The hardest part of CCSP Domain 3 isn't the technology; it's judging where the cloud provider's responsibility ends and yours begins. While technical details on secure network design and BCDR are critical, most exam failures in this domain come from misidentifying the responsible party in a given service model.
These free practice questions cover CCSP Domain 3: Cloud Platform and Infrastructure Security, which is 17% of the exam. They are aligned with the current (August 2024) (ISC)² blueprint and test your judgment on the shared responsibility model, risk analysis for cloud infrastructure, and business continuity planning in realistic scenarios.
Key facts
- Domain Name: Cloud Platform & Infrastructure Security
- Domain Number: 3
- Exam Weighting: 17% (approx. 25-26 questions)
- Official Blueprint: August 2024
- Official Body: (ISC)²
- Passing Score: 700 out of 1000 (overall)
- Key Topics: Shared responsibility model, risk management, secure infrastructure, BCDR.
The (ISC)² reports that exam questions are regularly refreshed, so studying from the current August 2024 CCSP exam outline is non-negotiable for success.
The Shared Responsibility Model: The #1 Trap in Domain 3
The exam will relentlessly test your understanding of the shared responsibility model. You cannot pass without mastering it. The core trap is simple: an answer choice will describe a perfect security control, but it will be the cloud provider's job when the question is about the customer's role (or vice versa).
Studying for CCSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Use this table as your guide.
| Security Layer | IaaS (Infrastructure) | PaaS (Platform) | SaaS (Software) |
|---|---|---|---|
| Customer Data | Customer | Customer | Customer |
| Application & Logic | Customer | Customer | Provider |
| Runtime & Middleware | Customer | Provider | Provider |
| Operating System | Customer | Provider | Provider |
| Virtualization | Provider | Provider | Provider |
| Servers & Storage | Provider | Provider | Provider |
| Networking (Physical) | Provider | Provider | Provider |
| Physical Data Center | Provider | Provider | Provider |
How to Use These CCSP Domain 3 Practice Questions
These 10 questions are not a simple knowledge check. They are modeled after real CCSP exam scenarios to test your judgment. They align with the current (ISC)² blueprint and include detailed explanations that teach you to think like the examiner.
We show you the right answer, explain why it's right, and dissect why the wrong answers are tempting. This method is central to how we teach at VoraPrep. You can apply it to over 1,800 more questions with our complete course. To see how our adaptive learning engine targets your weak spots, you can try VoraPrep's free CCSP practice questions.
Cloud Platform and Infrastructure Security Practice Questions
Read each question carefully and select the best possible answer. The detailed explanations are below the full set of questions.
Question 1
A financial services company is migrating its primary transaction database to a public cloud using an Infrastructure as a Service (IaaS) model. The company's security architect is primarily concerned with protecting data in transit between the on-premises data center and the cloud. Which of the following is the MOST appropriate control?Question 2
A SaaS provider experiences a major outage at one of their data centers due to a natural disaster. As a customer of this SaaS provider, which of the following is your PRIMARY responsibility?Question 3
A security analyst is conducting a risk assessment for a new application deployed on a PaaS platform. An identified vulnerability has a Single Loss Expectancy (SLE) of $80,000. Historical data indicates a similar event occurs, on average, once every five years. What is the Annualized Loss Expectancy (ALE) for this risk?Question 4
In a public cloud IaaS environment, which of the following components is the cloud provider ALWAYS responsible for securing?Question 5
A company wants to ensure that its virtual servers in the cloud are resilient to the failure of a single piece of physical hardware, such as a server rack or power distribution unit. Which cloud infrastructure concept BEST addresses this requirement?Question 6
A startup is building a new application entirely on a Serverless (FaaS) platform. Who is responsible for patching the underlying operating system and application runtime (e.g., Python, Node.js)?Question 7
During a security audit of a cloud environment, an auditor finds that the development team has been provisioning oversized virtual machines with excessive CPU and memory for testing purposes and not de-provisioning them afterward. This is an example of which specific cloud-related risk?Question 8
What is the PRIMARY purpose of implementing a "choke point" in a cloud network architecture, such as a virtual firewall or gateway that inspects all ingress and egress traffic?Question 9
A company's disaster recovery plan specifies a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour for a critical application hosted in the cloud. Which of the following strategies BEST meets these requirements?Question 10
A cloud customer is using a key management service (KMS) provided by their cloud service provider (CSP). The customer wants to ensure that a cryptographic key cannot be used outside of a specific geographic region to comply with data residency laws. Which KMS feature should they use?Explanations
Explanation for Question 1
Correct Answer is C. The question asks for the best control to protect data in transit between two distinct locations.- Why C is correct: An IPsec or TLS VPN tunnel creates an encrypted, authenticated channel over the public internet, directly addressing the risk to data in transit. This is the standard industry practice for site-to-site connectivity.
- Why the others are wrong:
- A (Host-based firewalls) protects the VM from network attacks (data in use), but it doesn't protect the data as it travels across the internet.
- B (Encrypting the disk image) protects data at rest on the storage volume, not in transit.
- D (Relying on defaults) is never a sound security posture. Default configurations are often overly permissive.
Explanation for Question 2
Correct Answer is C. This is a classic shared responsibility question disguised as a disaster scenario. In a SaaS model, the provider is responsible for the application's availability. The customer is responsible for how their business functions when that application is unavailable.- Why C is correct: Your responsibility is to your own business operations. The Business Continuity Plan (BCP) outlines how the business will continue to function during a disruption, including the loss of a critical SaaS vendor.
- Why the others are wrong:
- A, B, and D are all responsibilities of the SaaS provider. They manage the infrastructure, failover, and application data restoration as part of their service level agreement (SLA) and disaster recovery plan. As the customer, you have no control over these aspects.
Explanation for Question 3
Correct Answer is C.Step 1: Calculate the ARO
The event occurs once every five years. The ARO is the frequency of the event per year. ARO = 1 ÷ 5 years = 0.2Step 2: Calculate the ALE
Now, multiply the SLE by the ARO. SLE = $80,000 ALE = $80,000 × 0.2 = $16,000The Annualized Loss Expectancy is $16,000. This figure helps the business make a risk-based decision on whether to spend money on a control to mitigate this vulnerability.
- Why C is correct: The calculation ($80,000 × 0.2) yields $16,000.
- Why the others are wrong:
- A ($80,000) is the SLE, not the ALE. A common mistake is to confuse the two terms.
- B ($400,000) incorrectly multiplies SLE by 5 instead of by the ARO (1/5).
- D ($40,000) might result from a miscalculation, perhaps using an ARO of 0.5 (once every two years).
Explanation for Question 4
Correct Answer is C. The CCSP exam will relentlessly test you on the IaaS shared responsibility model. You must know the line of demarcation perfectly.- Why C is correct: The cloud provider is always responsible for the security of the cloud. This includes the physical security of the data centers: fences, guards, cameras, and access controls. The customer has no ability or right to manage this.
- Why the others are wrong:
- A (Guest OS) is the customer's responsibility in IaaS. You install it, patch it, and harden it.
- B (Network traffic between VMs) is controlled by the customer via security groups, network ACLs, and other virtual networking constructs.
- D (IAM policies) are configured and managed by the customer to control who can access their cloud resources.
Explanation for Question 5
Correct Answer is B. This question tests your knowledge of cloud architectural concepts for resiliency.- Why B is correct: An Availability Zone (AZ) is one or more discrete data centers with redundant power, networking, and cooling within a single region. Deploying resources across multiple AZs protects an application from the failure of a single data center or components within it, providing high availability.
- Why the others are wrong:
- A (Geographic regions) are geographically separate areas. They are used for disaster recovery (surviving a regional outage), not for protecting against a single hardware failure within a data center.
- C (Edge locations) are part of a Content Delivery Network (CDN) used to cache content closer to users. They are for performance, not compute resiliency.
- D (VPC) is a logically isolated network within the cloud; it does not inherently provide physical hardware resiliency.
Explanation for Question 6
Correct Answer is C. Serverless, or Function-as-a-Service (FaaS), represents the highest level of abstraction, shifting the most responsibility to the provider.- Why C is correct: In a Serverless model, the cloud provider manages the entire underlying stack. This includes the physical servers, host OS, and the language runtimes. The customer is only responsible for their application code and function configuration.
- Why the others are wrong:
- A and B are incorrect because the startup has no access to or control over the underlying operating system in a FaaS environment. This is a key benefit of the model. Contrast this with container security in IaaS, where the customer is responsible for securing the container runtime and images on their VMs.
- D is incorrect because while an MSSP could manage security configurations, the fundamental patching of the provider's platform remains the provider's job.
Explanation for Question 7
Correct Answer is C. This scenario describes a common operational issue in the cloud that has security and cost implications.- Why C is correct: Leaving oversized, unnecessary resources running consumes the available resource pool and drives up costs. In a malicious context, an attacker could do this to inflict financial damage. While technically a form of resource exhaustion, the exam may use more specific terms like "Cloud Squatting" or identify the risk as unnecessary cost and resource waste from poor governance.
- Why the others are wrong:
- A (Data leakage) involves the unauthorized exfiltration of data.
- B (Denial of Service) typically refers to making a service unavailable to legitimate users. While resource exhaustion can be a DoS attack, this scenario points more toward operational waste than a malicious attack.
- D (Insecure APIs) is a vulnerability in the application's interfaces, not an operational issue of resource management.
Explanation for Question 8
Correct Answer is B. This is a core network security architecture question.- Why B is correct: A "choke point" (more formally, a security gateway or network ingress/egress point) forces all traffic through a single point of inspection. This simplifies security management, monitoring, logging, and policy enforcement. It ensures that no traffic can bypass your security controls.
- Why the others are wrong:
- A (Load balancing) distributes traffic, which is a different function.
- C (Content acceleration) is the function of a CDN.
- D (Encryption) is a specific control that might be applied at a choke point, but it is not the primary purpose of creating one. The purpose is centralized control.
Explanation for Question 9
Correct Answer is D. This question requires you to match a DR strategy to specific RTO/RPO requirements. An RPO of 1 hour is very strict and is the deciding factor here.- Why D is correct: A multi-site active-active configuration means the application runs concurrently in two or more regions. Failover can be near-instantaneous (low RTO), and data is typically replicated synchronously or near-synchronously, resulting in zero or minimal data loss (low RPO). This is the only option that can reliably meet a one-hour RPO.
- Why the others are wrong:
- A (Nightly backups) would result in an RPO of up to 24 hours.
- B (Asynchronous replication) introduces a data lag. While better than nightly backups, it may not meet a strict 1-hour RPO, as the lag could be several minutes to over an hour depending on the distance and technology.
- C (Pilot light) reduces RTO but doesn't guarantee the RPO. The key is the data replication method. Synchronous replication is required for a near-zero RPO, which is characteristic of an active-active or hot-standby setup, not typically pilot light.
Explanation for Question 10
Correct Answer is C. This question tests advanced knowledge of cloud provider KMS capabilities.- Why C is correct: Key policies are the primary mechanism for controlling access to and usage of cryptographic keys. These policies are powerful JSON documents that can specify conditions based on IP address, time of day, and, importantly, the source region of the API call. You can write a policy that explicitly denies any cryptographic operation request that originates outside your designated region.
- Why the others are wrong:
- A (Key rotation) is the process of periodically replacing keys; it doesn't control their geographic usage.
- B (Key archival) is about securely storing keys that are no longer in active use.
- D (BYOK) is a process for importing your own keys into the KMS. While it gives you control over key generation, you still need to apply a key policy to restrict its use by region.
Calculate Your CCSP Score & Study Hours by Domain
Adjust your practice scores across official CCSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score? A Diagnosis of Your Domain 3 Readiness
Your score isn't just a number; it's a diagnostic tool. Here's how to interpret your results and what to do next.
- 0-4 Correct: Conceptual Gaps.
You likely have some foundational gaps in the core concepts, especially the shared responsibility model. Don't just re-read; actively use the comparison table in this article. For each layer, explain aloud why the responsibility shifts between IaaS, PaaS, and SaaS. Until you can do this without looking, you are not ready.
- 5-7 Correct: Scenario Misapplication.
You know the terms but struggle to apply them under pressure. You probably fell for at least one "wrong party" trap. Your task: for every question you missed, write down one sentence: "This was [Party A's] responsibility, not [Party B's], because the service model is [IaaS/PaaS/SaaS] and the security layer is [e.g., Operating System]." This forces you to diagnose the trap.
- 8-10 Correct: Ready for Nuance.
You have a strong command of Domain 3. Your risk is now complacency and missing edge cases. It's time to move beyond simple quizzes. Use an adaptive practice engine, like the one in the VoraPrep CCSP course, to find and eliminate your remaining hidden weak spots with complex, multi-step scenarios.
Get More CCSP Practice on VoraPrep
A short quiz is a great start, but passing the CCSP requires consistent, targeted practice. VoraPrep offers a complete 6-pillar CCSP course built to help you master all six domains efficiently. It's not another overpriced, passive video-lecture bundle.
Our interactive learning system includes:
- Textbook-Grade Lessons: Clear, concise study guides covering every exam objective.
- Adaptive Practice Bank: Over 1,800 exam-calibrated questions that target your weak areas.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real testing experience.
- FSRS Spaced-Repetition Flashcards: To drill key terms, standards, and concepts.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day.
- Vory, Your 24/7 Personal Tutor: Stuck on a concept? Ask Vory inside any lesson or question for a step-by-step explanation.
The goal isn't just to practice, but to practice intelligently. Our platform ensures you spend your limited study time on the topics that will have the biggest impact on your score.