A data protection officer for a SaaS company signed off on a new cloud provider based in Switzerland. The provider was ISO 27001 certified and the DPO felt confident. Six months later, a data subject access request from a German citizen hit their inbox. They forwarded it to the cloud provider, who replied that retrieving a single user's data from their archived backups was "out of scope" for their standard agreement. The company missed the initial 30-day GDPR response window, had to request a difficult extension, and learned a hard lesson. Certification is not the same as contractual obligation.
These free CCSP practice questions cover the Legal, Risk, and Compliance domain (Domain 6), which accounts for 13% of the exam. They test your judgment on topics like GDPR, eDiscovery, audit processes, and risk management in a cloud context. Use them to diagnose weak spots and learn the exam's logic.
Key facts
- Official Exam: Certified Cloud Security Professional (CCSP)
- Awarding Body: (ISC)²
- Passing Score: 700 out of 1000
- Exam Format: 150 multiple-choice questions over 4 hours
- Domain 6 Weighting: 13% (approx. 19-20 questions)
- Required Study: 100-150 hours on average
The Bureau of Labor Statistics projects jobs for Information Security Analysts will grow 32% from 2022 to 2032, with certified professionals often commanding salaries between $120,000 and $175,000 (BLS).
How to Use These CCSP Domain 6 Practice Questions
This is not a random list of sample questions. I’ve written these 10 questions to mirror the difficulty and style you will face on the actual exam for Domain 6, fully aligned with the 2026 (ISC)² CCSP blueprint.
Studying for CCSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The goal isn't just to see if you get the answer right. It's to train your thinking.
For every question, I’ve included a detailed rationale that explains not only why the correct answer is best but also why the other options are tempting yet incorrect. This is the core of what we do at VoraPrep: we teach you to see the exam through the eyes of the person who wrote the question. These explanations are where the real learning happens. Try VoraPrep's free CCSP practice questions to experience this for yourself.
Let's begin.
CCSP Domain 6 Practice Questions & Explanations
Read each question carefully, eliminate the obvious distractors, and select the best possible answer. I've grouped them by topic to help you connect the concepts.
Part 1: Legal Frameworks & Data Privacy
Question 1
A European company is migrating its customer relationship management (CRM) platform to a US-based SaaS provider. The provider has assured the company that its data centers are ISO 27001 certified. As the cloud security professional, which of the following is the MOST critical consideration to ensure GDPR compliance for this data transfer?
The correct answer is B. Following the Schrems II court ruling, a Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) is the necessary legal mechanism, but it's no longer sufficient on its own. A Transfer Impact Assessment (TIA) must also be conducted to verify that the data will have "essentially equivalent" protection in the destination country. This often requires supplementary measures.
Let's break down why the others are wrong:
- A) Verifying the ISO 27001 certificate: This is a tempting answer and a common trap. ISO 27001 is an excellent security standard, but it is a certification of a security management system, not a legal instrument for data transfers under GDPR. This is the exact mistake made in the opening story.
- C) Confirming AES-256 encryption: Strong encryption is a vital technical control and may be one of the "supplementary measures" required by a TIA. However, it does not, by itself, satisfy the legal requirement for the cross-border data transfer framework.
- D) Requesting a SOC 2 Type 2 report: A SOC 2 report is a fantastic tool for vendor due diligence, providing assurance about security controls. But, like ISO certification, it is not the specific legal mechanism required by GDPR for data transfers.
The examiner wants you to distinguish between good security practices (A, C, D) and the specific, multi-layered legal requirements of the regulation in question (B).
Question 2
Your company has received an eDiscovery request related to litigation. The potentially relevant data is stored across multiple IaaS virtual machines, a PaaS database, and a SaaS email archive. According to the Electronic Discovery Reference Model (EDRM), which phase involves locating potential sources of electronically stored information (ESI) and determining its scope?
The correct answer is C) Identification. This is the phase where you figure out what data is potentially relevant and where it lives. It involves locating sources of electronically stored information (ESI) and determining the scope, breadth, and depth of that data.
Here’s why the other answers are incorrect based on the EDRM sequence:
- A) Preservation: This is the step after Identification. Once you identify relevant ESI, you must issue a legal hold to ensure it is protected against modification or deletion. You have to know what to preserve before you can preserve it.
- B) Collection: This is the step after Preservation. After identifying and preserving the data, you then collect it for further processing and review.
- D) Information Governance: This is a tricky distractor. Information Governance is actually the very first phase of the EDRM, preceding Identification. It's the overarching strategy for how an organization manages its information. However, the question asks about the phase for "locating potential sources" for a specific request, which is the definition of Identification.
The exam will test you on the correct order. The full sequence is: Information Governance -> Identification -> Preservation -> Collection -> Processing -> Review -> Analysis -> Production -> Presentation.
Question 6
The legal team has informed you that a new privacy regulation, similar to the California Consumer Privacy Act (CCPA), is coming into effect. Which of the following data subject rights is a key provision of both CCPA and GDPR?
The correct answer is B) The right to be forgotten (erasure). Under GDPR, this is the "right to erasure" (Article 17). Under CCPA (as amended by CPRA), it's the "right to delete." While technical implementation and exceptions differ slightly, the fundamental concept of allowing a consumer to request the deletion of their personal information is a cornerstone of both frameworks.
Let's look at why the other options are incorrect:
- A) Data minimization: This is a core principle of GDPR, meaning organizations should only collect data that is necessary for a specific purpose. It is not framed as a direct "right" for data subjects in the same way as the right to erasure.
- C) The requirement for a Data Protection Officer (DPO): This is a specific requirement under GDPR for public authorities and organizations engaged in large-scale monitoring. CCPA/CPRA does not have a mandatory DPO requirement.
- D) The right to opt-out of data processing for AI training: This is an emerging and specific right. Both frameworks provide rights to opt-out of certain activities (like the sale of data under CCPA), but an explicit, broad right to opt-out of AI training is not a universally established provision in both laws in the same way the right to erasure is.
Part 2: Risk Management & Analysis
Question 3
A financial services company is evaluating a new cloud-based analytics platform. The company's risk policy requires a quantitative risk analysis. The asset value (AV) of the customer data is estimated at $5,000,000. A potential data breach is estimated to have an exposure factor (EF) of 30%. Historical data suggests such a breach could occur once every four years. What is the Annualized Loss Expectancy (ALE)?
- Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF)
- Annualized Rate of Occurrence (ARO) = Number of occurrences ÷ Number of years
- Annualized Loss Expectancy (ALE) = SLE × ARO
Let's walk through the calculation step-by-step.
Step 1: Calculate the Single Loss Expectancy (SLE)
The SLE represents the monetary loss from a single incident.- Asset Value (AV) = $5,000,000
- Exposure Factor (EF) = 30% or 0.30
- SLE = $5,000,000 × 0.30 = $1,500,000
Step 2: Calculate the Annualized Rate of Occurrence (ARO)
The ARO is how often the incident is expected to occur in a single year. The problem states it occurs "once every four years."- ARO = 1 ÷ 4 = 0.25
Step 3: Calculate the Annualized Loss Expectancy (ALE)
The ALE is the expected monetary loss for that asset over one year.- ALE = SLE × ARO
- ALE = $1,500,000 × 0.25 = $375,000
So, the correct answer is B) $375,000.
Now let's look at the distractors. They are designed to catch you if you miscalculate.
- A) $1,500,000: This is the SLE, not the ALE. This is the most common mistake. Candidates calculate the first step and immediately pick the corresponding answer.
- C) $5,000,000: This is the asset value (AV).
- D) $1,250,000: This is what you get if you incorrectly multiply the AV by the ARO ($5,000,000 × 0.25).
The purpose of calculating ALE is to make business decisions. If a security control to prevent this breach costs $100,000 per year, it's a good investment. If it costs $400,000, it's a bad one.
Question 8
The risk management team has identified a risk related to a cloud service outage. The potential loss is high, but the team has decided not to implement any additional controls and has documented the decision, stating it falls within the company's risk appetite. This is an example of which risk treatment strategy?
The correct answer is D) Risk acceptance. When an organization identifies a risk but makes a conscious, informed decision not to take action, it is accepting the risk. This is a valid strategy, but it must be a documented decision made by management, acknowledging that the residual risk is within the organization's defined risk appetite.
Here is a quick comparison of the four strategies:
| Strategy | Action Taken | Example |
|---|---|---|
| Mitigation | Apply controls to reduce likelihood or impact. | Implementing multi-factor authentication. |
| Transference | Shift financial impact to a third party. | Buying cybersecurity insurance. |
| Avoidance | Stop the activity that creates the risk. | Deciding not to collect sensitive data. |
| Acceptance | Take no action; document the decision. | Acknowledging a minor vulnerability will not be patched. |
The question states the team "decided not to implement any additional controls," which is the definition of acceptance.
Part 3: Audit, Governance & Compliance
Question 4
When auditing a cloud environment, an auditor is reviewing the provider's Service Organization Control (SOC) 2 report. The report was issued six months ago and provides an opinion on the design and operational effectiveness of the provider's controls over the past year. Which type of report is this?
| Report Focus | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Audience | User entity's auditors | Management, customers (under NDA) | Public, general use |
| Content | Internal Controls over Financial Reporting (ICFR) | Trust Services Criteria (Security, Availability, etc.) | Summary of SOC 2 findings |
| Report Type | Type 1 | Type 2 |
|---|---|---|
| Scope | Suitability of design of controls | Design and operational effectiveness of controls |
| Timeframe | As of a specific point in time | Over a period of time (e.g., 6-12 months) |
The question has two clues:
- It's a "cloud environment," which points to the Trust Services Criteria, making it a SOC 2.
- It assesses "design and operational effectiveness," which explicitly defines a Type 2 report.
Therefore, it must be a SOC 2 Type 2 report.
Question 5
A cloud customer is using an IaaS provider to host a web application. Under the shared responsibility model, which of the following is typically the responsibility of the cloud customer?
The correct answer is B) Patching the guest operating system of a virtual machine.
In an Infrastructure as a Service (IaaS) model, the provider is responsible for the security of the cloud (physical infrastructure, network, hypervisor). The customer is responsible for security in the cloud (everything they build on top).
Let's analyze the options in an IaaS context:
- A) Security of the virtualization software (hypervisor): This is the core of the IaaS platform and is squarely the responsibility of the cloud provider.
- B) Patching the guest operating system: The customer deploys the virtual machine and chooses the OS. Therefore, the customer is responsible for configuring, securing, and patching that OS.
- C) Physical security of the data center: This is the foundational layer. The provider is responsible for the gates, guards, and physical hardware protection.
- D) Network infrastructure security: The provider secures the underlying network hardware. The customer is responsible for configuring their virtual network, firewall rules, and subnets within that infrastructure.
Question 7
Your organization wants to ensure that a cloud provider adheres to a specific set of security controls and configurations outlined in your corporate policy. Which of the following is the BEST way to gain this assurance?
The correct answer is C) Include specific control requirements and audit rights in the contract. The contract is the only legally binding document that defines the relationship and obligations. If you need a specific control (e.g., FIPS 140-2 validated cryptography), it must be in the contract. "Right to audit" clauses give you the legal standing to verify those controls.
- A) Rely on the provider's ISO 27001 certification: This is tempting but wrong. ISO 27001 certifies that the provider has a security management system. It doesn't guarantee they implement the specific controls your policy requires.
- B) Conduct a vulnerability scan of the provider's IP range: This is almost always a violation of the provider's terms of service and could get your account suspended. Any testing must be explicitly authorized.
- D) Review marketing materials: This is the weakest form of assurance. Marketing materials are not legally binding promises.
The exam mantra is: "If it's not in the contract, it doesn't exist."
Question 9
Which of the following international standards provides a framework for selecting and implementing information security controls and is often used in conjunction with ISO/IEC 27001?
The correct answer is A) ISO/IEC 27002. ISO 27001 specifies the requirements for an Information Security Management System (ISMS). ISO 27002 is a supplementary standard that provides detailed guidance and best practices for implementing the controls listed in ISO 27001's Annex A.
Think of it this way: 27001 is the "what" (the requirements), and 27002 is the "how" (the implementation guide).
- B) ISO/IEC 27017: This provides specific guidance for security controls applicable to cloud services.
- C) ISO/IEC 27701: This is an extension to ISO 27001 for establishing a Privacy Information Management System (PIMS).
- D) ISO/IEC 31000: This provides generic guidelines on risk management, not specific to information security.
Question 10
A company discovers that a former employee retained access to a cloud-based file storage system and downloaded sensitive intellectual property after their employment was terminated. From a governance perspective, this failure is MOST likely due to a weakness in which process?
The correct answer is C) Identity and access management (IAM) lifecycle. A proper IAM lifecycle includes processes for provisioning, reviewing, and deprovisioning user access. When an employee is terminated, all access should be revoked immediately. The fact that the former employee still had access clearly indicates a failure in this deprovisioning step.
- A) Incident response: The IR process kicks in after the event is discovered. The root cause was not a failure of IR.
- B) Data classification: Knowing the data was sensitive is important for assessing impact, but the failure was in access control, not classification.
- D) Business continuity planning (BCP): BCP deals with maintaining operations during a disruption. This is a confidentiality breach, not a disruption.
The examiner is testing whether you can trace an event back to the specific governance process that should have prevented it.
Calculate Your CCSP Score & Study Hours by Domain
Adjust your practice scores across official CCSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score?
Count up your correct answers to see where you stand.
- 8-10 Correct: You have a strong grasp of Domain 6 concepts. You can differentiate between legal requirements, technical controls, and audit artifacts. Your focus should be on practicing more complex, scenario-based questions to solidify your judgment.
- 5-7 Correct: You have a foundational knowledge but are likely getting caught by tempting distractors (e.g., SOC 1 vs. SOC 2, SLE vs. ALE). This is common. Dive deep into the explanations for the questions you got wrong. Understand the logic, don't just memorize the answer.
- 0-4 Correct: This score indicates a significant knowledge gap. This is valuable information that tells you where to focus. Start with the fundamentals: the shared responsibility model, the purpose of major regulations like GDPR, and the definitions of risk management terms.
No matter your score, the next step is the same. Turn your mistakes into your study plan. For each question you missed, write down the core concept in your own words. This targeted approach is far more effective than passively re-reading a textbook. Explore the full VoraPrep CCSP course to see how our adaptive engine does this for you automatically.
Get More CCSP Practice on VoraPrep
These 10 questions are just a small sample. The full CCSP exam has 150 questions, and passing requires deep knowledge.
At VoraPrep, we've built a complete 6-pillar course designed to get you exam-ready. It's not just another question bank.
Our platform includes:
- Textbook-Grade Lessons: Clear, concise study guides covering every topic on the CCSP blueprint.
- Adaptive Practice: A bank of over 1,800+ exam-calibrated questions that targets your weak spots.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real testing experience.
- Spaced-Repetition Flashcards: An FSRS system to help you memorize key terms and frameworks.
- Personalized Study Plan: A dynamic calendar that tells you what to study each day based on your exam date.
- Vory, Your 24/7 Tutor: Stuck on a concept? Ask Vory inside any lesson or question for a step-by-step explanation.
Legacy courses charge $1,500 or more for passive video lectures. VoraPrep provides a complete, interactive learning system for a simple monthly or annual subscription ($25/month or $199/year). You can see a full breakdown on our Best CCSP Review Courses (2026) guide.