ISC2 CCSP Practice Exam

• A. Measured service
• B. Resource pooling Correct answer
• C. Broad network access
• D. Rapid elasticity

Option B is correct because resource pooling means the provider serves multiple customers from a shared pool of physical and virtual resources that are assigned dynamically, and the customer generally has no control over or knowledge of the exact location. Measured service is about metering usage, broad network access is about reaching services over the network from many client types, and rapid elasticity is about scaling capacity quickly.

• A. Baseline each account's usage and alert on unexplained spikes in compute or egress Correct answer
• B. Publish monthly consumption reports to team leads for review at budget time
• C. Cap each account's quota at its current peak so any growth needs an approved change ticket
• D. Tag resources with a cost-center label for charge allocation by the finance team

Option A is correct because metering data gives a per-account usage baseline, so unexplained spikes in compute or egress can reveal crypto-mining, data exfiltration or compromised credentials. Options B and D use the same data for budgeting and chargeback, which are financial uses, and option C caps quotas at peak and relies on change tickets, which limits growth but does not detect threats.

• A. Reversibility
• B. Resiliency
• C. Interoperability Correct answer
• D. Portability

Option C is correct because ISO/IEC 17788 defines interoperability as the ability of two or more systems or services to exchange information and use the information exchanged, which is what real-time calls between two providers' systems require. Portability is about moving data or applications between providers, reversibility is about getting customer assets back and removing them at exit, and resiliency is about continuing to operate through disruption.

• A. Replicate the order database to the public cloud nightly, encrypted under keys the provider's key service manages
• B. Burst only stateless tiers handling tokenized data into approved regions that meet the private cloud's baseline Correct answer
• C. Burst the web and application tiers into the provider's nearest region with spare capacity and rely on its attestations
• D. Front the burst environment with an access broker whose session policies mask card and personal data in transit

Option B is correct because bursting only stateless tiers that handle tokenized data, into approved regions that meet the private cloud's baseline, keeps card data and personal data out of the burst environment and inside the residency limits. Option A copies the regulated database to the public cloud under provider-managed keys, option C picks the nearest region with spare capacity and relies on attestations, which ignores residency, and option D masks data only in transit while the burst tiers still process it.

• A. Block storage Correct answer
• B. Cold archive storage
• C. Object storage
• D. Network file share

Option A is correct because block storage presents raw volumes with low-latency random reads and writes that the guest operating system formats with its own file system. Object storage (C) is accessed through an API rather than formatted as a volume, a network file share (D) brings its own file system and network latency, and cold archive storage (B) is built for rare retrieval.

• A. Keep the three-region layout and hold every key inside the country so that foreign fragments stay unreadable
• B. Keep the three-region layout and add a contract clause committing the provider not to read the fragments
• C. Spread fragments across zones of the two in-country regions and block foreign locations by policy Correct answer
• D. Keep the three-region layout and replace patient identifiers with tokens before the data is stored

Option C is correct because the data must stay in one country, so fragments must be spread over the zones of the two in-country regions, which keeps durability high, and policy must block foreign locations. Options A, B and D keep fragments abroad: holding keys locally, a no-access contract clause, or tokenizing identifiers does not change where the data physically resides.

• A. Separate containers per classification zone with their own keys and roles, and curated data served by a query layer Correct answer
• B. Tag each object with a sensitivity label and have the lake-wide role filter reads by that label
• C. Encrypt the profile prefix under its own key while the single lake-wide role keeps running the jobs
• D. Keep one namespace and add prefix-level deny rules for each analyst group, reviewed by the data owners every quarter

Option A is correct because separate containers per classification zone, each with its own keys and roles, remove the shared lake-wide role that allowed the accidental reads, and a query layer serves curated data safely. Options B, C and D keep the single namespace and the broad role, so access still depends on filters, one key or prefix rules that can fail or drift.

• A. An external key manager that the provider's storage service calls to unwrap each data key
• B. Provider-managed keys, with a contract clause requiring notice of any government request
• C. Customer-managed keys in the provider's key service, with dual approval for key administration
• D. Client-side encryption before upload, with keys held only in the bank's own HSMs Correct answer

Option D is correct because with client-side encryption and keys held only in the bank's own HSMs, the provider never has the keys and cannot be compelled to decrypt. Options A, B and C leave the provider able to call, hold or use the keys, so a compelled provider could still decrypt.

• A. Capacity alerts on host memory use routed to an on-call engineer
• B. Automatic live migration of busy VMs to hosts with free memory
• C. Per-tenant reservations and limits enforced by the scheduler Correct answer
• D. Anti-affinity rules that spread each unit's VMs across hosts

Option C is correct because per-tenant reservations and limits enforced by the scheduler stop any one unit from consuming the shared pool, which is the root cause. Options A and B only detect or shuffle load after starvation has begun, and option D spreads VMs for availability without capping their consumption.

• A. Delete the volumes and snapshots, then obtain the provider's deletion confirmation
• B. Rely on the provider's media destruction certificate issued at drive retirement
• C. Destroy every copy of the customer-held key and record the destruction Correct answer
• D. Overwrite the dataset repeatedly before deleting its volumes and snapshots

Option C is correct because destroying every copy of the customer-held key makes the ciphertext unrecoverable immediately, and the destruction record is evidence the regulator can have now. Options A and B depend on the provider's later actions and cannot prove anything about pooled storage today, and option D cannot be verified on virtualized storage where blocks may be remapped.

• A. Stacked VLAN tags on trunks between each pair of rack switches
• B. Per-tenant subnets on one flat layer 2 network with host firewalls
• C. Overlay networks with a per-tenant identifier over a routed underlay Correct answer
• D. Dedicated physical switches for each tenant in every hall

Option C is correct because overlay networks give each tenant its own identifier space (millions of segments) carried across a routed underlay, so segments can follow workloads across racks and halls. Options A and B do not provide scalable per-tenant layer 2 segments with mobility, and option D does not scale or follow workloads.

• A. Run scheduled dynamic scans against the production endpoint in the lowest-traffic window each night
• B. Run static analysis on every commit and require a clean report before the build is promoted
• C. Run dynamic scans against the shared test environment on a monthly schedule using a masked copy of production data
• D. Run dynamic scans against a per-build environment from the release image using synthetic data Correct answer

Option D is correct because a per-build environment created from the release image with synthetic data lets a dynamic scan exercise authentication and session handling in the running service without touching customer data, and destroying it leaves nothing behind. Option A scans production, Option B is static analysis that cannot see runtime session flaws, and Option C is too infrequent to gate each release.

• A. Raise the build gate to block any image that contains a package without a published fix
• B. Schedule a full rebuild and redeploy of every image each night from the latest available base images
• C. Re-evaluate stored images against new vulnerability data and flag running workloads that use them Correct answer
• D. Run a runtime agent that blocks outbound connections from containers to destinations not on an approved list

Option C is correct because the flaw was published after the build gate ran, so stored images must be re-evaluated against updated vulnerability data and the results mapped to the digests of running workloads. That gives security the affected list within hours. Options A and B only act at build or rebuild time, and Option D restricts network egress rather than identifying vulnerable workloads.

• A. Block on every finding of any severity and let release managers override the gate when a release is urgent
• B. Block on new high-severity findings and allow expiring, owner-approved exceptions for existing ones Correct answer
• C. Report findings on a team dashboard without blocking and review the totals at the monthly security meeting
• D. Block on any finding in files changed by the commit and leave findings in untouched files out of the gate

Option B is correct because blocking only new high-severity findings stops risky releases while expiring, owner-approved exceptions keep legacy findings visible without freezing urgent fixes. Option A blocks everything and relies on routine overrides, Option C never blocks, and Option D ignores risk that sits in untouched files.

• A. Ask the provider to hand over forensic images of the physical hosts that served the tenant
• B. Send the provider a written preservation request through its designated legal contact, citing the pending investigation Correct answer
• C. Engage an external forensic firm to visit the provider's facility and collect the telemetry on the team's behalf
• D. Extend the tenant's own log retention period to twelve months and treat the exported logs as the primary evidence set

Option B is correct because the provider's telemetry rolls off after 30 days and the contract gives no forensic support, so the first move is a formal written preservation request through the provider's legal contact before the evidence is lost. Option A asks a multi-tenant provider for host images it will not release, option C still depends on the provider granting access, and option D preserves only the tenant's own logs, which do not cover the provider-side telemetry.

• A. Copy the snapshots to the forensic lab's home region in an encrypted container after hashing them at the source and logging the transfer
• B. Have the provider's regional staff analyze the volumes and send the security team a signed written report
• C. Share encrypted snapshots to a forensic workstation in the same region and export only the findings after counsel review Correct answer
• D. Mask the personal data on the volumes first and copy the masked images to the home-region lab for analysis

Option C is correct because keeping the evidence inside the region and exporting only counsel-reviewed findings respects the data export ban while preserving chain of custody. Options A and D move personal data (or images that may still contain it) out of the region, and option B gives up direct control of the evidence to a provider report that the team cannot independently verify.

• A. ISO/IEC 27042
• B. ISO/IEC 27050
• C. ISO/IEC 27037 Correct answer
• D. ISO/IEC 27041

Option C is correct because ISO/IEC 27037 covers identification, collection, acquisition and preservation of digital evidence. ISO/IEC 27041 addresses assurance of investigative methods, 27042 covers analysis and interpretation of evidence, and 27050 covers electronic discovery.

• A. Encrypt data at rest under provider-managed keys and replicate snapshots inside the same facility for faster restores
• B. Keep a tested standby on separate hosts at a second site, with data encrypted under keys the company holds Correct answer
• C. Move the workload to dedicated hosts within the same facility, physically separated from other customers' hardware in a locked cage
• D. Rely on the provider's contractual promise to notify customers before a seizure takes place and to move affected workloads

Option B is correct because a tested standby on separate hosts at a second site keeps the platform running when the seized hosts are taken, and customer-held keys keep the data unreadable to anyone who obtains the hardware. Option A keeps the replicas in the same facility, Option C keeps the workload on hardware in the same seizure-prone facility, and Option D relies on a notification promise that does not restore availability.

• A. Complete the full self-assessment questionnaire used by merchants that process and store card numbers on their own servers
• B. Treat the merchant as outside the payment standard once the provider shares its current attestation of compliance
• C. Validate the requirements left for its own site, including the redirect, and confirm the attestation covers the service Correct answer
• D. Ask the provider to assume the merchant's compliance validation for the checkout through the shared responsibility matrix

Option C is correct because the merchant stays responsible for the parts of the payment standard that touch its own site, such as the redirect or embedded page, and must confirm the provider's attestation covers the service it uses. Option A overstates the scope, Option B wrongly treats the merchant as out of scope, and Option D cannot transfer the merchant's own validation duty to the provider.

• A. Apply the privacy law of the hosting region as the single baseline for all customers, with regional addenda added on request
• B. Certify the service to an international security management standard and treat that certification scope as satisfying national laws
• C. Adopt the provider's published compliance statements and certifications as the complete list of obligations for the product
• D. Have counsel map data subjects, customer locations, hosting and support locations to the laws each triggers Correct answer

Option D is correct because applicable law depends on where data subjects, customers, hosting and support operations are located, so mapping each of these to the laws it triggers is the way to establish the obligations. Options A, B and C substitute a single region's law, a certification or the provider's own statements for that analysis.