CISSP.app Blog
In This Article
- How to Use These Worked Examples
- Domain 1: Cloud Concepts, Architecture & Design (3 questions)
- Domain 2: Cloud Data Security (3 questions)
- Domain 3: Cloud Platform & Infrastructure Security (3 questions)
- Domain 4: Cloud Application Security (3 questions)
- Domain 5: Cloud Security Operations (2 questions)
- Domain 6: Legal, Risk & Compliance (2 questions)
- What Your Score Means
- FAQ
Most “free CCSP practice questions” resources fall into one of two traps: they either list sources without giving you actual questions, or they dump 50 bare questions with minimal explanation. Neither prepares you for how the CCSP exam actually tests judgment.
This article takes a different approach. Each of the 16 questions below includes the full stem, four answer choices, the correct answer clearly labeled, and a complete explanation — including why the wrong answers are wrong. That last part is where most candidates learn the most.
The 16 questions below are weighted to mirror the actual CCSP exam blueprint: Domain 2 (20%) gets the most questions, Domain 6 (13%) gets the fewest. This isn’t random — it reflects where the exam tests you hardest. For a full breakdown of domain weights and where to focus, see our CCSP domain weighting guide.
How to Use These Worked Examples
Don’t just read through these passively. For each question:
- Read the stem and all four options.
- Choose your answer before looking at the explanation.
- If you got it wrong, read every part of the explanation — including why the wrong options fail.
- Note which domain each mistake comes from. Patterns in your errors point directly to where you need more practice.
The CCSP exam tests applied judgment in ambiguous cloud security scenarios. Many questions have two answers that are technically correct — but one is the best answer given the specific context. Training yourself to find the best answer, not just a correct one, is the core skill this exam measures.
These are original practice questions written in the style of the CCSP exam — they are not actual exam questions. (ISC)² strictly prohibits sharing real exam content, and sites offering “real dumps” put your credential at risk of revocation. Practice with representative questions like these, not brain dumps.
Domain 1: Cloud Concepts, Architecture & Design
Exam weight: 17% — approximately 26 questions. Focus: shared responsibility models, cloud service and deployment models, cloud reference architectures.
A financial services company is migrating customer data to a SaaS application. The security team is concerned about data visibility and the ability to enforce access policies inside the SaaS platform. Which control would BEST address both concerns simultaneously?
Why C is correct: A CASB in API mode connects directly to the SaaS platform’s APIs and gives the customer visibility into data at rest inside the SaaS environment, as well as the ability to enforce access and DLP policies within that environment. It addresses both concerns named in the question.
Why A fails: A perimeter DLP appliance only sees traffic leaving your corporate network. It cannot inspect direct cloud-to-cloud traffic or data already stored inside the SaaS platform. It addresses neither data visibility inside SaaS nor policy enforcement within the SaaS application.
Why B fails: A VPN provides an encrypted transport channel but adds no inspection or policy enforcement capability inside the SaaS application itself.
Why D fails: A vendor-managed WAF protects the application from external attacks but is controlled by the vendor, not the customer. It does not give the customer visibility into their own data or control over access policies.
An organization needs to host a regulated application and wants to control the operating system, middleware, and runtime environment while offloading all physical infrastructure management to a cloud provider. Which cloud service model BEST fits this requirement?
Why C is correct: IaaS gives the customer control over the operating system, middleware, and runtime stack. The CSP manages physical hardware, networking, and virtualization. This matches the requirement exactly: control OS and above, offload physical infrastructure.
Why B is wrong: PaaS abstracts the operating system away — the customer cannot control the OS or runtime directly. PaaS gives control over the application and data only.
Why A is wrong: SaaS abstracts everything; the customer only manages data and user access. No control over OS, middleware, or runtime.
Why D is wrong: FaaS (serverless) abstracts even further than PaaS. The customer writes function code but has no control over the OS, runtime version selection, or middleware.
A regulated industry consortium has agreed to share a cloud environment with defined governance rules. One member organization has a significantly larger data footprint than the others. Which entity is PRIMARILY responsible for defining the governance model of this cloud deployment?
Why C is correct: A community cloud is governed by the community of members itself — either collectively or through a governance body they establish. This is a defining characteristic of the community cloud model.
Why A is wrong: The CSP provides infrastructure but does not define governance for a community cloud. The CSP manages its own responsibilities under the shared responsibility model, but community governance belongs to the community.
Why B is wrong: Regulators set compliance requirements that governance must satisfy — but they don’t govern the cloud deployment itself.
Why D is wrong: Data volume does not confer governance authority in a community cloud. Every member organization has equal standing unless the consortium explicitly assigns authority otherwise.
Domain 2: Cloud Data Security
Exam weight: 20% — approximately 30 questions. The highest-weighted domain. Focus: cloud data lifecycle, encryption key management, CASB controls, data discovery and classification.
An organization processes sensitive PII in a public cloud environment. The CISO wants to ensure that if the CSP’s internal systems are compromised, the CSP cannot access customer data in plaintext. Which encryption approach BEST achieves this requirement?
Why C is correct: HYOK means the customer performs encryption and decryption operations on their own infrastructure — the CSP only ever receives and stores ciphertext. Even a complete compromise of the CSP’s systems cannot expose plaintext data because the CSP never holds the keys or performs the cryptographic operations.
Why B is wrong: BYOK lets the customer supply key material, but that key material is imported into the CSP’s KMS and the CSP infrastructure performs encryption operations. A sufficiently privileged attacker who compromises the CSP’s KMS could access the keys.
Why A is wrong: CSP-managed keys give the CSP full control over key material. This addresses external attackers but does not protect against a compromised CSP.
Why D is wrong: CSP-native envelope encryption is entirely within the CSP’s trust boundary — this offers no protection if the CSP itself is compromised.
During a cloud data security audit, the team discovers that archived customer records are stored in cold cloud storage indefinitely with no deletion schedule or retention policy applied. Which phase of the cloud data lifecycle is the organization failing to manage?
Why D is correct: The cloud data security lifecycle includes: Create, Store, Use, Share, Archive, and Destroy. Data that is retained indefinitely without a deletion trigger is evidence that the Destroy phase is not being managed. The data has moved through Create, Store, and Archive successfully — the failure is in the final phase.
Why C is wrong: The data has been archived — that phase was performed. The problem is what happens (or doesn’t happen) after archiving. Archiving is not the same as destroying.
Why A and B are wrong: The data was created and stored correctly. The lifecycle issue is not in the early phases.
A CASB solution is deployed in forward proxy mode on a corporate network. An employee on a corporate device attempts to upload a file containing credit card numbers to a personal cloud storage service. Which outcome is MOST likely with a properly configured CASB?
Why B is correct: Forward proxy mode positions the CASB inline between users and cloud services. With TLS inspection (SSL break-and-inspect) enabled, the CASB can examine encrypted traffic content, detect PII via DLP policies, and block the upload before it reaches the destination in real time.
Why A is wrong: Forward proxy CASBs with TLS inspection configured can inspect HTTPS traffic. The statement that forward proxy “cannot inspect” encrypted traffic is incorrect when TLS inspection is deployed.
Why C is wrong: Alert-only behavior is a policy configuration choice — not the default outcome of a “properly configured” CASB with DLP enforcement. The question specifies proper configuration, which means enforcement, not just alerting.
Why D is wrong: Redirection to an approved service is a possible CASB behavior but not the primary enforcement action for DLP policy violations. Blocking and logging is the canonical response.
Practice CCSP Questions by Domain — Free for 7 Days
cissp.app’s adaptive engine covers all six CCSP domains, tracks your accuracy per domain, and surfaces weak areas automatically so you know exactly where to focus next.
Start Free CCSP Practice →No credit card required · Covers CCSP, CISSP, and CISM
Domain 3: Cloud Platform & Infrastructure Security
Exam weight: 17% — approximately 26 questions. Focus: virtualization security, hypervisor threats, cloud network security, container and workload security.
A security researcher discloses a hypervisor vulnerability that allows a guest virtual machine to execute arbitrary code in the host kernel. Which threat category does this BEST describe?
Why C is correct: A hypervisor escape — also called a VM breakout — is the specific threat where a guest VM exploits a hypervisor vulnerability to gain unauthorized access to the host kernel or other guest VMs. Code execution in the host kernel is the defining characteristic of this threat.
Why A is wrong: Side-channel attacks (such as Spectre and Meltdown) exploit hardware-level timing, cache behavior, or power consumption to infer information. They do not involve executing code in the host kernel through a software vulnerability.
Why B is wrong: VM sprawl is an operational/governance problem — too many untracked VMs consuming resources. It is not a vulnerability exploitation scenario.
Why D is wrong: Resource exhaustion denies service but does not describe code execution crossing the guest-host boundary.
An organization implements microsegmentation across its cloud workload environment. What is the PRIMARY security benefit this control provides?
Why B is correct: Microsegmentation creates fine-grained network policy boundaries between individual workloads or services. If one workload is compromised, the attacker cannot freely communicate with other workloads — lateral movement is constrained to the segment. This is the primary security value of the control.
Why A is wrong: Microsegmentation is a network security control, not a compute optimization. It does not reduce VM count.
Why C is wrong: Microsegmentation adds policy enforcement overhead to east-west traffic — it does not improve throughput. Network performance and security posture are different objectives.
Why D is wrong: Microsegmentation reduces the attack surface but does not replace host-based controls. Defense in depth requires both network segmentation and host-level protection.
A container orchestration platform is configured so that all containers run as root by default. What is the MOST significant security risk this configuration introduces?
Why A is correct: Running containers as root means that if a container is compromised and an attacker achieves a container escape, they have root access on the host OS. Container isolation (namespaces, cgroups) is not a security boundary equivalent to a hypervisor — privilege inside the container can translate to privilege on the host if the isolation is breached.
Why B is wrong: Container scheduling across nodes is a function of orchestration configuration, not privilege settings. Root containers schedule normally.
Why C is wrong: Running as root does not meaningfully increase CPU or memory consumption.
Why D is wrong: Image integrity is a supply chain control concern (image signing, registry policy) — separate from runtime privilege configuration.
Domain 4: Cloud Application Security
Exam weight: 17% — approximately 26 questions. Focus: secure SDLC in cloud, API security, identity federation, container and serverless security patterns.
A microservices application stores service-to-service API keys as environment variables in each container. A security review flags this as a significant risk. What is the MOST significant security concern with this approach?
Why A is correct: Environment variables have multiple exposure vectors: any process running on the same host can read them, they appear in crash dumps and error logs, and container orchestration APIs (including Kubernetes secret-less environment variables) can expose them to cluster administrators. They are also typically stored in plaintext in deployment manifests committed to version control.
Why B is wrong: Cross-zone communication is not affected by the credential storage mechanism. This is a factually incorrect statement.
Why C is wrong: Horizontal scaling works fine with environment variable credentials. The scaling mechanism and the credential exposure risk are unrelated.
Why D is wrong: OAuth 2.0 does not mandate specific secret storage mechanisms — it defines authentication flows. The concern here is operational security, not protocol compliance.
An organization is designing an OAuth 2.0 authorization flow. A third-party application must access user resources on their behalf, and the requirement states the user must NOT share their credentials with the third-party application at any point. Which OAuth 2.0 grant type BEST satisfies this requirement?
Why B is correct: Authorization Code with PKCE allows a user to authenticate directly with the authorization server — the third-party application receives an authorization code, exchanges it for a token, but never sees the user’s credentials. PKCE protects against authorization code interception. This is the current recommended grant type for public clients.
Why A is wrong: Resource Owner Password Credentials requires the user to give their username and password directly to the third-party application — exactly what the requirement prohibits.
Why C is wrong: Client Credentials is for machine-to-machine authentication where no user is involved. It is not applicable to user-delegated access scenarios.
Why D is wrong: The Implicit grant has been deprecated in OAuth 2.1 due to security vulnerabilities including token exposure in browser history and referrer headers. It should not be used in new designs.
A cloud security team is threat modeling a serverless function that processes customer payment data triggered by an event queue. Which threat is UNIQUELY elevated in serverless architectures compared to traditional server-based deployments?
Why B is correct: Serverless functions consume events from a wide variety of sources — message queues, storage triggers, databases, API gateways, and more. If an attacker can control any event source (or compromise a service that generates events), they can inject malicious payloads that the function processes with full trust. This multi-source attack surface is specific to serverless architectures and does not exist in the same form for traditional application servers.
Why A is wrong: SQL injection is a general application vulnerability that exists in any data-querying code regardless of the execution environment. It is not uniquely elevated by serverless architecture.
Why C is wrong: XSS targets browsers rendering HTML responses. Serverless function runtimes are server-side execution environments — XSS is not a meaningful threat to the runtime itself.
Why D is wrong: DoS is a concern for any networked service. While serverless auto-scaling changes cost exposure from DoS attacks (financial denial of service), volumetric DoS is not uniquely a serverless threat.
Domain 5: Cloud Security Operations
Exam weight: 16% — approximately 24 questions. Focus: incident response in cloud, cloud forensics, log management, BCM in cloud environments.
A security team receives an alert indicating a cloud workload may have been compromised. They want to investigate the incident while preserving forensic evidence. What action should they take FIRST?
Why B is correct: Forensic preservation must precede remediation. In cloud environments, volatile evidence — memory state, running process list, active network connections, temporary files — is permanently lost the moment an instance is terminated. Taking disk and memory snapshots preserves this evidence for analysis while still allowing containment to follow.
Why A is wrong: Immediate termination destroys all volatile evidence. If the organization needs to determine what happened (attribution, legal holds, regulatory reporting), they need that evidence first. Containment is important, but evidence preservation comes before termination.
Why C is wrong: CSPs do not perform forensic investigation for customers — that is the customer’s responsibility. Waiting for the CSP would destroy volatile evidence and delay containment without benefit.
Why D is wrong: Restoring from backup overwrites the compromised instance’s evidence. Restoration is a recovery step, not a first response step.
When performing e-discovery on data stored in a multi-tenant public cloud environment, what is the PRIMARY challenge for the cloud customer?
Why B is correct: In multi-tenant environments, data from many customers shares underlying storage and compute infrastructure. Scoping an e-discovery request to a specific customer’s data — especially for legal holds — requires identifying and isolating that data from co-resident tenant data, which often requires CSP assistance and may be constrained by the CSP’s technical architecture.
Why A is wrong: Cost is a real operational consideration but is not the primary technical or legal challenge of e-discovery in cloud environments. The challenge is isolation and access, not billing.
Why C is wrong: Log retention periods are configurable by customers in most CSPs — they are not fixed at 30 days. Customers can set longer retention with appropriate storage configuration.
Why D is wrong: E-discovery is legally enforceable regardless of where data is stored. Courts and regulators do not recognize cloud storage as an exemption from legal discovery obligations.
Domain 6: Legal, Risk & Compliance
Exam weight: 13% — approximately 20 questions. Focus: cloud contracts, data sovereignty, privacy regulations, audit rights, cross-border data transfer frameworks.
A company signs a cloud contract to store regulated health data. The contract does not include a right-to-audit clause. What is the GREATEST risk this omission creates for the cloud customer?
Why B is correct: A right-to-audit clause gives the customer (or their designated auditor) the contractual right to verify whether the CSP is meeting its security obligations. Without it, the customer must rely entirely on the CSP’s own assertions or third-party certifications (SOC 2, ISO 27001) — which may not cover all obligations in the specific contract. For regulated industries, this creates significant governance and compliance risk.
Why A is wrong: Pricing change procedures are governed by other contract clauses (notice periods, amendment procedures), not the audit clause.
Why C is wrong: Termination rights following a breach are typically addressed by breach of contract and force majeure clauses — not the audit clause.
Why D is wrong: Third-party certifications (SOC 2 Type II, ISO 27001 audits) are conducted by auditors under separate agreement with the CSP regardless of the customer contract. The right-to-audit clause gives the customer’s auditors access, which is a separate matter.
An EU-based company stores EU citizen personal data in a US-based cloud region. Under GDPR, which legal mechanism is MOST broadly used to legitimize this cross-border data transfer?
Why B is correct: Standard Contractual Clauses (SCCs) are the most widely used GDPR transfer mechanism for EU-to-third-country data transfers. The European Commission publishes standardized clauses that data exporters and importers can incorporate into their contracts. They apply to transfers to any third country including the US, and they are available to any organization regardless of its certification status.
Why A is wrong: BCRs apply within a corporate group — typically between a company’s own subsidiaries. They are not applicable to transfers to an external cloud provider with whom the company has no corporate affiliation.
Why C is wrong: Explicit consent is a valid transfer mechanism under GDPR but is impractical as the primary mechanism for cloud storage of large volumes of data from many individuals. It also cannot be used where consent is not freely given (e.g., in employment relationships), and data subjects can withdraw consent at any time.
Why D is wrong: The EU-US Data Privacy Framework (adequacy decision) applies only to organizations that have self-certified under that framework — it does not automatically cover all US cloud providers. SCCs remain the most broadly applicable mechanism.
What Your Score on These Questions Means
Score yourself honestly: one point per correct answer before reading the explanation. Then compare to the table below.
| Score (out of 16) | Percentage | Readiness Signal |
|---|---|---|
| 14–16 | 88–100% | Strong — focus on volume and timed simulation |
| 12–13 | 75–81% | On track — identify wrong-answer domains and drill them |
| 10–11 | 63–69% | Developing — review foundational concepts in weak domains |
| 8–9 | 50–56% | Early stage — prioritize study before increasing question volume |
| 7 or below | Below 44% | Needs focused study — return to source material for missed domains |
More important than your overall score: which domains did you miss? If you missed Q4, Q5, and Q6 (all Domain 2 questions), that is your highest-priority study focus — Domain 2 is worth 20% of the exam. If your errors are clustered in Domain 4 (cloud application security), that’s where to concentrate next.
For the full domain-by-domain study framework — including how many questions to target per domain and when you’re ready to sit — see our CCSP practice questions strategy guide and our CCSP 90-day study plan. If you’re coming from CISSP, our CCSP vs CISSP comparison covers what carries over and what you have to learn from scratch.
These 16 questions are a calibration tool, not a complete prep plan. A reliable readiness threshold is 1,000–1,500 unique practice questions with full explanations before sitting the CCSP. Quality matters more than volume — scenario-based questions like these, with explanations that cover all four options, build judgment faster than memorizing 3,000 definition questions.
FAQ: CCSP Practice Questions
How are CCSP practice questions different from CISSP practice questions?
CCSP questions require cloud-specific application of security concepts: shared responsibility models, CASB controls, cloud data lifecycle, hypervisor security, and cloud-native application patterns. About 30–40% of CCSP content overlaps with CISSP (cryptography, risk, access control fundamentals), but the remaining 60–70% tests concepts that don’t appear on the CISSP exam at all.
What score should I aim for on CCSP practice questions before the real exam?
Target 75% or above on each individual domain before sitting the CCSP exam. The overall passing score is 700 out of 1000. If any domain falls below 70% on practice tests, prioritize it specifically. Domain 2 (Cloud Data Security, 20% weight) is the highest-stakes domain to master.
What is the hardest CCSP domain for most candidates?
Domain 2 (Cloud Data Security) is the domain most candidates underperform on despite being the highest-weighted domain at 20%. It requires fluency with cloud-specific encryption key management (BYOK vs. HYOK), CASB deployment modes, and the cloud data lifecycle — concepts with no direct CISSP equivalent.
How many CCSP practice questions should I do before the exam?
A reliable benchmark is 1,000–1,500 unique practice questions with explanations. The key is quality: questions should force you to apply judgment in cloud security scenarios, not recall definitions. Use worked examples like these to calibrate your reasoning, then build volume with a question bank.
Can I use the same mindset for CCSP questions as for CISSP questions?
The manager mindset — thinking about risk management, governance, and the “best” answer rather than the technically complete one — does carry over from CISSP to CCSP. However, CCSP also requires cloud-technical depth that CISSP does not test. You need both: the strategic framing AND the cloud-specific knowledge.