A company is using a cloud provider's IaaS offering to host a web server. The web server is compromised due to an unpatched vulnerability in the operating system. According to the shared responsibility model, who is primarily responsible for this vulnerability?

The cloud provider, because they manage the physical infrastructure

The web server software vendor, because they release patches

Both the provider and the company equally

The company, because they are responsible for patching the operating system in IaaS

A company is outsourcing its data storage to a cloud provider. They are concerned about the provider's use of subcontractors for data processing. The company wants to ensure that subcontractors are also bound by the same data protection obligations. What is the most effective way to address this?

Prohibit the provider from using any subcontractors

Require the provider to include a clause in the contract that holds them responsible for subcontractor compliance

Rely on the provider's public statements about subcontractor compliance

Audit the subcontractors directly

A multinational company is considering a cloud provider for storing employee HR data. The provider's data centers are located in multiple countries. The company is concerned about which country's laws apply to the data and wants to ensure they can comply with local privacy regulations. What is the most critical factor to evaluate?

The location of the data centers and the provider's data residency options

The provider's data encryption standards

The provider's use of subcontractors

Which component of a VPC allows the customer to define IP address ranges and subnets?

Virtual network (VNet) or VPC CIDR block

Virtual private network (VPN) gateway

Systems Security Certified Practitioner

Domain 7Objective 4

7.4 - Understand and Configure Cloud Security SSCP Practice Questions (Page 2)

Part of the Systems and Application Security domain, which accounts for 15% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

15%of the exam

Questions 6–10

6application · medium
A company is using a cloud provider's IaaS offering to host a web server. The web server is compromised due to an unpatched vulnerability in the operating system. According to the shared responsibility model, who is primarily responsible for this vulnerability?
Select an answer first
7expert · hard
A company is outsourcing its data storage to a cloud provider. They are concerned about the provider's use of subcontractors for data processing. The company wants to ensure that subcontractors are also bound by the same data protection obligations. What is the most effective way to address this?
Select an answer first
8foundation · easy
Which legal concern is most directly related to the physical location of cloud data centers?
Select an answer first
9application · medium
A multinational company is considering a cloud provider for storing employee HR data. The provider's data centers are located in multiple countries. The company is concerned about which country's laws apply to the data and wants to ensure they can comply with local privacy regulations. What is the most critical factor to evaluate?
Select an answer first
10foundation · easy
Which component of a VPC allows the customer to define IP address ranges and subnets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

7.4 - Understand and Configure Cloud Security SSCP Practice Questions (Page 2)

Questions 6–10

A company is using a cloud provider's IaaS offering to host a web server. The web server is compromised due to an unpatched vulnerability in the operating system. According to the shared responsibility model, who is primarily responsible for this vulnerability?

A company is outsourcing its data storage to a cloud provider. They are concerned about the provider's use of subcontractors for data processing. The company wants to ensure that subcontractors are also bound by the same data protection obligations. What is the most effective way to address this?

Which legal concern is most directly related to the physical location of cloud data centers?

Which component of a VPC allows the customer to define IP address ranges and subnets?

Keep studying — Systems and Application Security