ISC2 CCSP Practice Test

CCSP practice test: what's covered

• Certified Cloud Security Professional

Free CCSP sample questions

1. A CISO is evaluating moving a financial analytics workload to a public cloud. The workload bursts heavily at quarter-end but is otherwise idle. Which NIST SP 800-145 essential characteristic MOST directly justifies the cloud migration from a cost perspective?

   • A. Broad network access
   • B. Rapid elasticity
   • C. Resource pooling
   • D. Measured service
   Show answer

   Correct: B. Rapid elasticity lets the workload scale out at quarter-end and scale in afterwards — paying only for the spike. Measured service (B) is the metering capability that supports billing but is not the cost driver itself; without elasticity, you would still pay for idle capacity. Resource pooling enables multi-tenancy efficiencies for the provider but does not directly drive the CSC's cost savings.

2. A Cloud Service Customer (CSC) signs up for a SaaS HR platform. The CSP encrypts the database, manages OS patching, and hardens the hypervisor. Under the shared responsibility model, which control is MOST clearly STILL the CSC's responsibility?

   • A. Physical security of the data center
   • B. User access provisioning and role assignments within the HR application
   • C. Hypervisor vulnerability patching
   • D. Underlying network fabric isolation
   Show answer

   Correct: B. In SaaS the CSP owns nearly everything below the application; the CSC is left with identity, access, data classification, and usage policy. Provisioning users and assigning HR roles is squarely the CSC's job. The trap (B in some forms) is to assume the CSP handles "everything" in SaaS — they do not handle in-app authorization decisions.

3. Which TWO roles are formally defined in the ISO/IEC 17788 cloud computing reference architecture? (Choose 2)

   • A. Cloud Service Customer (CSC)
   • B. Cloud Service Provider (CSP)
   • C. Cloud Service Broker (CSB)
   • D. Cloud Threat Actor
   • E. Cloud Forensics Auditor
   Show answer

   Correct: A and B. ISO/IEC 17788 formally defines CSC, CSP, and Cloud Service Partner (which includes broker and auditor roles). Many candidates select CSB because NIST mentions it — but the question is scoped to ISO 17788, where CSB sits under the broader "Cloud Service Partner" umbrella, not as a separate top-level role. Threat actor and forensics auditor are not architectural roles in the standard.

4. Which TWO statements correctly describe responsibility allocation across cloud service models? (Choose 2)

   • A. In IaaS, the CSC is responsible for guest OS, runtime, and application security
   • B. In SaaS, the CSC has no responsibility — the CSP handles everything including user access management
   • C. In PaaS, the CSP manages OS patching and runtime, while the CSC manages app code and data
   • D. In all models, the CSP owns the physical data center security
   • E. IaaS, PaaS, and SaaS allocate identical responsibilities to the CSC
   Show answer

   Correct: A and C. IaaS = CSC owns OS+up; PaaS = CSC owns app+data; SaaS = CSC owns data + access mgmt + config. (B) is the classic misconception — even in SaaS the CSC owns user provisioning and authorization. (D) is partially true but doesn't describe the model split. Models clearly do NOT allocate identical responsibilities.

5. A regulated bank wants the agility of public cloud for dev/test but must keep production workloads on infrastructure they exclusively control for compliance. Which deployment model is MOST appropriate?

   • A. Public cloud with VPC isolation
   • B. Hybrid cloud
   • C. Community cloud
   • D. Multi-cloud with two public CSPs
   Show answer

   Correct: B. Hybrid combines a private cloud (for regulated prod) with public cloud (for elastic dev/test) bound by standardized technology enabling data and application portability. Public with VPC (B) is still public — VPC does not give exclusive infrastructure control. Community cloud is shared by organizations with common concerns, not single-tenant.

Last updated: 2026-10-19

CCSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test