EC-Council 312-40: Certified Cloud Security Engineer (C|CSE)

Last checked November 10, 2026 against the official EC-Council exam page.

1. Question 1Cloud fundamentals

   A startup's web application receives heavy traffic during a weekly promotion and very little the rest of the week. The team wants compute capacity to rise and fall automatically with demand, without filing manual provisioning requests. Which NIST essential characteristic of cloud computing best matches this requirement?

   1. AResource pooling
   2. BRapid elasticity
   3. CBroad network access
   4. DMulti-tenant sharing of hardware between customers
   Show answer and explanationHide answer

   Correct answer: B

   Rapid elasticity means capacity is provisioned and released automatically to match demand, which is exactly what the scenario asks for. Resource pooling describes sharing provider resources among consumers, broad network access describes availability over standard networks, and multi-tenant hardware sharing is an implementation pattern rather than an essential characteristic.

2. Question 2Shared responsibility

   A company uses a managed database service. The provider patches the database engine and maintains the underlying hardware. The company still decides who may query the tables and whether data is encrypted at rest. Which party is responsible for those decisions?

   1. AThe cloud provider, because it operates the database engine
   2. BThe internet service provider carrying the database traffic
   3. CBoth parties equally, with no defined boundary between them
   4. DThe customer, because it controls data and access settings
   Show answer and explanationHide answer

   Correct answer: D

   Under the shared responsibility model, the customer remains responsible for its data, access decisions and encryption configuration even when the provider manages the engine and hardware. The provider's responsibility covers the platform, the shared responsibility model does define a boundary, and network carriers are not part of the customer's contract.

3. Question 3Standards

   Which NIST special publication provides the widely cited definition of cloud computing, including its five essential characteristics and three service models?

   1. ANIST SP 800-145
   2. BNIST SP 800-53
   3. CNIST SP 800-37
   4. DNIST SP 800-171
   Show answer and explanationHide answer

   Correct answer: A

   NIST SP 800-145 defines cloud computing, its essential characteristics, deployment models and service models. SP 800-53 is a catalog of security and privacy controls, SP 800-37 describes the risk management framework, and SP 800-171 covers protection of controlled unclassified information.

4. Question 4Legal and compliance

   A company based in the European Union stores customer profiles with a cloud provider. The company decides the purposes and means of processing, while the provider processes the data only on documented instructions. Under GDPR, which role does the company hold?

   1. AData controller
   2. BData processor
   3. CData subject
   4. DSupervisory authority
   Show answer and explanationHide answer

   Correct answer: A

   Under GDPR the controller determines the purposes and means of processing, which describes this company. The provider acts as the processor, the data subjects are the individuals whose data is held, and a supervisory authority is the regulator.

5. Question 5Cloud fundamentals

   Which cloud deployment model is dedicated to one organization rather than shared with outside consumers?

   1. APublic cloud open to the general public
   2. BCommunity cloud shared by organizations with common concerns
   3. CHybrid cloud combining two distinct deployment models
   4. DPrivate cloud operated for a single organization
   Show answer and explanationHide answer

   Correct answer: D

   A private cloud is provisioned for exclusive use by a single organization, whether that organization or a third party runs it. A public cloud is open to the general public, a community cloud serves a defined group with shared concerns, and a hybrid cloud combines two or more distinct models.