(ISC)² CCSP Practice Exam

What the (ISC)² CCSP exam covers

• Cloud Concepts, Architecture and Design159 questions
• Cloud Data Security191 questions
• Cloud Platform and Infrastructure Security171 questions
• Cloud Application Security150 questions
• Cloud Security Operations170 questions
• Legal, Risk and Compliance122 questions

Free (ISC)² CCSP practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 963.

1. Question 1Cloud Concepts, Architecture and Design

   In the cloud shared responsibility model, who is responsible for securing data and access configuration?

   • AThe customer (the provider secures the underlying cloud infrastructure)Correct
   • BThe provider (the customer only manages billing and account contacts)
   • CThe provider secures data while the customer secures physical racks
   • DA regulator sets both data and access controls for all tenants
   ✓ Correct answer: A

   The customer is responsible. In the cloud shared responsibility model the provider secures the underlying infrastructure (physical facilities, hardware, hypervisor, and managed services), while the customer is always responsible for their data, its classification, and identity/access configuration (IAM policies, permissions, and credentials). Regardless of service model, data and access control remain the customer's duty, making A the correct answer.

   Why the other options are wrong

   • BThe customer, not the provider, always retains responsibility for data classification and access configuration in every service model.
   • CCustomers never manage physical racks in public cloud; the provider owns physical security while the customer owns data and access.
   • DRegulators define compliance obligations but do not operationally set a tenant's data protection or access controls.
2. Question 2Cloud Application Security

   In a Kubernetes Pod spec, which securityContext setting prevents the container process from gaining additional privileges via setuid binaries?

   • AsecurityContext: { allowPrivilegeEscalation: false }Correct
   • BsecurityContext: { runAsUser: 0 }, running the container as root
   • ChostNetwork: true, sharing the node network namespace directly
   • DsecurityContext: { privileged: true }, granting broad host access
   ✓ Correct answer: A

   allowPrivilegeEscalation: false sets the no_new_privs kernel flag on the container process, preventing it from ever gaining more privileges than its own parent process had, which blocks the classic setuid-binary escalation path where a process executes a binary with the setuid bit to assume a more privileged user. This is a standard Pod Security Standards hardening setting, applied alongside running as non-root and dropping unneeded Linux capabilities. Takeaway: it constrains what a compromised or malicious process can still do even after code execution inside the container.

   Why the other options are wrong

   • BrunAsUser: 0 runs the process as root but does not stop setuid binaries from escalating further.
   • ChostNetwork: true shares the node's network stack; it has no effect on privilege escalation.
   • Dprivileged: true grants broad host capabilities, the opposite of blocking escalation.
3. Question 3Cloud Security Operations

   What does a defined log retention policy primarily balance?

   • AThe number of log sources against the number of parsing rules
   • BReal-time alerting speed against dashboard refresh frequency
   • CCompliance/forensic needs against storage cost and privacy obligationsCorrect
   • DLog verbosity level against the count of monitored metrics
   ✓ Correct answer: C

   A log retention policy sets how long log categories are kept, a direct trade-off between two pressures. Compliance mandates (PCI DSS, HIPAA, contractual SLAs) and forensic needs push retention longer, since evidence discovered months after an incident is only useful if the logs still exist. Storage cost scales with retention length and volume, and privacy regulations like GDPR limit how long personal data, including data embedded in logs, may be kept without a lawful basis. Setting retention means balancing needed historical visibility against storage cost and privacy limits. This differs from pipeline sizing (source/parser counts), real-time operational concerns (alerting speed, dashboard refresh), and log verbosity, which governs volume generated rather than duration stored.

   Why the other options are wrong

   • ASource and parser counts are pipeline sizing details, not the retention-duration trade-off the policy governs.
   • BAlerting speed versus dashboard refresh is a performance concern, unrelated to how long logs are kept.
   • DVerbosity and metric counts affect volume, but retention policy balances keeping data against cost and privacy.
4. Question 4Cloud Security Operations

   Why should cloud audit logs be exported to a separate, append-only/immutable account or store?

   • ATo compress the log entries so they consume less storage in the workload account
   • BTo let any internet user search the logs for faster crowd-sourced troubleshooting
   • CTo let each service write logs using its own local clock without synchronization
   • DTo prevent an attacker who compromises the workload account from deleting or altering evidenceCorrect
   ✓ Correct answer: D

   If audit logs stay in the same account as the workload they describe, an attacker who fully compromises that account, or a malicious insider with admin rights there, can simply delete or edit entries to erase evidence. Exporting logs continuously to a separate, dedicated account with tightly restricted access and write-once/immutable storage means compromising the workload account gives no path to the historical record, since it lives outside that compromise's blast radius. This separation of duties between the monitored account and the account holding the audit trail is a foundational logging control.

   Why the other options are wrong

   • AIsolating logs in a separate account protects integrity against tampering; it is a security control, not a storage-compression technique.
   • BThe point of restricting the destination account is to limit access to trusted responders, never to expose logs to arbitrary internet users.
   • CSeparating log storage does not remove the need for synchronized clocks; unsynchronized timestamps would undermine forensic timelines.
5. Question 5Cloud Data Security

   Which event source is MOST important to forward to a SIEM in order to detect unauthorized access attempts against sensitive data stored in a cloud object store?

   • AData event (object-level) access logs for the storage serviceCorrect
   • BLoad-balancer request-per-second throughput counters
   • CVirtual-network flow logs for the compute subnet
   • DContainer image build and push events from the registry
   ✓ Correct answer: A

   Data events, such as S3 object-level logging or storage account diagnostic logs, capture individual read/write/delete operations and the identities performing them. Forwarding these to a SIEM lets analysts detect anomalous or unauthorized access to sensitive objects, correlate with identities, and trigger alerts.

   Why the other options are wrong

   • BLoad-balancer throughput counters measure traffic volume, not who accessed which sensitive object in the store.
   • CSubnet flow logs show packet-level connections but not the object-level read/write actions on stored data.
   • DRegistry build and push events concern container artifacts, not access attempts against the object store's data.
6. Question 6Cloud Application Security

   A team is selecting a cloud application architecture and wants to understand the shared responsibility implications of choosing Function-as-a-Service (serverless) over deploying to virtual machines. Which statement is correct?

   • AWith FaaS the provider patches the OS and runtime, so the customer focuses on code, dependencies, and permissionsCorrect
   • BWith FaaS the customer becomes responsible for patching the underlying hypervisor and host operating system layers
   • CServerless entirely eliminates all application-layer security responsibilities for the customer
   • DDeploying to VMs shifts dependency and code-vulnerability responsibility entirely to the cloud provider itself
   ✓ Correct answer: A

   Moving up the abstraction stack from IaaS to serverless shifts more operational responsibility to the provider, who manages the host, OS, and language runtime. The customer's remaining security duties center on writing secure function code, managing third-party dependencies, scoping IAM permissions tightly, and protecting data and configuration.

   Why the other options are wrong

   • BThe provider, not the customer, patches the hypervisor and host OS in a FaaS model; that is the entire point of the abstraction.
   • CServerless does not remove application-layer responsibilities; insecure code, vulnerable dependencies, and over-broad permissions remain the customer's problem.
   • DDeploying to VMs (IaaS) leaves OS patching, application code, and dependency security with the customer, not the provider.
7. Question 7Cloud Security OperationsSelect all that apply

   An organization is defining a business continuity and disaster recovery (BC/DR) strategy for cloud-hosted services. Which TWO operational practices strengthen recoverability? (Choose TWO)

   • ARegularly testing failover and restore procedures and validating against defined RTO/RPO targetsCorrect
   • BStoring the only backup copy in the same region and availability zone as production
   • CMaintaining geographically distributed, immutable backups with periodic restore verificationCorrect
   • DAssuming the cloud provider's SLA alone guarantees recovery of customer data
   ✓ Correct answer: A, C

   Testing failover and restores confirms that recovery actually works and meets the recovery time and recovery point objectives, while geographically distributed immutable backups with restore verification protect against regional outages, ransomware, and silent corruption. Together they make recovery dependable rather than assumed. These are core BC/DR operational disciplines.

   Why the other options are wrong

   • BKeeping the only backup in the same region/AZ as production means a regional failure destroys both production and the backup.
   • DProvider SLAs cover service availability, not recovery of the customer's own data, which remains the customer's responsibility.
8. Question 8Cloud Data Security

   A payment platform wants to remove primary account numbers (PANs) from its application databases so that a database compromise yields no recoverable card numbers, while still letting the application reference a stand-in value that can be reversed only inside a separate, tightly controlled vault. Which technique is the BEST fit?

   • ATokenization, replacing each PAN with a non-sensitive token mapped to the real value in a segregated token vaultCorrect
   • BStatic data masking that overwrites the PANs with fixed asterisks in place, permanently losing the original value
   • CAnonymization that irreversibly strips all identifying detail from the records, with no way to recover it later
   • DHashing each PAN with SHA-256 and storing only the resulting digest in the application database
   ✓ Correct answer: A

   Tokenization replaces the sensitive PAN with a surrogate token that has no exploitable value on its own. The real value lives only in a segregated token vault with strict access control, so a breach of the application database exposes only tokens. Because the mapping is preserved in the vault, authorized processes can detokenize when genuinely needed, satisfying both the reduce-scope and reversible-when-authorized requirements.

   Why the other options are wrong

   • BStatic masking overwrites the value irreversibly in place, so the application could not later reference and recover the true PAN.
   • CAnonymization is intentionally irreversible, which contradicts the need to reverse the value inside a controlled vault.
   • DA SHA-256 hash is one-way and cannot be reversed to recover the PAN, and unsalted hashes of structured values like PANs are also susceptible to lookup attacks.
9. Question 9Cloud Application Security

   A cloud web application is being targeted by automated attacks attempting cross-site scripting and SQL injection over HTTP. Which control is purpose-built to inspect and filter this Layer 7 traffic?

   • AA web application firewall (WAF)Correct
   • BA network access control list (ACL) at Layer 3
   • CFull-disk encryption on the application servers
   • DA VPN concentrator
   ✓ Correct answer: A

   A WAF operates at Layer 7 and applies rules and signatures to web requests, filtering common application attacks before they reach the app. It is a key defense-in-depth layer for internet-facing cloud applications, complementing secure coding rather than replacing it.

   Why the other options are wrong

   • BA Layer 3 ACL filters IPs and ports and cannot parse HTTP payloads for XSS or SQLi.
   • CDisk encryption protects data at rest, not inbound web attacks.
   • DA VPN secures tunnels for remote access, not public web request inspection.
10. Question 10Legal, Risk and Compliance

    An organization is formalizing how it governs a portfolio of outsourcing arrangements, including cloud services, over their full lifecycle. Which international standard provides guidance specifically on outsourcing governance?

    • AISO 37500Correct
    • BISO 27017
    • CISO 22301
    • DISO 9001
    ✓ Correct answer: A

    ISO 37500 offers a framework for outsourcing governance, covering strategy, initiation, transition, and ongoing management of outsourcing relationships including cloud. It helps organizations structure vendor management and supplier oversight consistently across the arrangement's lifecycle.

    Why the other options are wrong

    • BISO 27017 provides cloud security controls guidance, not outsourcing governance.
    • CISO 22301 addresses business continuity management, not outsourcing governance.
    • DISO 9001 covers quality management systems generally, not outsourcing relationship governance.

Who this (ISC)² CCSP practice exam is for

This practice set is for anyone preparing for the (ISC)² CCSP exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this (ISC)² CCSP practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real (ISC)² CCSP exam.

Related Security resources

• (ISC)² CCSP study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• (ISC)² CGRC (Governance, Risk and Compliance) practice examRelated
• (ISC)² CISSP practice examRelated

(ISC)² CCSP practice exam FAQ