A multinational company wants to restrict access to its cloud-based HR portal to employees physically located in the United States and Canada. The company uses a cloud identity provider and wants to enforce this restriction at the application level. Which control should be implemented?

Require multi-factor authentication for all users and rely on the user's profile country.

Configure a network security group to block IP addresses from outside North America.

Use a geofencing policy in the identity provider to allow access only from the US and Canada.

Use a VPN and require all employees to connect through it.

What is the primary purpose of network flow logs in a cloud environment?

To record metadata about network traffic for analysis and troubleshooting

To block malicious traffic in real time

To provide a backup of network configuration

How does immutable infrastructure enhance security?

By preventing unauthorized changes to running systems

By providing a backup of all data

Certified Cloud Security Professional

Domain 1Objective 3

Understand Security Concepts Relevant to Cloud Computing CCSP Practice Questions (Page 9)

Part of the Cloud Concepts, Architecture and Design domain, which accounts for 17% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 2–3 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

20concepts

17%of the exam

20 Concepts in This Objective

Cryptography fundamentals
Key management in the cloud
Identity and access management (IAM)
Privileged access management
Service and workload access
Data sanitization methods
Media lifecycle management
Network security controls
Traffic inspection and monitoring
Geofencing and geographic restrictions
Hypervisor security
Container security
Ephemeral computing and serverless security
Virtualization isolation
Common cloud threats
Threat modeling and risk assessment
Patching and vulnerability management
Baselining and configuration management
Immutable architecture
System hardening

Questions 41–45

41application · medium
A multinational company wants to restrict access to its cloud-based HR portal to employees physically located in the United States and Canada. The company uses a cloud identity provider and wants to enforce this restriction at the application level. Which control should be implemented?
Select an answer first
42foundation · easy
What is the primary purpose of network flow logs in a cloud environment?
Select an answer first
43foundation · easy
What is the primary mechanism that isolates virtual machines from each other on the same physical host?
Select an answer first
44foundation · easy
How does immutable infrastructure enhance security?
Select an answer first
45foundation · easy
Which cloud networking component acts as a virtual firewall that controls inbound and outbound traffic to resources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Understand Security Concepts Relevant to Cloud Computing CCSP Practice Questions (Page 9)

Questions 41–45

A multinational company wants to restrict access to its cloud-based HR portal to employees physically located in the United States and Canada. The company uses a cloud identity provider and wants to enforce this restriction at the application level. Which control should be implemented?

What is the primary purpose of network flow logs in a cloud environment?

What is the primary mechanism that isolates virtual machines from each other on the same physical host?

How does immutable infrastructure enhance security?

Which cloud networking component acts as a virtual firewall that controls inbound and outbound traffic to resources?

Keep studying — Cloud Concepts, Architecture and Design