ISC2 Certified Cloud Security Professional (CCSP) - Blueprint Practice Exam 1

1. A business transfers an application to a cloud provider but retains residual risk beyond its stated tolerance. Who should make the authorized acceptance decision?
2. A capacity alarm fires every day during an approved batch workload and repeatedly obscures unrelated security alerts. What is the best operational response?
3. A change to network policy blocks legitimate production traffic. Which practice best supports safe recovery?
4. A CI pipeline signs a release artifact. What must the deployment process verify before trusting the signature?
5. A cloud customer wants to assess isolation between its virtual machines and other tenants. Which evidence is most relevant?
6. A cloud database stores sensitive values in encrypted columns, but an application user can issue unrestricted export queries. What is the principal remaining risk?
7. A cloud provider supplies an independent control report. Which review is essential before relying on it for assurance?
8. A company deploys replicas in two availability zones but keeps its only backup in the same account with identical administrator access. What weakness remains?
9. A company is choosing a cloud processing location for personal information from several jurisdictions. What is the appropriate decision process?
10. A company selects SaaS for payroll. Which activity remains essential for its security team despite outsourcing the application stack?
11. A company wants employees to authenticate to a cloud application with its corporate identity provider and a second factor. Which combination fits?
12. A critical service's recovery plan assumes that a provider can restore a database, but no recovery exercise has occurred. What is the best next validation?
13. A customer needs the ability to leave a SaaS provider without losing essential records. Which contractual topic is most directly relevant?
14. A database must lose no more than ten minutes of committed data and return within two hours. Which requirements express these targets?
15. A development team needs realistic customer data but must not receive production identity values. The application does not need to recover those original identities. Which approach best fits?
16. A document processed by an AI assistant includes instructions to reveal another user's records. Which design best limits the impact?
17. A finance team wants one authoritative identity source for several SaaS products while each product retains its own permissions. Which design fits?
18. A payment service must replace account numbers with surrogates and recover originals only through a tightly controlled service. Which mechanism fits?
19. A platform team adopts immutable machine images. A new critical patch becomes available. Which response best follows that operating model?
20. A production workload uses isolated subnets, but all instances share an unrestricted deployment identity. What should be prioritized?
21. A provider publishes a critical vulnerability affecting managed database software. What should the customer do first operationally?
22. A records dataset is scheduled for deletion, but counsel issues a preservation notice covering specific records. What should the cloud team do?
23. A retailer moves its application to IaaS virtual machines. The provider manages the physical hosts. Who normally remains responsible for patching the guest operating systems?
24. A security analytics pilot uses machine learning to block accounts automatically. Which control best addresses unreliable model decisions?
25. A security team sees repeated alerts for one compromised access key. Which action directly contains that credential's use?
26. A team is designing a new cloud payment API. When should threat modeling begin for the greatest design benefit?
27. A team must move a containerized service between two cloud providers within one week. Which requirement most directly supports this goal?
28. A team wants to identify vulnerable third-party libraries before releasing its container image. Which assessment is most relevant?
29. A team will send internal documents to a hosted AI service for retrieval. Which two checks directly reduce unintended disclosure? Select 2 answers.
30. A tenant requests cryptographic erasure of a dataset. What must be established before relying on deletion of its encryption key?
31. A tenant retains logs locally in the same account administered by the people being monitored. Which improvement strengthens evidence integrity?
32. An analyst suspects a short-lived cloud instance is compromised. Its disk and memory may disappear when it is terminated. What should the response plan enable?
33. An analytics export is sent to an approved partner. The business needs document access to expire even after download. Which capability should be evaluated?
34. An API returns a document when a caller supplies its identifier, without checking the caller's access to that document. Which control directly addresses the flaw?
35. An application server needs database access, while unrelated workloads must not reach the database. Which network rule best fits?
36. An audit discovers a customer control required by its provider's assurance report was never implemented. What is the best response?
37. An incident review finds that a replicated dataset was copied outside approved regions. Which preventive control most directly addresses the cause?
38. An organization plans an encrypted cloud workload whose threat model includes provider administrators reading memory. Which additional capability should it evaluate?
39. Cloud logs arrive from several accounts with inconsistent clocks. Which improvement most directly supports incident correlation?
40. Two independent cloud services use the same upstream identity provider. An outage of that provider stops both services. What was overlooked in the resilience assessment?

Comments — 0