A candidate I coached was acing practice tests. He knew the cloud service models cold. IaaS, PaaS, SaaS, no problem. Then on exam day, he saw a question about a company migrating a legacy application to a PaaS environment and was asked to identify the primary remaining security responsibility. He chose "network security controls," feeling confident. He failed the exam. His mistake wasn't a lack of knowledge; it was a failure of judgment. He memorized the models but missed the core principle: you always own your data and who can access it.
These free CCSP practice questions for Domain 1 (Cloud Concepts, Architecture, and Design) are designed to mirror the 2026 exam's format and difficulty. They test your judgment on key topics like the shared responsibility model, cloud service models, and data sovereignty, going beyond simple memorization to prepare you for real exam scenarios.
Key facts
- Exam name: Certified Cloud Security Professional (CCSP)
- Official body: (ISC)²
- Domain 1 weighting: 17% of the total exam score
- Passing score: 700 out of 1000 points
- Number of questions: 150 multiple-choice questions
- Exam length: 4 hours
About These Free Cloud Concepts, Architecture and Design Questions
These 10 sample questions are not just a quiz. They are a diagnostic tool crafted to expose the subtle gaps in understanding that cause candidates to fail Domain 1. They are calibrated to the difficulty of the real CCSP exam and are fully aligned with the current (ISC)² blueprint for 2026.
The questions cover a mix of foundational concepts and complex architectural scenarios. The goal isn't just to see if you can pick the right answer, but to train you to see why the wrong answers are tempting distractors. This is the skill that separates passing candidates from the rest. As you work through them, pay close attention to the detailed explanations. Try VoraPrep's free CCSP practice questions for a larger set covering all six domains.
Studying for CCSP CCSP1? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Cloud Concepts, Architecture and Design Practice Questions
Read each question carefully. Eliminate the obvious distractors, then weigh the remaining options against the core security principles being tested.
---
Question 1A financial services company based in Germany is migrating its customer relationship management (CRM) application to a SaaS provider. The provider's data centers are located in the United States and Ireland. Which of the following is the MOST important consideration for the company's security architect?
A) The provider's disaster recovery capabilities. B) The physical security of the provider's data centers. C) Compliance with the EU General Data Protection Regulation (GDPR). D) The cost of data egress from the cloud environment.
View Answer and Explanation
Correct Answer: C Explanation: The core of this question is about data sovereignty and regulatory compliance. Since the company is based in Germany and handles customer data, it is subject to GDPR. GDPR has strict rules about transferring personal data outside the European Union. Transferring data to a U.S. data center requires specific legal mechanisms (like Standard Contractual Clauses) to be in place. This regulatory requirement supersedes the other operational concerns in terms of initial architectural decisions. Why the other answers are wrong:- A (Disaster recovery): While DR is a critical operational concern, it's a secondary issue if the primary service is illegal due to non-compliance with data protection laws. You must be compliant first.
- B (Physical security): This is a valid concern, but with a reputable SaaS provider, physical security is part of the baseline due diligence covered by certifications like ISO 27001 or SOC 2 reports. It is less of a primary architectural driver than a major legal mandate like GDPR.
- D (Data egress cost): This is a financial consideration. While important for budgeting, it does not pose the same level of business risk as massive regulatory fines and reputational damage from a GDPR violation. Security and compliance come before cost optimization.
---
Question 2Your organization is developing a new, cloud-native application. The development team wants to focus solely on writing code and managing application logic, without worrying about the underlying operating system, patching, or runtime environment. Which cloud service model best fits this requirement?
A) Infrastructure as a Service (IaaS) B) Platform as a Service (PaaS) C) Software as a Service (SaaS) D) Function as a Service (FaaS)
View Answer and Explanation
Correct Answer: B Explanation: This is a classic service model definition question. Platform as a Service (PaaS) provides the platform (operating system, runtime, middleware) for developers to build, test, and deploy applications. The key phrase is "without worrying about the underlying operating system, patching, or runtime environment." This is the exact value proposition of PaaS. Why the other answers are wrong:- A (IaaS): This is a tempting distractor. With IaaS, you get raw compute, storage, and networking. However, you are still responsible for managing the operating system, patching it, and installing the runtime. The development team would explicitly have to worry about these things.
- C (SaaS): SaaS provides a complete, ready-to-use application (like Salesforce or Microsoft 365). You cannot deploy your own custom code in a SaaS model; you can only consume the service.
- D (FaaS): While FaaS (a subset of serverless computing) also abstracts the OS, PaaS is the broader and more appropriate answer for developing a complete "application." FaaS is more suited for event-driven, single-purpose functions. PaaS is the best fit for the overall application development environment described.
---
Question 3In the shared responsibility model, which of the following is ALWAYS the responsibility of the cloud customer, regardless of the service model (IaaS, PaaS, or SaaS)?
A) Patching the guest operating system. B) Configuration of the virtual network firewall. C) Classification and accountability of data. D) Physical security of the data center.
View Answer and Explanation
Correct Answer: C Explanation: This question hits the absolute core of the shared responsibility model. While responsibilities for infrastructure, platforms, and applications shift depending on the model, the customer is always responsible for their own data. This includes classifying the data (e.g., Public, Confidential, Secret), managing access to it, and being accountable for its protection. You can outsource the processing, but you cannot outsource the ultimate ownership and responsibility. Why the other answers are wrong:- A (Patching the guest OS): This is a customer responsibility in IaaS, but it's handled by the cloud provider in PaaS and SaaS.
- B (Configuration of the virtual network firewall): This is a customer responsibility in IaaS and sometimes PaaS, but in a typical SaaS model, the customer has no control over the network configuration.
- D (Physical security): This is a classic cloud provider responsibility across all service models. One of the primary benefits of the cloud is offloading the burden of securing physical facilities.
---
Question 4A startup is building a video streaming service and expects unpredictable, spiky traffic patterns. They need the ability to scale resources up and down automatically within seconds to meet demand, and they only want to pay for the exact compute time they consume. Which cloud characteristic is MOST critical to meet this requirement?
A) Measured service B) Resource pooling C) Broad network access D) Rapid elasticity
View Answer and Explanation
Correct Answer: D Explanation: The keywords here are "unpredictable, spiky traffic," "scale... automatically within seconds," and "meet demand." This directly describes rapid elasticity. Elasticity is the ability to quickly, and often automatically, provision and de-provision computing resources as needed. It's distinct from scalability, which is the ability to handle a growing amount of work; elasticity is about matching resources to the current workload dynamically. Why the other answers are wrong:- A (Measured service): This describes the pay-per-use billing model ("only want to pay for the exact compute time"). While this is a related benefit, it is the result of elasticity. The core technical capability that enables this cost model in a spiky environment is rapid elasticity itself.
- B (Resource pooling): This refers to the provider's model of serving multiple customers (multi-tenancy) from a shared pool of resources. While this is what makes elasticity possible on the provider's end, the characteristic the customer experiences and leverages is elasticity.
- C (Broad network access): This refers to the ability to access cloud services over the network from various clients (laptops, phones, etc.). It does not relate to the scaling requirement.
---
Question 5A healthcare organization is required by law to store patient records for 10 years. They are considering a cloud storage solution. Which of the following architectural concepts is MOST critical to ensure the long-term integrity and accessibility of this data?
A) High availability B) Durability C) Portability D) Reversibility
View Answer and Explanation
Correct Answer: B Explanation: The question emphasizes the "long-term integrity" of data over a 10-year period. This directly maps to the concept of durability. Durability is the measure of data's persistence and protection from loss or corruption over time. Cloud storage services like Amazon S3 or Azure Blob Storage are designed for high durability (e.g., 99.999999999% or "eleven nines"), often by replicating data across multiple facilities.> ⚠️ Exam trap: Many candidates confuse durability with availability. Availability refers to the system being online and accessible right now. Durability refers to the guarantee that your data will not be lost over time. A system can be temporarily unavailable but still be highly durable. For a 10-year retention requirement, surviving bit rot, disk failures, and other long-term threats is the primary concern.
Why the other answers are wrong:- A (High availability): This is about uptime. While important, you can have a highly available system that loses data, or a highly durable system that experiences occasional downtime. The requirement for 10-year storage is fundamentally a durability problem.
- C (Portability): This refers to the ability to move data or applications between cloud providers. It's a good architectural principle but doesn't address the primary requirement of ensuring the data isn't lost over a decade.
- D (Reversibility): This is the ability to move data and applications back on-premises from the cloud. Like portability, it is a strategic consideration but does not directly address the long-term integrity of the stored data itself.
---
Question 6A consortium of universities decides to pool their resources to create a shared cloud environment for research purposes. The infrastructure is jointly owned and managed by the member universities and is accessible only to them. What type of cloud deployment model does this represent?
A) Public B) Private C) Hybrid D) Community
View Answer and Explanation
Correct Answer: D Explanation: This is a textbook definition of a community cloud. A community cloud is a deployment model where the cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). The key elements are "consortium," "shared resources," and "accessible only to them." Why the other answers are wrong:- A (Public): A public cloud is open to the general public. This environment is restricted to the consortium.
- B (Private): A private cloud is operated solely for a single organization. This environment is shared by multiple universities.
- C (Hybrid): A hybrid cloud involves a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together. This scenario describes a single, shared infrastructure, not a binding of different types.
---
Question 7An organization is migrating a monolithic legacy application to an IaaS environment. The security team is concerned about the single point of failure that the application represents. Which cloud design principle should they recommend to the engineering team to improve the application's resilience?
A) Design for failure B) Implement least privilege C) Use multi-factor authentication D) Encrypt data at rest
Free 10-Question Diagnostic Assessment
Pinpoint your exact knowledge gaps in 10 minutes and receive a personalized 12-week study roadmap PDF with zero obligation.
View Answer and Explanation
Correct Answer: A Explanation: The core concern is a "single point of failure" and improving "resilience." The "design for failure" principle directly addresses this. This architectural approach assumes that components will eventually fail and builds the system to withstand and recover from such failures gracefully. In a cloud context, this means using multiple availability zones, load balancers, and automated recovery mechanisms, rather than trying to prevent every possible failure. Why the other answers are wrong:- B (Least privilege): This is a critical access control principle that limits user and system permissions to the minimum required. It improves security but does not directly address the application's resilience to infrastructure failure.
- C (Multi-factor authentication): MFA is an authentication control to prevent unauthorized access. It is vital for security but irrelevant to application resilience.
- D (Encrypt data at rest): Encryption protects data confidentiality. It does not prevent the application from going down if a server or component fails.
---
Question 8When evaluating a Cloud Service Provider (CSP), a security professional uses the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM). What is the primary purpose of the CCM?
A) To provide a detailed guide for building a private cloud. B) To offer a list of certified secure cloud providers. C) To provide a framework of security controls mapped to major standards and regulations. D) To define the legal requirements for a cloud service contract.
View Answer and Explanation
Correct Answer: C Explanation: The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing. Its primary purpose is to provide a comprehensive set of controls, structured in domains, that are cross-walked (mapped) to other major security standards, regulations, and frameworks like ISO 27001, NIST SP 800-53, PCI DSS, and GDPR. This allows organizations to assess a CSP's security posture against a common baseline and understand how it aligns with their own compliance needs. Why the other answers are wrong:- A (Guide for building a private cloud): While the controls in the CCM could be used as a guide, its primary purpose is as an assessment and mapping framework, not a build-it-yourself manual.
- B (List of certified providers): The CSA does have a certification program (STAR), but the CCM itself is the framework of controls, not a list of certified entities. The STAR Registry is the list.
- D (Define legal requirements): The CCM is a technical and governance framework. While it helps ensure compliance with legal requirements (by mapping to them), it does not define the legal terms of a contract itself.
---
Question 9A company wants to extend its on-premises data center with cloud resources to handle peak loads, a practice known as "cloud bursting." Which cloud deployment model is being implemented?
A) Public B) Private C) Hybrid D) Community
View Answer and Explanation
Correct Answer: C Explanation: Cloud bursting is a classic example of a hybrid cloud model. The organization maintains its private cloud or on-premises data center for normal workloads but "bursts" into a public cloud to access additional resources when demand spikes. This architecture combines two different deployment models (private and public), which is the definition of a hybrid cloud. Why the other answers are wrong:- A (Public): This model uses only public cloud resources.
- B (Private): This model uses only on-premises or privately hosted resources.
- D (Community): This involves a shared infrastructure for a specific group, which is not what's described.
---
Question 10Which of the following is a primary security risk associated with multi-tenancy in a cloud environment?
A) Data remanence B) Network latency C) VM escape D) Vendor lock-in
View Answer and Explanation
Correct Answer: C Explanation: Multi-tenancy means multiple customers are sharing the same physical hardware. The primary security risk in this model is a failure of the isolation mechanisms that separate tenants. A VM escape (or hypervisor escape) is an attack where malicious code in one virtual machine breaks out of its isolated environment and gains access to the underlying hypervisor or other VMs on the same host. This is a direct attack on the principle of multi-tenant isolation. Why the other answers are wrong:- A (Data remanence): This is the risk of data persisting after it has been supposedly deleted. While a concern in the cloud, it's not unique to or a primary risk of the multi-tenant architecture itself, but rather of storage management. The provider's sanitization procedures are the control here.
- B (Network latency): This is a performance issue, not a security risk.
- D (Vendor lock-in): This is a business and strategic risk related to the difficulty of moving away from a specific provider. It is not a direct security risk of the multi-tenancy model.
---
How Did You Score?
Count up your correct answers. This isn't about a grade; it's about identifying your thought process.
- 8-10 Correct: You have a strong grasp of the foundational concepts in Domain 1. You are likely able to differentiate between the service models and understand the core tenets of the shared responsibility model. Your next step should be to move beyond definitions and focus on complex scenarios. Use the VoraPrep adaptive question bank to find more difficult questions that force you to apply these concepts in nuanced architectural situations.
- 5-7 Correct: You understand the basics, but you likely fell for one or two of the common traps, such as confusing durability with availability or misattributing responsibility in a PaaS model. This is the most common score. Your task is to solidify the fundamentals. For every question you got wrong, write down the core principle you missed in a single sentence. For example: "I will always be responsible for data classification, even in SaaS." Then, spend a week drilling just Domain 1 questions on VoraPrep.
- 0-4 Correct: You have significant knowledge gaps in this domain. This is not a cause for panic; it's a clear signal to act. Stop trying to memorize definitions. Go back to the source. Read the official NIST definitions for the cloud deployment and service models (NIST SP 800-145). Review the CSA Security Guidance for Critical Areas of Focus in Cloud Computing. Your goal for the next two weeks is to build your conceptual foundation before attempting more practice questions.
Get More CCSP Practice on VoraPrep
These 10 questions are just a small sample. To pass the CCSP, you need to expose yourself to hundreds of scenarios that test your judgment. The real exam won't just ask you to define IaaS; it will give you a business problem and expect you to know that IaaS is the right solution because the company needs granular control over the network stack.
This is where a complete, end-to-end prep course is essential. VoraPrep provides a comprehensive platform built on 6 pillars: textbook-grade lessons, FSRS flashcards, a personalized study plan, 1:1 exam simulators, and Vory, your 24/7 personal tutor.
Our adaptive learning engine contains over 1,800 CCSP practice questions. It learns your weak spots from the questions you miss and automatically serves you more questions on those topics until you master them. If you're struggling with the shared responsibility model, our system will ensure you see it from every possible angle. If you get stuck on a question, you can ask Vory, your personal tutor, to walk you through the logic step-by-step, 24/7. It’s a smarter way to study compared to passively watching expensive, outdated video lectures.
Check out our full CCSP exam details and format breakdown to learn more.