A security architect is designing a new cloud environment for a high-security application. The team is debating between using a configuration management tool to maintain a consistent baseline (e.g., CIS benchmarks) and using an immutable infrastructure approach where servers are replaced rather than updated. The application requires frequent updates and has a strict change-management process. Which approach is more appropriate, and why?

Use both approaches simultaneously, applying configuration management to the immutable images and in-place updates to running instances.

Use immutable infrastructure, because it ensures that any change is made by deploying a new instance from a known-good image, reducing configuration drift and unauthorized changes.

Use neither approach and rely on manual configuration and periodic audits.

Use configuration management to enforce the baseline, because it allows for in-place updates and is easier to integrate with the change-management process.

What is the main advantage of cryptographic erase over overwriting for data sanitization?

It is faster and can be done remotely

It guarantees that data is completely removed from all backups

It physically destroys the storage media

It uses a magnetic field to erase data

How do geographic restrictions typically determine a user's location?

By checking the user's device MAC address

By analyzing the user's IP address

By using the user's social media profile

By reading the user's browser cookies

Certified Cloud Security Professional

Domain 1Objective 3

Understand Security Concepts Relevant to Cloud Computing CCSP Practice Questions (Page 2)

Part of the Cloud Concepts, Architecture and Design domain, which accounts for 17% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

20concepts

17%of the exam

20 Concepts in This Objective

Cryptography fundamentals
Key management in the cloud
Identity and access management (IAM)
Privileged access management
Service and workload access
Data sanitization methods
Media lifecycle management
Network security controls
Traffic inspection and monitoring
Geofencing and geographic restrictions
Hypervisor security
Container security
Ephemeral computing and serverless security
Virtualization isolation
Common cloud threats
Threat modeling and risk assessment
Patching and vulnerability management
Baselining and configuration management
Immutable architecture
System hardening

Questions 6–10

6foundation · easy
In cloud IAM, which component is a collection of permissions that can be assigned to users or groups to grant access to resources?
Select an answer first
7expert · medium
A security architect is designing a new cloud environment for a high-security application. The team is debating between using a configuration management tool to maintain a consistent baseline (e.g., CIS benchmarks) and using an immutable infrastructure approach where servers are replaced rather than updated. The application requires frequent updates and has a strict change-management process. Which approach is more appropriate, and why?
Select an answer first
8foundation · easy
Which data sanitization method uses a strong magnetic field to destroy data on magnetic storage media?
Select an answer first
9foundation · easy
What is the main advantage of cryptographic erase over overwriting for data sanitization?
Select an answer first
10foundation · easy
How do geographic restrictions typically determine a user's location?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Understand Security Concepts Relevant to Cloud Computing CCSP Practice Questions (Page 2)

Questions 6–10

In cloud IAM, which component is a collection of permissions that can be assigned to users or groups to grant access to resources?

Which data sanitization method uses a strong magnetic field to destroy data on magnetic storage media?

What is the main advantage of cryptographic erase over overwriting for data sanitization?

How do geographic restrictions typically determine a user's location?

Keep studying — Cloud Concepts, Architecture and Design