Certified Cloud Security Professional (CCSP)

Last checked October 22, 2026 against the official ISC2 exam page.

1. Question 1Cloud Concepts, Architecture and Design

   A regulated workload must run in a provider's data centre, but on infrastructure dedicated to one organisation. Which cloud deployment model fits?

   1. APrivate cloud operated by a third-party provider, where the infrastructure is dedicated to the single organisation using it
   2. BCommunity cloud, shared among several organisations that have a common compliance requirement and a shared mission to meet
   3. CPublic cloud with a dedicated tenancy option, where the provider shares its underlying hardware pools with other customers
   4. DHybrid cloud that combines the organisation's own data centre with a public provider that serves many other tenants
   Show answer and explanationHide answer

   Correct answer: A

   A managed private cloud is run by a provider but dedicated to one organisation, which matches the isolation the workload needs. Community clouds are shared among a group, public clouds share infrastructure across tenants, and hybrid clouds mix models rather than describing one dedicated environment.

2. Question 2Cloud Data Security

   Which data state does TLS protect between a client application and a cloud API?

   1. AData in transit, which covers the data moving across networks between a client and a service while the connection is open
   2. BData at rest, which covers the data stored on disks, in objects and in backups held by the provider in its storage systems
   3. CData in use, which covers the data that an application processes in the memory of a server while it is running a job
   4. DData in archive, which covers older records kept for compliance that are rarely read after they are first stored by the team
   Show answer and explanationHide answer

   Correct answer: A

   TLS protects data in transit, the data moving between the client and the service. At-rest, in-use and archive are separate states that TLS does not cover on its own.

3. Question 3Cloud Platform & Infrastructure Security

   Which virtualisation risk matters most in a multi-tenant cloud when a guest VM breaks out of its isolation?

   1. AHypervisor escape, where an attacker breaks out of a guest virtual machine to reach the host or the guests of other tenants
   2. BCertificate expiry, where an expired certificate stops the guest operating system from loading correctly during each boot cycle
   3. CDisk fragmentation, where the file system scatters data across blocks, which slows reads inside the guest over a long period
   4. DLatency jitter, where the network delay between requests varies over time, but no data is exposed to any other tenant at all
   Show answer and explanationHide answer

   Correct answer: A

   A hypervisor escape lets code in one guest reach the host or other tenants, which is the core multi-tenant isolation risk. Certificate expiry, disk fragmentation and latency jitter are operational issues that do not cross tenant boundaries.

4. Question 4Cloud Application Security

   A cloud application must verify that API callers present a valid, unexpired token from a trusted identity provider. Which standards fit?

   1. AA shared password typed into a configuration file that the API reads on each request for every user who calls it
   2. BOAuth 2.0 and OpenID Connect, which issue access and identity tokens that APIs validate against the trusted provider
   3. CIP allowlisting as the only check, which trusts any caller that arrives from a known network address range of the company
   4. DBasic HTTP authentication with one service account password that all clients of the API share between them for simplicity
   Show answer and explanationHide answer

   Correct answer: B

   OAuth 2.0 and OpenID Connect provide delegated access and identity tokens that APIs can validate, including expiry and issuer. Shared passwords, IP allowlists alone and shared basic credentials do not identify individual users or validate tokens.

5. Question 5Cloud Security Operations

   A SOC needs audit events from all cloud accounts in one place for detection. Which pattern is most appropriate?

   1. ADelete the logs after 24 hours to reduce storage costs, since the SIEM only needs recent events in order to run its detections
   2. BKeep logs only in each account and have analysts sign in to every account separately each day to check the events by hand
   3. CCentralise logs from every account into a dedicated security account with restricted access, then forward them to the SIEM
   4. DSend the logs to a shared developer workspace so that engineers can find them quickly while they are debugging an application
   Show answer and explanationHide answer

   Correct answer: C

   Centralising logs in a restricted security account keeps them tamper-resistant and gives the SIEM one view across accounts. Per-account checks are slow, deleting logs removes evidence, and developer workspaces lack the access separation the SOC needs.