(ISC)² CCSP Practice Exam

What the (ISC)² CCSP exam covers

• Cloud Concepts, Architecture and Design129 questions
• Cloud Data Security164 questions
• Cloud Platform and Infrastructure Security154 questions
• Cloud Application Security125 questions
• Cloud Security Operations217 questions
• Legal, Risk and Compliance90 questions

Free (ISC)² CCSP sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 879.

1. Question 1Cloud Concepts, Architecture and Design

   In the cloud shared responsibility model, who is responsible for securing data and access configuration?

   • AThe customer (the provider secures the underlying cloud infrastructure)Correct
   • BThe provider (the customer only manages billing and account contacts)
   • CThe provider secures data while the customer secures physical racks
   • DA regulator sets both data and access controls for all tenants
   ✓ Correct answer: A

   The customer is responsible. In the cloud shared responsibility model the provider secures the underlying infrastructure (physical facilities, hardware, hypervisor, and managed services), while the customer is always responsible for their data, its classification, and identity/access configuration (IAM policies, permissions, and credentials). Regardless of service model, data and access control remain the customer's duty, making A the correct answer.

   Why the other options are wrong

   • BThe customer, not the provider, always retains responsibility for data classification and access configuration in every service model.
   • CCustomers never manage physical racks in public cloud; the provider owns physical security while the customer owns data and access.
   • DRegulators define compliance obligations but do not operationally set a tenant's data protection or access controls.
2. Question 2Legal, Risk and Compliance

   How can data-residency and compliance requirements increase cost, and what governance step manages this?

   • AThey are satisfied automatically by the provider regardless of which region a workload happens to run in
   • BThey may force specific regions/tiers; policy and tagging that map workloads to compliant, cost-appropriate regions manage itCorrect
   • CThey influence only documentation and reporting, with no effect on the architecture or the resulting cost
   • DThey always reduce cost because narrowing the choice of regions removes the more expensive options
   ✓ Correct answer: B

   This answer directly addresses the key concept tested in this security certification question. Understanding compliance, policy is essential for compliance and effective risk management. Organizations must implement this practice as part of their overall security and governance program. Regular assessment and improvement of this area ensures alignment with industry standards and regulatory requirements. This represents a critical control point in the security architecture.

   Why the other options are wrong

   • ACompliance requires deliberate region selection; the provider does not satisfy residency rules automatically.
   • CResidency rules constrain which regions and services are usable, which directly shapes architecture and cost.
   • DResidency constraints often raise cost by forcing specific, sometimes higher-priced regions, not lowering it.
3. Question 3Legal, Risk and Compliance

   During cloud eDiscovery, a litigation hold is issued. What is the primary gotcha created by the provider's automated data-retention/auto-deletion and multi-region replication?

   • ARelevant data may be auto-purged or its location obscured unless retention is suspended and preservation is coordinated with the provider's capabilitiesCorrect
   • BLitigation holds automatically override the provider's replication settings without any customer action
   • CMulti-region replication satisfies the preservation duty on its own, so no hold configuration is needed
   • DThe provider's default retention window is always longer than any litigation hold requires
   ✓ Correct answer: A

   This answer directly addresses the key concept tested in this security certification question. Understanding this topic is essential for compliance and effective risk management. Organizations must implement this practice as part of their overall security and governance program. Regular assessment and improvement of this area ensures alignment with industry standards and regulatory requirements. This represents a critical control point in the security architecture.

   Why the other options are wrong

   • BA hold does not automatically reconfigure the provider; preservation must be actively coordinated and applied.
   • CReplication improves durability but does not stop lifecycle deletion, so it cannot satisfy the hold by itself.
   • DDefault retention windows are not guaranteed to exceed a hold, so relevant data can still be auto-deleted.
4. Question 4Cloud Platform and Infrastructure Security

   An IaC deployment intermittently creates resources with overly permissive security groups in production but not in staging. Both use the same module, but production overrides a variable. What is the best way to prevent recurrence?

   • AGrant the deployment pipeline full administrative rights to fix issues at runtime
   • BTurn off configuration drift detection to reduce alerting noise
   • CAdd policy-as-code guardrails in the pipeline to reject non-compliant configurations before applyCorrect
   • DStop using infrastructure as code and configure the resources manually instead
   ✓ Correct answer: C

   This answer directly addresses the key concept tested in this security certification question. Understanding policy is essential for compliance and effective risk management. Organizations must implement this practice as part of their overall security and governance program. Regular assessment and improvement of this area ensures alignment with industry standards and regulatory requirements. This represents a critical control point in the security architecture.

   Why the other options are wrong

   • AGranting full admin broadens blast radius and does not prevent permissive configurations.
   • BDisabling drift detection hides problems rather than preventing overly permissive rules.
   • DManual configuration removes repeatability and increases the chance of misconfiguration.
5. Question 5Cloud Data Security

   A data discovery tool inspects the actual contents of files using pattern matching and dictionaries to locate things like credit card numbers. Which data-discovery method is this?

   • AContent-based (content analysis) discoveryCorrect
   • BLabel-based discovery relying on pre-assigned classification tags
   • CMetadata-based discovery using file attributes only
   • DHash-based discovery comparing known-file fingerprints
   ✓ Correct answer: A

   Content-based discovery opens and examines the data itself, using techniques such as regular-expression pattern matching, keyword dictionaries, and statistical analysis to identify sensitive items like PANs or SSNs. It is more thorough than relying on tags or attributes because it does not depend on data being pre-labeled. This makes it effective at catching unlabeled or mislabeled sensitive data.

   Why the other options are wrong

   • BLabel-based discovery depends on classification tags already applied to the data and will miss anything unlabeled or mislabeled.
   • CMetadata-based discovery examines attributes like file name, size, or timestamps and does not read the sensitive content within.
   • DHash-based discovery matches files against known fingerprints and cannot recognize new or variant sensitive content patterns.
6. Question 6Cloud Platform and Infrastructure SecuritySelect all that apply

   An auditor reviews logging coverage for a cloud environment. Which TWO log sources are MOST important for detecting unauthorized changes to the cloud control plane and network flows? (Choose TWO)

   • ACloud management API/audit logs (e.g., CloudTrail / Activity Log / Cloud Audit Logs)Correct
   • BVirtual network flow logs (e.g., VPC Flow Logs / NSG Flow Logs)Correct
   • CApplication debug logs written to local instance disk only
   • DStatic infrastructure-as-code template files in the repository
   ✓ Correct answer: A, B

   Cloud management API audit logs (CloudTrail, Azure Activity Log, Cloud Audit Logs) record who made which control-plane changes, making them essential for detecting unauthorized modifications. Network flow logs capture accepted and rejected connections, supporting detection of anomalous or malicious traffic. Together they cover both the management plane and the data/network plane.

   Why the other options are wrong

   • CLocal-only application debug logs are easily lost or tampered with on a compromised host and do not capture control-plane or network-level activity.
   • DIaC template files describe intended configuration but are not runtime logs and cannot reveal who actually made unauthorized changes.
7. Question 7Cloud Security OperationsSelect all that apply

   Which TWO practices strengthen secure management of the underlying physical and logical infrastructure that a cloud provider operates for its data centers? (Choose TWO)

   • AEnforcing strict physical access controls (badge/biometric, mantraps, visitor escorting) and environmental controls in the data centerCorrect
   • BPublishing exact rack locations and host identifiers of tenant workloads to all customers
   • CMaintaining redundant power, cooling, and network paths with documented capacity and maintenance managementCorrect
   • DAllowing maintenance technicians unaudited remote access to production hypervisors
   ✓ Correct answer: A, C

   Physical security (mantraps, biometrics, escorting) prevents unauthorized data-center access, while environmental and redundancy controls maintain availability and resilience. Capacity and maintenance management ensure the infrastructure can meet demand and is serviced without compromising security. These are core provider responsibilities for the physical and logical estate.

   Why the other options are wrong

   • BPublishing the physical placement of tenant workloads leaks information attackers could exploit and breaks tenant confidentiality.
   • DUnaudited remote access to production hypervisors is a major risk; such access must be least-privilege and fully logged.
8. Question 8Cloud Security OperationsSelect all that apply

   Which TWO practices strengthen the security operations of the underlying virtualization/hypervisor layer in a cloud environment? (Choose TWO)

   • AKeeping the hypervisor and its management plane patched and isolated on a dedicated management networkCorrect
   • BGranting every guest VM direct read access to the hypervisor's memory for performance
   • CHardening and minimizing the hypervisor host, disabling unused services and management interfacesCorrect
   • DAllowing tenants to install custom kernel modules into the host hypervisor
   ✓ Correct answer: A, C

   The hypervisor is a high-value target because compromising it can affect all hosted guests (VM escape, cross-tenant exposure). Sound practice keeps the hypervisor and its management interfaces patched, isolated on a restricted management network, and stripped of unnecessary services. These controls reduce both the attack surface and the blast radius of any compromise.

   Why the other options are wrong

   • BGiving guests direct access to hypervisor memory would destroy tenant isolation and enable cross-VM data theft.
   • DAllowing tenants to load custom kernel modules into the host hypervisor would let them tamper with the trusted base and break isolation.
9. Question 9Cloud Data Security

   An analyst relies solely on object labels to drive data discovery in a cloud bucket. A breach later reveals unlabeled spreadsheets full of personal data. Which limitation of label-based discovery does this MOST clearly expose?

   • ALabel-based discovery misses data that was never tagged or was mislabeled, so unclassified sensitive data goes undetectedCorrect
   • BLabel-based discovery decrypts each object before reading its tag, so it cannot run without the data encryption key
   • CLabel-based discovery consumes far more compute than deep content inspection of the same repositories
   • DLabel-based discovery can be applied only to structured database tables and never to unstructured files
   ✓ Correct answer: A

   Label-based discovery is fast and cheap but inherits the quality of the tagging. Anything that was never classified, was imported without labels, or was mislabeled will not surface, leaving regulated data hidden. Combining content analysis with label-based methods closes that gap.

   Why the other options are wrong

   • BReading a metadata label does not require decrypting the object, so this is not the limitation.
   • CLabel-based discovery is lightweight; content inspection, not labeling, is the compute-heavy approach.
   • DLabels can be applied to files as well as tables, so the stated scope limitation is false.
10. Question 10Cloud Application SecuritySelect all that apply

    A cloud team is shifting security left in its CI/CD pipeline. Which TWO checks are MOST appropriate to run automatically on every code commit, before deployment? (Choose two.)

    • AStatic application security testing (SAST) of the source codeCorrect
    • BSoftware composition analysis (SCA) of dependenciesCorrect
    • CAnnual third-party physical site audit
    • DQuarterly board risk-appetite review
    ✓ Correct answer: A, B

    Shifting left means catching defects as early and as cheaply as possible. SAST scans source for coding flaws and SCA flags vulnerable or non-compliant dependencies. Both integrate directly into commit and build stages, providing rapid feedback to developers.

    Why the other options are wrong

    • CA physical site audit is periodic and unrelated to per-commit code checks.
    • DA board risk-appetite review is a governance activity, not a pipeline check.

Related Security resources

• (ISC)² CCSP study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

(ISC)² CCSP practice exam FAQ