A company uses a cloud access security broker (CASB) to monitor employee use of sanctioned and unsanctioned cloud applications. Which capability is the CASB providing in this scenario?

Automatic backup of all data stored in cloud applications.

Visibility into cloud application usage and enforcement of access policies.

Encryption of data at rest in the cloud provider's storage services.

Replacement of the organization's identity provider for all cloud applications.

In a SAML-based federation, which statement best describes the role of the identity provider (IdP)?

The IdP creates and manages the user's account within the service provider's application.

The IdP receives the user's assertion from the service provider and grants access to the requested resource.

The IdP authenticates the user and issues an assertion containing identity attributes to the service provider.

The IdP stores the user's credentials and directly validates them against the service provider's user database.

A user authenticates to their corporate identity provider and is then able to access a partner company's application without logging in again. Which security concept does this scenario best illustrate?

Single sign-on (SSO), because the user only enters credentials once to access multiple applications.

Federated identity, because the user's authentication is established in one trust domain and trusted by another domain through an identity federation relationship.

Identity provider (IdP), because the corporate system is acting as the identity provider for the partner application.

Multi-factor authentication (MFA), because the user's identity is verified through multiple factors before access is granted.

An organization wants users to authenticate once and then access both a cloud CRM and an internal HR portal without being prompted again. Which approach directly achieves this goal?

Create identical user accounts in both applications and synchronize passwords using a directory sync tool.

Store the user's password in a browser password manager and enable auto-fill for both applications.

Configure both applications to trust the same identity provider and use SSO protocols such as SAML or OIDC.

Deploy a reverse proxy that forwards the user's credentials to each application automatically.

A security architect is configuring authentication for a cloud-based application. The requirement is that a user must present both a password and a one-time code generated by an authenticator app on their smartphone. Which term best describes this authentication approach?

Multi-factor authentication (MFA)

Certificate-based authentication

Certified Cloud Security Professional

Domain 4Objective 7

Design Appropriate Identity and Access Management (IAM) Solutions CCSP Practice Questions (Page 1)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

8concepts

16%of the exam

Questions 1–5

1foundation · medium
A company uses a cloud access security broker (CASB) to monitor employee use of sanctioned and unsanctioned cloud applications. Which capability is the CASB providing in this scenario?
Select an answer first
2foundation · medium
In a SAML-based federation, which statement best describes the role of the identity provider (IdP)?
Select an answer first
3foundation · medium
A user authenticates to their corporate identity provider and is then able to access a partner company's application without logging in again. Which security concept does this scenario best illustrate?
Select an answer first
4foundation · medium
An organization wants users to authenticate once and then access both a cloud CRM and an internal HR portal without being prompted again. Which approach directly achieves this goal?
Select an answer first
5foundation · medium
A security architect is configuring authentication for a cloud-based application. The requirement is that a user must present both a password and a one-time code generated by an authenticator app on their smartphone. Which term best describes this authentication approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.