A company uses object storage to store confidential documents. The security team wants to ensure that only authorized users can access the documents, and that all access is recorded for audit purposes. Which combination of controls should they implement?

Retention policies and lifecycle management

IAM policies to control access and enable access logging

A financial services company stores sensitive customer data in an object storage bucket. The security team discovers that a misconfigured bucket policy allowed public read access. Which combination of controls should be implemented to prevent this from recurring?

Enable versioning on the bucket

Enable server-side encryption on the bucket

Enable block public access at the account level and require IAM policies for all access

Create a new bucket and migrate the data

Which security threat is most directly associated with object storage that uses publicly readable access policies?

Data corruption from concurrent writes

Data loss due to hardware failure

Availability issues due to network congestion

Data breach through unauthorized access

A company uses object storage to store log files for security auditing. The logs are written by multiple applications and must be retained for 7 years. The security team is concerned about an attacker modifying or deleting logs to cover their tracks. Which control should be implemented?

Store the logs in a separate bucket with a restrictive policy

Enable versioning on the bucket

Encrypt the logs with server-side encryption

Enable object lock with retention mode on the bucket

A company is migrating a legacy on-premises application to the cloud. The application requires a shared file system with strong consistency and low latency for a cluster of VMs. The data is subject to a regulatory requirement that mandates data residency within a specific country. The company also wants to minimize egress costs. Which storage architecture should they choose?

Block storage volumes attached to each VM, replicated to another region

Ephemeral storage on each VM with a synchronization script

Object storage with a CDN in the required country

Cloud file storage in a region within the required country, with VMs in the same region

Certified Cloud Security Professional

Domain 2Objective 2

Design and Implement Cloud Data Storage Architectures CCSP Practice Questions (Page 4)

Part of the Cloud Data Security domain, which accounts for 20% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 2–3 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

2concepts

20%of the exam

Questions 16–20

16application · medium
A company uses object storage to store confidential documents. The security team wants to ensure that only authorized users can access the documents, and that all access is recorded for audit purposes. Which combination of controls should they implement?
Select an answer first
17application · medium
A financial services company stores sensitive customer data in an object storage bucket. The security team discovers that a misconfigured bucket policy allowed public read access. Which combination of controls should be implemented to prevent this from recurring?
Select an answer first
18foundation · easy
Which security threat is most directly associated with object storage that uses publicly readable access policies?
Select an answer first
19application · medium
A company uses object storage to store log files for security auditing. The logs are written by multiple applications and must be retained for 7 years. The security team is concerned about an attacker modifying or deleting logs to cover their tracks. Which control should be implemented?
Select an answer first
20expert · hard
A company is migrating a legacy on-premises application to the cloud. The application requires a shared file system with strong consistency and low latency for a cluster of VMs. The data is subject to a regulatory requirement that mandates data residency within a specific country. The company also wants to minimize egress costs. Which storage architecture should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.