Which authorization model grants permissions based on the user's role within an organization?

Attribute-based access control (ABAC)

Discretionary access control (DAC)

Role-based access control (RBAC)

A company has a hybrid cloud environment where employees connect to cloud resources from remote locations. The security team wants to ensure that all traffic between employees and the cloud is encrypted and that only authenticated users can access the resources. Which solution should they implement?

Deploy a remote access VPN with TLS encryption and integrate it with the company's identity provider for MFA.

Use a direct connection like ExpressRoute and rely on the cloud provider's authentication.

Implement a network segmentation strategy and use shared keys for access.

Set up a site-to-site VPN and require users to authenticate with their Active Directory credentials.

What is the purpose of data lifecycle management in cloud storage?

To encrypt data in transit between the client and storage

To monitor access to storage resources

To provide backup and disaster recovery for stored data

To automate the movement, retention, and deletion of data according to policy

A security analyst is investigating a potential data exfiltration. They have logs from the cloud firewall, the application server, and the authentication service. Which approach would best help them identify if data was exfiltrated?

Correlate the logs to identify a user who authenticated, accessed sensitive data, and then transferred it out.

Review the firewall logs for large outbound transfers.

Use packet capture to analyze all traffic.

Focus only on the application logs to see what data was accessed.

A company is implementing a cloud-based application that will be accessed by external partners. The company wants to use federated identity so partners can use their own credentials. They also need to enforce least privilege for partner access. Which approach should they take?

Set up federation but assign all partners the 'Owner' role.

Create local accounts for each partner and assign them to a 'Partner' role.

Use a shared account for all partners and rely on the cloud provider's authentication.

Set up federation with each partner's identity provider and use attribute-based access control (ABAC) to grant permissions based on partner attributes.

Certified Cloud Security Professional

Domain 3Objective 4

Plan and Implementation of Security Controls CCSP Practice Questions (Page 3)

Part of the Cloud Platform and Infrastructure Security domain, which accounts for 17% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 2–4 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

9concepts

17%of the exam

9 Concepts in This Objective

Physical and environmental protection controls
System protection controls
Storage protection controls
Communication protection controls
Identification and authentication in cloud
Authorization and access control in cloud
Audit mechanisms and log collection
Log correlation and analysis
Packet capture and network monitoring

Questions 11–15

11foundation · easy
Which authorization model grants permissions based on the user's role within an organization?
Select an answer first
12application · medium
A company has a hybrid cloud environment where employees connect to cloud resources from remote locations. The security team wants to ensure that all traffic between employees and the cloud is encrypted and that only authenticated users can access the resources. Which solution should they implement?
Select an answer first
13foundation · easy
What is the purpose of data lifecycle management in cloud storage?
Select an answer first
14expert · hard
A security analyst is investigating a potential data exfiltration. They have logs from the cloud firewall, the application server, and the authentication service. Which approach would best help them identify if data was exfiltrated?
Select an answer first
15expert · hard
A company is implementing a cloud-based application that will be accessed by external partners. The company wants to use federated identity so partners can use their own credentials. They also need to enforce least privilege for partner access. Which approach should they take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.