Single Choice
In the shared responsibility model for a public cloud IaaS environment, which party is responsible for installing and managing biometric access controls at the data center?
- ACloud service providerCorrect answer
- BCloud customer
- CCustomer and provider jointly
- DFacility landlord
Why this is the answer
The CSP owns physical data center security, including biometric access controls. The customer's responsibilities begin above the hypervisor and virtual network layers.
- Question 24Multiple Select
Which tasks are typically customer responsibilities in an IaaS deployment? Select all that apply.
- APatching guest operating systemsCorrect answer
- BConfiguring virtual network firewall rulesCorrect answer
- CManaging application-level identity and accessCorrect answer
- DHardening the hypervisor
Why this is the answer
In IaaS, the customer patches guest OSes, configures virtual network security, and manages application access. The CSP hardens the hypervisor and physical infrastructure.
- Question 25Interactive
Review the code block. Which hypervisor type is being configured?
- AType 1 native hypervisorCorrect answer
- BType 2 hosted hypervisor
- CContainer runtime
- DApplication-based emulator
Why this is the answer
A hypervisor that runs directly on host hardware without a host operating system is a Type 1 native hypervisor, the standard for production cloud environments.
- Question 26Single Choice
In a cloud environment, who retains ultimate accountability for the protection of customer data, even when a CSP provides physical and virtualization security?
- ACloud customerCorrect answer
- BCloud service provider
- CBoth parties equally
- DRegulatory authority
Why this is the answer
Accountability for customer data cannot be delegated. The CSP operates controls, but the customer retains ultimate accountability for data protection.
- Question 27Multiple Select
Which controls are physical environmental controls in a cloud data center? Select all that apply.
- AVideo surveillance camerasCorrect answer
- BBiometric access readersCorrect answer
- CMantrap entry vestibulesCorrect answer
- DVirtual private cloud subnets
Why this is the answer
Cameras, biometric readers, and mantraps are physical access and monitoring controls. VPC subnets are logical network constructs, not physical controls.
- Question 28Interactive
Review the code block. Which category of security control does this logic represent?
- ADetective controlCorrect answer
- BPreventive control
- CCorrective control
- DPhysical control
Why this is the answer
The logic detects an anomaly and sends an alert. Detection and alerting are primary functions of detective controls.
- Question 29Single Choice
Which hypervisor architecture is the industry standard for production cloud IaaS environments?
- AType 1 native hypervisorCorrect answer
- BType 2 hosted hypervisor
- CContainer engine
- DApplication-based emulator
Why this is the answer
Type 1 hypervisors run directly on host hardware and are the cloud standard. Type 2 hypervisors run on an operating system and are not typical for production IaaS.
Cloud Security Operations
7 questions in this domain
- Question 30Single Choice
Under the shared responsibility model for IaaS, who normally patches the guest operating system and applications on a VM?
- AThe cloud customerCorrect answer
- BThe cloud provider
- CBoth parties equally
- DThe software vendor only
Why this is the answer
In IaaS, the provider secures the physical host and hypervisor, but the customer manages the guest OS and applications.
- Question 31Multiple Select
Which two options are logical infrastructure components in cloud computing?
- AVirtual networksCorrect answer
- BContainersCorrect answer
- CServer racks
- DPower and cooling
Why this is the answer
Logical infrastructure includes virtual networks, containers, VMs, and identity resources, while racks and cooling are physical.
- Question 32Interactive
Examine the provided code snippet. What type of cloud resource is being defined?
- AVirtual machineCorrect answer
- BStorage bucket
- CIAM role
- DLoad balancer
Why this is the answer
The Terraform snippet defines an AWS EC2 instance, which is a virtual machine in the cloud.
- Question 33Single Choice
What is the primary purpose of establishing a secure baseline configuration for cloud components?
- AConsistency and reduced configuration driftCorrect answer
- BIncreased network bandwidth
- CElimination of all security monitoring
- DAutomatic removal of audit logs
Why this is the answer
Secure baselines ensure every component is deployed consistently and prevent configuration drift that can introduce vulnerabilities.
- Question 34Multiple Select
Which two processes are essential for maintaining cloud physical and logical infrastructure?
- AChange management and version controlCorrect answer
- BPatch and vulnerability managementCorrect answer
- CDisabling all security logging
- DRemoving network security groups
Why this is the answer
Change management and patch management are core maintenance processes that prevent and remediate security issues.
- Question 35Interactive
Review the code snippet. What type of security element does it define?
- AIAM policy statementCorrect answer
- BSecurity group rule
- CEncryption key
- DLoad balancer listener
Why this is the answer
The JSON statement grants an S3 action on a resource, which is an IAM policy statement.
- Question 36Single Choice
Which task is usually performed by a Tier 1 SOC analyst?
- AInitial alert triageCorrect answer
- BRoot cause investigation
- CProactive threat hunting
- DFinal executive reporting
Why this is the answer
Tier 1 analysts monitor dashboards, acknowledge alerts, and perform initial triage before escalation.
Legal, Risk and Compliance
6 questions in this domain
- Question 37Single Choice
What does data sovereignty mean?
- ALaws of the residence countryCorrect answer
- BCustomer's home-country laws
- COnly data owner access
- DProvider's contract terms
Why this is the answer
Data sovereignty means stored data is subject to the laws of the country where it physically resides, linking location with legal authority.
- Question 38Multiple Select
Which two mechanisms are recognized EU cross-border data transfer mechanisms?
- AStandard Contractual ClausesCorrect answer
- BBinding Corporate RulesCorrect answer
- CUS Privacy Shield
- DVerbal consent
Why this is the answer
SCCs and BCRs are recognized GDPR transfer mechanisms; the Privacy Shield is no longer valid, and verbal consent does not satisfy transfer requirements.
- Question 39Interactive
Review the clause in the code block. Which concept does it best illustrate?
- AData sovereigntyCorrect answer
- BData minimization
- CBreach notification
- DVendor lock-in
Why this is the answer
The clause says storage location does not change the legal jurisdiction applying to data, which is the core concept of data sovereignty.
- Question 40Single Choice
Under GDPR, who must evaluate a data subject's deletion request?
- AData controllerCorrect answer
- BCloud provider
- CSub-processor
- DDPO only
Why this is the answer
GDPR data subject rights are exercised against the controller, who evaluates the request; the processor must follow the controller's instructions.
- Question 41Multiple Select
Which two principles are part of the GDPR?
- AData minimizationCorrect answer
- BPurpose limitationCorrect answer
- CMaximum retention
- DUnrestricted sharing
Why this is the answer
GDPR principles include data minimization and purpose limitation; maximum retention and unrestricted sharing directly violate the regulation's requirements.
- Question 42Interactive
The code block describes default privacy settings in a cloud application. Which GDPR principle is being implemented?
- APrivacy by design and defaultCorrect answer
- BData sovereignty
- CRight to access
- DBreach notification
Why this is the answer
Embedding privacy safeguards into default settings reflects GDPR Article 25, which requires privacy by design and by default.
Frequently asked questions
Everything about the ISC2 CCSP question bank and how to use it.