ISC2 Certified Cloud Security Professional practice questions

Try 25 supported questions from the 493-question bank. Check each answer when you are ready and keep this preview’s progress privately in your browser.

Back to the CCSP exam guide Switch to a timed mock

Free preview

25 of 493 questions are open

This sample includes answers, available explanations, official references and curated community discussion. An Exam Pass unlocks the private complete bank for this exam.

See Exam Pass pricing

Answer support

What is available on this page

9 contested answers

Questions: 25
Explanations: 25
Candidate context: 25
Question citations: 5

25 questions in this bank

Question 1 of 25
Which of the following roles is responsible for creating cloud components and the testing and validation of services?
Show answer
Correct answer: D
How others answered
D86%
Explanation
Just wanted to let everyone know that I passed the exam today and no questions from the 512 available were in the actual exam. While the quality of the questions here is questionable, I can tell you for sure the ones on the actual exam are serious.
Adapted from community discussion by squeeze_talus0y · 2024-11-22 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 1 Report an issue
Candidate context
Question 1 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
S
squeeze_talus0y
2024-11-22
5 upvotes
Just wanted to let everyone know that I passed the exam today and no questions from the 512 available were in the actual exam. While the quality of the questions here is questionable, I can tell you for sure the ones on the actual exam are serious.
T
tuantmb
2024-02-26
3 upvotes
Should be D - Cloud Service Developer A - Cloud Auditor: assess the security, performance and compliance of cloud services B - Inter-Cloud Provider: offer cloud services across multiple cloud platform C - Cloud Service Broker: help customers find and use the best cloud services for their needs D - Cloud Service Developer: build and maintain cloud-based applications and infrastructure --> Correct
7
74gjd_37
2023-10-03
Selected D2 upvotes
D. Cloud service developer is responsible for creating cloud components and testing and validating services from an ISC2 CCSP perspective.
G
gmuyir
2025-03-19
Selected D1 upvote
D. Cloud service developer A cloud service developer is responsible for creating cloud components, including services, applications, and other resources. They also conduct the testing and validation of these services to ensure they function correctly and meet the necessary requirements https://ln.run/1hwqN
Question 2 of 25
What is the biggest concern with hosting a key management system outside of the cloud environment?
Show answer
Correct answer: C
How others answered
C77%
A23%
Explanation
Outside the cloud env could be on premise. And that does not imply loss of confidentiality. Whereas Availability of the key is always a question when needed for any operation
Adapted from community discussion by echo_cert · 2021-02-15 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 2 Report an issue
Candidate context
Question 2 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
E
echo_cert
2021-02-15
10 upvotes
Outside the cloud env could be on premise. And that does not imply loss of confidentiality. Whereas Availability of the key is always a question when needed for any operation
D
dmo_d
2023-11-27
Selected C3 upvotes
A is a key concern for both external/on-prem hosting and in-cloud hosting. But C is the unique (additional) biggest concern that comes with an externally hosted key-management.
M
MaciekMT
2025-02-26
Selected C1 upvote
The biggest concern with hosting a Key Management System (KMS) outside of the cloud environment is availability. If the external KMS becomes unreachable, cloud-based applications and services that depend on those keys for encryption and authentication could fail to function, resulting in downtime or loss of access to critical data. 🔹 Why Availability is the Primary Concern: If the KMS is unavailable, encrypted data cannot be accessed or decrypted. Network dependencies between cloud services and an external KMS introduce risks of latency or outages. Cloud services require constant access to encryption keys for ongoing operations.
V
Voldamort
2022-07-05
Selected C2 upvotes
My first thought was that it should be Confidentiality but then I thought that I could be hosting the Key Management on Premise and then that would not be the problem. I think that the correct answer is C Availability.
Question 3 of 25
What provides the information to an application to make decisions about the authorization level appropriate when granting access?
Show answer
Correct answer: D
How others answered
D100%
Explanation
Application is the relaying party in the context of federation. The Identity Provider passes the information to the relaying party, which is the application. That's why D is correct
Adapted from community discussion by keresh · 2022-12-01 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 3 Report an issue
Candidate context
Question 3 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
K
keresh
2022-12-01
5 upvotes
Application is the relaying party in the context of federation. The Identity Provider passes the information to the relaying party, which is the application. That's why D is correct
H
hogancl42004
2024-09-26
2 upvotes
My thought is B, "The relying party is any member of the federation that shares resources based on authenticated identities. Relying parties then handle authorization based on their policies. This allows a relying party to determine their level of trust in third-party IdPs and to map permissions on their own rather than relay on the IdP to provide both authentication and authorization. " From the CCSP Official Study Guide, Third Edition pg 181
K
kepalon
2023-03-24
2 upvotes
Really confusing, as the Authorization is done by the "Relying Party" who is the one that needs to provide the Authrorization. The identity provider, passes the identification+Authentication. I understand your point, and I like the idea of thinking the Application = Relying Party, that way it is easier to point to the Identity Provider as the right answer.
M
MaciekMT
2025-02-19
Selected D1 upvote
In a federated identity scenario, the Identity Provider (IdP) supplies an assertion or token containing user identity data (often called claims). The application (relying party) then uses this information to make authorization decisions (i.e., what the user is allowed to do).
Question 4 of 25
Which of the cloud cross-cutting aspects relates to the ability to easily move services and applications between different cloud providers?
Show answer
Correct answer: C
How others answered
C100%
Explanation
Interoperability defines how easy it is to move and reuse application components regardless of the provider, platform, OS, infrastructure, location, storage, format of data or APIs, how well applications work together, and how well new applications work with other solutions present in the business, organization, or provider’s existing architecture.
Adapted from community discussion by serget12 · 2023-10-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 4 Report an issue
Candidate context
Question 4 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
B
BuckLee
2024-10-09
Selected C1 upvote
Similarly, organizations should strive to avoid vendor lock-in whenever possible. Portability is a design principle that says workloads should be designed so that they don't leverage vendor-specific features and may be more easily shifted between cloud providers. This isn't always possible, but it is a good design practice. (ISC)2 CCSP Certified Cloud Security Professional Official Study Guide (p. 22).
S
serget12
2023-10-20
2 upvotes
Interoperability defines how easy it is to move and reuse application components regardless of the provider, platform, OS, infrastructure, location, storage, format of data or APIs, how well applications work together, and how well new applications work with other solutions present in the business, organization, or provider’s existing architecture.
X
xav1er
2023-04-25
1 upvote
Its Portability. From CCSP Students Guide: Portability defines the ease with which application components are moved and reused elsewhere regardless of the provider, platform, OS, infrastructure, location, storage, format of data, or APIs. Portability is a key aspect to consider when selecting cloud providers, since it can both help prevent vendor lock-in and deliver business benefits by allowing identical cloud deployments to occur in different cloud provider solutions, either for the purposes of disaster recovery or for the global deployment of a distributed single solution.
C
certifiedgeek
2023-05-12
2 upvotes
The question is about "moving between cloud providers" (portability) and not retrieve&delete data from a cloud provider (reversibility) nor the ability for apps to work seamlessly with providers (interoperability).
Question 5 of 25
Which type of audit report is considered a "restricted use" report for its intended audience?
Show answer
Correct answer: D
How others answered
D58%
C33%
Only 58% agreed on this answer — treat it as contested rather than settled.
Explanation
the question doesn't seem correct The SOC 2 Type 1 is not extremely useful for determining the security and trust of an organization. The SOC 2 Type 1 only reviews the design of controls, not how they are implemented and maintained, or their function. The SOC 2 Type 2 report, however, does just that. This is why the SOC 2 Type 2 is the sort of report that is extremely useful for getting a true assessment of an organization’s security posture.
Adapted from community discussion by ragar123 · 2020-12-14 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 5 Report an issue
Candidate context
Question 5 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
R
ragar123
2020-12-14
21 upvotes
the question doesn't seem correct The SOC 2 Type 1 is not extremely useful for determining the security and trust of an organization. The SOC 2 Type 1 only reviews the design of controls, not how they are implemented and maintained, or their function. The SOC 2 Type 2 report, however, does just that. This is why the SOC 2 Type 2 is the sort of report that is extremely useful for getting a true assessment of an organization’s security posture.
D
DA95
2023-06-09
4 upvotes
A SOC Type 2 audit report is considered a "restricted use" report for its intended audience. SOC, or Service Organization Controls, is a set of auditing standards and guidelines developed by the American Institute of Certified Public Accountants (AICPA) to help service organizations demonstrate the effectiveness of their internal controls and processes. A SOC Type 2 audit report is a detailed assessment of a service organization's controls over a specific period of time, typically six to nine months. Because this report contains sensitive information about the organization's internal controls and processes, it is considered a "restricted use" report and is only intended for the organization's management, board of directors, and other stakeholders who have a need to know the information contained in the report.
A
Ahbey_911
2021-08-09
2 upvotes
The options include SOC Type I & II, not SOC 2 Type II. SOC Type I - provides a description of the controls provided by the audited organization and the auditor opinion based on the description, BUT... does not involve actual testing of controls. SOC Type 1 reports are intended for restricted use, only to be seen by the actual service organization, its current clients, or its auditors. These reports are not intended for wider or public distribution. So, the answer is correct folks.
X
xaccan
2022-04-05
3 upvotes
They mean SoC 1 which is true, which is a control report that focuses strictly on an organization’s financial statements and a service organization’s controls that can impact a customer’s financial statements
Question 6 of 25
Which of the following approaches would NOT be considered sufficient to meet the requirements of secure data destruction within a cloud environment?
Show answer
Correct answer: D
How others answered
D63%
C37%
Only 63% agreed on this answer — treat it as contested rather than settled.
Explanation
Nope. In cloud environments, usually you dont have ways to overwrite the information at physical level, so the best way is to use cryptographic erasure. And the worst is just trusting the Deletion features, because it does not actually delete the information; only the pointers to it.
Adapted from community discussion by evilwizardington · 2021-02-01 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 6 Report an issue
Candidate context
Question 6 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
E
evilwizardington
2021-02-01
5 upvotes
Nope. In cloud environments, usually you dont have ways to overwrite the information at physical level, so the best way is to use cryptographic erasure. And the worst is just trusting the Deletion features, because it does not actually delete the information; only the pointers to it.
G
guest999
2020-06-16
4 upvotes
The only INCORRECT answer is A. Either the question is incorrect or there should be multiple answers. Because B,C & D are correct in a Cloud environment.
R
RBa001
2020-07-11
4 upvotes
This is a negative Question. Option D is the least preferred method and Option A is the most preferred. Thus Correct answer is Option D
M
MaciekMT
2025-02-26
Selected D1 upvote
Deletion alone is NOT considered a sufficient method for secure data destruction in a cloud environment because it typically only removes file pointers rather than erasing the actual data. The data remains on the storage medium and can potentially be recovered using forensic techniques. 🔹 Secure Data Destruction Methods: A. Cryptographic Erasure → Deletes encryption keys, making encrypted data permanently unreadable. B. Zeroing → Overwrites storage sectors with zeros, making data recovery difficult. C. Overwriting → Replaces existing data with random patterns or predefined values to ensure secure erasure.
Question 7 of 25
What must SOAP rely on for security?
Show answer
Correct answer: C
How others answered
C60%
A40%
Only 60% agreed on this answer — treat it as contested rather than settled.
Explanation
C. TLS (Transport Layer Security) for security. TLS is a protocol that provides encryption and secure communication over a network. While SOAP can use other security measures like encryption and tokenization, it typically relies on TLS (or its predecessor, SSL) to ensure secure communication between client and server.
Adapted from community discussion by Mo22 · 2024-03-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 7 Report an issue
Candidate context
Question 7 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
M
Mo22
2024-03-26
Selected C3 upvotes
C. TLS (Transport Layer Security) for security. TLS is a protocol that provides encryption and secure communication over a network. While SOAP can use other security measures like encryption and tokenization, it typically relies on TLS (or its predecessor, SSL) to ensure secure communication between client and server.
G
globy118
2024-06-10
Selected C2 upvotes
SOAP itself does not inherently rely solely on encryption; it can work over both encrypted and unencrypted channels.
M
MaciekMT
2025-02-19
Selected C1 upvote
SOAP (Simple Object Access Protocol) does not include built-in security features, so it typically relies on transport-layer protection—most commonly TLS (Transport Layer Security)—to safeguard data in transit. While SSL was used in older implementations, it’s largely deprecated, and TLS is the modern standard for securing SOAP communications.
S
sweetykaur
2024-10-13
2 upvotes
SSL (Secure Sockets Layer). SOAP (Simple Object Access Protocol) relies on SSL for ensuring secure communication and data transfer.
Question 8 of 25
Which of the following is NOT a focus or consideration of an internal audit?
Show answer
Correct answer: A
How others answered
A93%
Explanation
Speaking from experience doing security audits at clients, internal audits do NOT result in an official certification of any kind. See it as a way of 1) finding gaps and fixing them by a certain date by which an external audit will actually perform the audit and provide certification.
Adapted from community discussion by Zeezee2 · 2021-11-20 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 8 Report an issue
Candidate context
Question 8 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
Z
Zeezee2
2021-11-20
Selected A7 upvotes
Speaking from experience doing security audits at clients, internal audits do NOT result in an official certification of any kind. See it as a way of 1) finding gaps and fixing them by a certain date by which an external audit will actually perform the audit and provide certification.
Z
Zeezee2
2021-11-20
6 upvotes
And to add to this, everything has costs to it. Internal audit = blocking personnel from doing their day to day to answer to questions, to go through documentation, have people involved internally who actually do the audit, sometimes aided by consulting firms who work from an internal audit perspective as well... All these things cost $$€€
E
Eric0223
2022-10-06
Selected A2 upvotes
The CCSP offical guide mentioned that internal audit covers cost, design, performance...while external covers some sort of the efficiency of control implementation.
L
Lenell
2022-12-28
Selected A2 upvotes
Because external audits does not take on the role of a "trusted advisor" but more of a regulator with punitive capability, I see "A" as the BEST answer.
Question 9 of 25
Which security concept is based on preventing unauthorized access to data while also ensuring that it is accessible to those authorized to use it?
Show answer
Correct answer: C
How others answered
C87%
Explanation
what a messy question preventing unauthorized access to data --> C confidentiality ensuring that it is accessible to those authorized to use it --> B Availability looks like we have to guess between B and C. As CSSP is more security oriented, i am for C
Adapted from community discussion by xroxro · 2023-02-16 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 9 Report an issue
Candidate context
Question 9 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
X
xroxro
2023-02-16
6 upvotes
what a messy question preventing unauthorized access to data --> C confidentiality ensuring that it is accessible to those authorized to use it --> B Availability looks like we have to guess between B and C. As CSSP is more security oriented, i am for C
M
MaciekMT
2025-02-19
Selected C1 upvote
Confidentiality is about ensuring that only authorized individuals have access to data, while unauthorized individuals are barred from it. By definition, this security principle means preventing disclosure to those who shouldn’t see the data, and implicitly allowing access to those who are properly authorized. Availability focuses on ensuring the data/systems are online and reachable for authorized users when needed (but does not address unauthorized access). Integrity focuses on preventing unauthorized modification of data and ensuring its accuracy and reliability. Nonrepudiation ensures a party cannot deny (repudiate) having taken an action (e.g., sending a message or signing a document).
D
DA95
2023-06-09
1 upvote
The security concept that is based on preventing unauthorized access to data while also ensuring that it is accessible to those authorized to use it is availability (option B). This concept is an important part of information security and focuses on ensuring that data and systems are available to users when they need them, without being compromised or disrupted by unauthorized access or other security threats. Integrity (option A) is related to the accuracy and completeness of data, confidentiality (option C) is focused on protecting data from unauthorized disclosure, and nonrepudiation (option D) is a concept that is used to prevent someone from denying that they performed a certain action.
C
CptSweatbread
2023-02-03
3 upvotes
I thought B as well, but I think the key words here are "prevent unauthorized access". Availability on it's own does not prevent unauthorized access.
Question 10 of 25
Which of the following is NOT a domain of the Cloud Controls Matrix (CCM)?
Show answer
Correct answer: D
How others answered
D64%
B36%
Only 64% agreed on this answer — treat it as contested rather than settled.
Explanation
The domains covered in the new Cloud Controls Matrix (CCM) v4 are: Application & Interface Security Audit and Assurance Business Continuity Mgmt & Op Resilience Change Control & Configuration Management Data Security and Privacy - DSP (old DSI) Datacenter Security Cryptography, Encryption and Key Management Governance, Risk Management and Compliance Human Resources Security Identity & Access Management Infrastructure & Access Management Infrastructure & Virtualization Interoperability & Portability • Universal EndPoint Management Security Incident Management, E-Discovery & Cloud Forensics Supply Chain Management, Transparency & Accountability Threat & Vulnerability Management Logging and Monitoring
Adapted from community discussion by xaccan · 2022-10-05 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 10 Report an issue
Candidate context
Question 10 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
X
xaccan
2022-10-05
12 upvotes
The domains covered in the new Cloud Controls Matrix (CCM) v4 are: Application & Interface Security Audit and Assurance Business Continuity Mgmt & Op Resilience Change Control & Configuration Management Data Security and Privacy - DSP (old DSI) Datacenter Security Cryptography, Encryption and Key Management Governance, Risk Management and Compliance Human Resources Security Identity & Access Management Infrastructure & Access Management Infrastructure & Virtualization Interoperability & Portability • Universal EndPoint Management Security Incident Management, E-Discovery & Cloud Forensics Supply Chain Management, Transparency & Accountability Threat & Vulnerability Management Logging and Monitoring
M
melvint
2024-08-01
Selected D5 upvotes
https://cloudsecurityalliance.org/research/cloud-controls-matrix/ Answer is D
M
MaciekMT
2025-03-01
Selected D1 upvote
The Cloud Controls Matrix (CCM) is a cybersecurity control framework developed by the Cloud Security Alliance (CSA). It includes domains that address various security aspects of cloud computing, but budgetary and cost controls are not part of its focus. The CCM is designed to ensure cloud security, not financial management. Why the other options are part of CCM: A. Data center security → This falls under Infrastructure & Virtualization Security (IVS) and Facility Security (FS) domains in CCM. B. Human resources → Covered under Human Resources Security (HRS), which deals with security policies for employees. C. Mobile security → Addressed under Mobile Security (MOS), ensuring security for mobile and endpoint devices.
S
serget12
2023-10-11
2 upvotes
I'd double check the list provided, I did not see Logging and Monitoring although that seems like it should be part of the Matrix.
Question 11 of 25
Which of the following is the sole responsibility of the cloud provider, regardless of which cloud model is used?
Show answer
Correct answer: C
How others answered
C100%
Explanation
Infrastructure and platform is what service provider can still provide but they can be provided by IaaS and PaaS providers. But the physical environment could could not be provided by any other person other than the service provider
Adapted from community discussion by Joadeika · 2024-07-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 11 Report an issue
Candidate context
Question 11 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
K
kepalon
2023-09-24
Selected C5 upvotes
Physical environment is always the responsibility of the cloud provider. In IaaS the Infrastructure has a shared responsibility.
J
Joadeika
2024-07-10
2 upvotes
Infrastructure and platform is what service provider can still provide but they can be provided by IaaS and PaaS providers. But the physical environment could could not be provided by any other person other than the service provider
R
ra1paul
2025-02-02
Selected C1 upvote
Customer will never have access to any physical environment.
S
smiley
2023-06-08
1 upvote
Why not D? Who is always responsible for the infrastructure in the cloud?
Question 12 of 25
Which of the following is NOT one of five principles of SOC Type 2 audits?
Show answer
Correct answer: C
How others answered
C100%
Explanation
The SOC Type 2 audits include five principles: security, privacy, processing integrity, availability, and confidentiality.
Adapted from community discussion by xaccan · 2024-04-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 12 Report an issue
Candidate context
Question 12 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
M
MaciekMT
2025-03-01
Selected C1 upvote
SOC 2 (Service Organization Control Type 2) audits are based on the Trust Services Criteria (TSC), which consist of five key principles: Security – Protection of systems from unauthorized access. Availability – Ensuring systems are available for operation and use. Processing Integrity – Ensuring system processing is complete, valid, accurate, timely, and authorized. Confidentiality – Protection of sensitive data from unauthorized disclosure. Privacy – Proper handling of personal information. Financial controls are NOT part of SOC 2 audits. Financial reporting is covered under SOC 1, which is focused on internal controls over financial reporting (ICFR), not security and operational controls.
K
kepalon
2024-09-24
3 upvotes
Question should read: SOC 2 audits, or even SOC 2 type audits. BUT not SOC TYPE 2.
X
xaccan
2024-04-05
2 upvotes
SOC 2 defines criteria for managing customer data based on five “trust service principles”—security, availability, processing integrity, confidentiality and privacy.
D
deegadaze1
2023-09-23
1 upvote
No, It is About SOC1 Type 1/2 [Precisely SOC1 type 2 (type II)]
Question 13 of 25
Which of the following would be a reason to undertake a BCDR test?
Show answer
Correct answer: B
How others answered
B50%
A50%
Only 50% agreed on this answer — treat it as contested rather than settled.
Explanation
Disagree with this answer. From practical exp, if it's a monolithic application and IaaS/PaaS then any application change will not require BCDR test as the infra layer or DR would have been the same. SImilarly containers and SaaS app change/update/config change also should not require BCDR test. Regulation change can be valid reason for BCDR test. Somebody commented here about RTO sarcastically but those RPO/RTO changes could be internal rules/policy with BCDR and definitely may require "next" DR test to test /confirm the new targets. More regulations can be state or Federal Govt restrictions for e.g. about failover from Govt DC to happen only to other DCs within certain geographical perimeter. Like many other ISC question, language of this question also rather vague. ISC may expect answer for this as Application change but that's not something ideally trigger this.
Adapted from community discussion by CloudTrip · 2023-02-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 13 Report an issue
Candidate context
Question 13 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
C
CloudTrip
2023-02-24
2 upvotes
Disagree with this answer. From practical exp, if it's a monolithic application and IaaS/PaaS then any application change will not require BCDR test as the infra layer or DR would have been the same. SImilarly containers and SaaS app change/update/config change also should not require BCDR test. Regulation change can be valid reason for BCDR test. Somebody commented here about RTO sarcastically but those RPO/RTO changes could be internal rules/policy with BCDR and definitely may require "next" DR test to test /confirm the new targets. More regulations can be state or Federal Govt restrictions for e.g. about failover from Govt DC to happen only to other DCs within certain geographical perimeter. Like many other ISC question, language of this question also rather vague. ISC may expect answer for this as Application change but that's not something ideally trigger this.
Z
Zeezee2
2023-05-20
Selected B3 upvotes
Personally I think B is the most appropriate answer here, I disagree with C & D and I don't think any simple functional change should trigger BCP retesting. It should perhaps trigger BCP plan changes based on changes to that application's BIA if the new functionality makes the application more or less critical to the organisation however.
E
evilwizardington
2022-08-20
3 upvotes
And the changes in metrics of a BCDR do not mean you need to test it. =P For example, assume that your RTO is lower. So what? the infrastructure didnt change, the steps didnt change, etc. So you dont need to test the BCDR to know the estimated time.
D
David_S
2022-11-07
3 upvotes
This question has a few potentially correct answers. Even a change in staff, if those are the staff who need to perform the BC/DR procedures, would trigger the need for testing, with the new staff involved.
Question 14 of 25
What is the biggest challenge to data discovery in a cloud environment?
Show answer
Correct answer: C
How others answered
C100%
Explanation
When the data is multi tenant, you cannot have access to the each tenant and get the data , it is a big concern, when the question says whats the biggest concern, it should be multi tenancy.
Adapted from community discussion by phanil1 · 2022-10-27 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 14 Report an issue
Candidate context
Question 14 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
P
phanil1
2022-10-27
7 upvotes
When the data is multi tenant, you cannot have access to the each tenant and get the data , it is a big concern, when the question says whats the biggest concern, it should be multi tenancy.
I
ikamalbhatt
2024-11-02
Selected C3 upvotes
Laws and regulations may limit the types or methods of discovery you can engage in, or what you can do with the data, as well as where and how you can store it. The EU’s General Data Protection Regulation (GDPR) has requirements that impact where and how you store data and thus may have an impact on discovery, and other regulations may also apply, depending on your organization’s compliance requirements.
M
MaciekMT
2025-03-01
Selected C1 upvote
The biggest challenge to data discovery in a cloud environment is location, because cloud data is often distributed across multiple regions, data centers, and even different cloud providers. This creates difficulties in: Tracking where data resides → Cloud providers often store data in multiple locations for redundancy and performance optimization, making it hard to pinpoint its exact location. Legal & Compliance Issues → Different countries have data sovereignty laws (e.g., GDPR, CCPA) that regulate where data can be stored, making discovery even more complex. Dynamic Environments → Cloud workloads can scale, migrate, or get replicated across various regions, affecting data visibility.
A
AlanJP
2023-01-22
4 upvotes
The ISC2 CBK lists the first challenge as "Identifying where your data is" so I guess Location is the 'right' answer despite what we think
Question 15 of 25
Which of the following should NOT be part of the requirement analysis phase of the software development lifecycle?
Show answer
Correct answer: B
How others answered
B74%
D26%
Only 74% agreed on this answer — treat it as contested rather than settled.
Explanation
Answer is correct. The Secure Software Development Lifecycle (SDLC) Process phases are 1. Requirement Gathering and Feasibility 2. Requirement Analysis 3. Design 4. Development/Coding 5. Testing 6. Maintenance Note: It is essential that security be included in discussions and the SDLC process from the very initial stages. Carter, Daniel. CCSP Certified Cloud Security Professional All-in-One Exam Guide, Second Edition (p. 169). McGraw-Hill Education. Kindle Edition.
Adapted from community discussion by MahesswarShriMohanty · 2021-01-13 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 15 Report an issue
Candidate context
Question 15 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
M
MahesswarShriMohanty
2021-01-13
15 upvotes
Answer is correct. The Secure Software Development Lifecycle (SDLC) Process phases are 1. Requirement Gathering and Feasibility 2. Requirement Analysis 3. Design 4. Development/Coding 5. Testing 6. Maintenance Note: It is essential that security be included in discussions and the SDLC process from the very initial stages. Carter, Daniel. CCSP Certified Cloud Security Professional All-in-One Exam Guide, Second Edition (p. 169). McGraw-Hill Education. Kindle Edition.
[
[Removed]
2022-07-05
4 upvotes
D is definitely not the answer. Per CBK 3rd edition page 122. "This phase includes gathering business and security requirement." Also per NIST SDLC, "Security planning should begin in the initiation phase with the identification of key security roles to be carried out in the development of the system." The correct answer is Programming language (B). CCSP official study guide says , we should refrain from choosing specific tool or technology in Requirement phase.
M
MaciekMT
2025-03-01
Selected B1 upvote
During the requirement analysis phase of the Software Development Lifecycle (SDLC), the focus is on understanding what the software needs to do rather than how it will be implemented. The key aspects include: A. Functionality → Defines what the software should do. C. Software platform → Determines where the software will run (e.g., cloud, on-prem, Windows, Linux). D. Security requirements → Identifies necessary security controls (e.g., encryption, access control). However, B. Programming languages are typically chosen later, during the design or implementation phase, based on system architecture and project constraints.
K
Kneebee
2024-04-22
2 upvotes
The correct answer is "B"; The requirement analysis phase of the software development lifecycle focuses on gathering and documenting the functional and non-functional requirements of the software system. Programming languages, on the other hand, are not a requirement but a technical decision made later in the development process. Programming languages are chosen based on the project's needs and the expertise of the development team. Therefore, they should not be part of the requirement analysis phase.
Question 16 of 25
Which of the cloud cross-cutting aspects relates to the assigning of jobs, tasks, and roles, as well as to ensuring they are successful and properly performed?
Show answer
Correct answer: B
How others answered
B100%
Explanation
Governance is the system by which the provisioning and usage of cloud services are directed and controlled. Governance defines actions, assigns responsibilities, and verifies performance. Governance includes the policy, process, and internal controls that comprise how an organization is run. Everything from the structures and policies to the leadership and other mechanisms for management.
Adapted from community discussion by Seke · 2023-02-28 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 16 Report an issue
Candidate context
Question 16 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
S
Seke
2023-02-28
7 upvotes
Governance is the system by which the provisioning and usage of cloud services are directed and controlled. Governance defines actions, assigns responsibilities, and verifies performance. Governance includes the policy, process, and internal controls that comprise how an organization is run. Everything from the structures and policies to the leadership and other mechanisms for management.
A
Ahbey_911
2022-08-09
5 upvotes
SLA is one of the defined cross cutting aspects though ( ISO 17789) Cross-cutting aspects include: • auditability (clause 8.5.2); • availability (clause 8.5.3); • governance (clause 8.5.4); • interoperability (clause 8.5.5); • maintenance and versioning (clause 8.5.6); • performance (clause 8.5.7); • portability (clause 8.5.8); • protection of personally identifiable information (clause 8.5.9); • regulatory; • resiliency (clause 8.5.10); • reversibility (clause 8.5.11); • security (clause 8.5.12); • service levels and service level agreement (clause 8.5.13).
A
AlanJP
2023-01-22
4 upvotes
According to the ISC2 CBK "The term 'governance' relating to processes and decisions looks to define actions, assign responsibilities, and verify performance."
Y
yesj
2022-03-29
3 upvotes
Goverance should be the one who keeps tracks of all the jobs should be completed
Question 17 of 25
Which aspect of cloud computing makes it very difficult to perform repeat audits over time to track changes and compliance?
Show answer
Correct answer: A
How others answered
A43%
B36%
D21%
Only 43% agreed on this answer — treat it as contested rather than settled.
Explanation
I dont understand comments like these. The given answer is A. You select A, then state multitenancy is correct (which is B), and refer to the explanation provided being good, which is an explanation for virtualization being the answer. Why is this upvoted two times?
Adapted from community discussion by styro · 2022-08-04 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 17 Report an issue
Candidate context
Question 17 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
S
styro
2022-08-04
11 upvotes
I dont understand comments like these. The given answer is A. You select A, then state multitenancy is correct (which is B), and refer to the explanation provided being good, which is an explanation for virtualization being the answer. Why is this upvoted two times?
K
Kneebee
2023-10-22
2 upvotes
The correct answer is "B". Multitenancy in cloud computing refers to the practice of multiple customers (tenants) sharing the same physical resources within a cloud environment. While multitenancy can lead to cost efficiencies and resource optimization, it can also make it more challenging to perform repeat audits over time to track changes and compliance. This is because multiple tenants may be making changes and utilizing the same shared resources, making it difficult to isolate and track specific changes and ensure compliance for each individual tenant.
Z
zxccvbnm
2022-08-14
Selected A2 upvotes
virtualization as i think Multitenancy shouldnt impact audit
S
serget12
2022-10-11
1 upvote
Virtualization is cloud, especially with templates and best practices to automate. Which would make it very easy to track and repeat logging and auditing. Bad question
Question 18 of 25
Which of the following is NOT an application or utility to apply and enforce baselines on a system?
Show answer
Correct answer: B
How others answered
B100%
Explanation
github is a a sw repository and collaboration tool. Not a control SW tool, the other ones are SW control tools. And yes, you can enforce baselines with AD. GPO- Group Policy Objects & templates.
Adapted from community discussion by kepalon · 2024-09-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 18 Report an issue
Candidate context
Question 18 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
M
MaciekMT
2025-03-02
Selected B1 upvote
GitHub is a code repository and version control platform, primarily used for storing, managing, and collaborating on code. While it can store configuration files or automation scripts, it does not directly apply or enforce baselines on a system. Why the other options are correct: A. Chef → A configuration management tool that automates system configuration and enforces baselines. C. Puppet → Another configuration management tool used to apply system baselines automatically. D. Active Directory → Used for Group Policy enforcement, which helps enforce security and system configuration baselines.
K
kepalon
2024-09-24
Selected B2 upvotes
github is a a sw repository and collaboration tool. Not a control SW tool, the other ones are SW control tools. And yes, you can enforce baselines with AD. GPO- Group Policy Objects & templates.
N
NYF
2023-06-13
1 upvote
Microsoft is releasing security baselines for on-premises Active Directory connected devices using group policies. These are used by many organizations around the globe for decades. Using these security settings, administrators can control the state of the corporate devices and maintain the standards. https://www.rebeladmin.com/2019/08/step-step-guide-apply-security-baselines-windows-10-devices-using-microsoft-intune/
A
AWSPro24
2024-06-22
1 upvote
I think gitHub is the right answer but there are certainly methods were IaC lives in github and it is therefore used as a baseline for building out infrastructure.
Question 19 of 25
Which of the following is NOT a function performed by the record protocol of TLS?
Show answer
Correct answer: B
How others answered
B83%
C17%
Explanation
ACCELERATION IS CORRECT. TLS Record protocol provides the actual secure communication method for transmitting data; encryption + authentication & in some cases also compression. Acceleration is not a component of TLS, it might be provided by another external component
Adapted from community discussion by kepalon · 2022-03-24 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 19 Report an issue
Candidate context
Question 19 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
K
kepalon
2022-03-24
Selected B4 upvotes
ACCELERATION IS CORRECT. TLS Record protocol provides the actual secure communication method for transmitting data; encryption + authentication & in some cases also compression. Acceleration is not a component of TLS, it might be provided by another external component
A
AlanJP
2021-07-23
3 upvotes
Authentication is actually done by the Handshake protocol. The Message Authentication Code is applied at the Record layer, but the authentication is not done here. TLS Accelerators are hardware encryption engines and are used in the Record layer.
[
[Removed]
2022-01-05
2 upvotes
TLS Record Protocol manages the following: Dividing outgoing messages into manageable blocks, and reassembling incoming messages. Compressing outgoing blocks and decompressing incoming blocks (optional). Applying a Message Authentication Code (MAC) to outgoing messages, and verifying incoming messages using the MAC. Encrypting outgoing messages and decrypting incoming messages.
M
MaciekMT
2025-02-20
Selected B1 upvote
The TLS record protocol is responsible for ensuring confidentiality (via encryption), data integrity (through authentication mechanisms like MACs), and it may also compress data before encryption. Acceleration is not a function of the TLS record protocol.
Question 20 of 25
How many additional DNS queries are needed when DNSSEC integrity checks are added?
Show answer
Correct answer: B
How others answered
B100%
Explanation
DNSSEC does not require any additional DNS queries to be performed. The DNSSEC integrity checks and validations are all performed as part of the single DNS lookup resolution.
Adapted from community discussion by DA95 · 2022-12-09 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Permanent link to question 20 Report an issue
Candidate context
Question 20 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
D
DA95
2022-12-09
5 upvotes
When DNSSEC integrity checks are added, an additional two DNS queries are needed. DNSSEC (Domain Name System Security Extensions) is a set of security extensions to the Domain Name System (DNS) that provide authentication and integrity for DNS data. When DNSSEC is used, additional DNS queries are needed in order to verify the authenticity and integrity of DNS records. This involves querying additional DNS resource records, such as the DNSKEY and DS records, which are used to verify the digital signatures on DNS data. As a result, two additional DNS queries are typically needed when DNSSEC is used, in addition to the initial query for the DNS data itself.
X
xroxro
2022-08-16
2 upvotes
correct me if i'm wrong but with DNSsec the recursive DNS has to query public keys to verify signature, right ? So, zero from a client point of view (only one query to his recursive DNS server) but many if count all needed queries
M
MaciekMT
2025-02-20
Selected B1 upvote
DNSSEC is designed so that the extra security-related records (such as RRSIG, DNSKEY, and DS) are returned alongside the standard DNS responses. This integration means that the resolver does not need to issue any additional DNS queries beyond the original request.
S
sweetykaur
2024-10-14
1 upvote
One. DNSSEC adds an extra DNS query to fetch the digital signatures necessary for verifying the authenticity and integrity of the DNS data.
Question 21 of 25
Which of the following statements about Type 1 hypervisors is true?
Show answer
Correct answer: A
How others answered
A57%
B29%
Only 57% agreed on this answer — treat it as contested rather than settled.
Explanation
and the answer is not correct. Type 1 hypervisor can be installed directly to different types of hardware, and normally type 1 hypervisors vendors, like cytrix and vmware do not produce hardware
Adapted from community discussion by gjjw · 2020-05-20 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
Permanent link to question 21 Report an issue
Candidate context
Question 21 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
G
gjjw
2020-05-20
12 upvotes
and the answer is not correct. Type 1 hypervisor can be installed directly to different types of hardware, and normally type 1 hypervisors vendors, like cytrix and vmware do not produce hardware
M
MaciekMT
2025-02-23
Selected A1 upvote
A Type 1 hypervisor (also known as a bare-metal hypervisor) runs directly on the hardware without an underlying operating system. Typically, the hardware vendor (e.g., Dell, HP, Cisco) is separate from the hypervisor vendor (e.g., VMware, Microsoft, Citrix, Red Hat), making option A the most accurate statement. Why Not the Others? B. The hardware vendor and software vendor are the same: Not necessarily true—many Type 1 hypervisors, like VMware ESXi or Microsoft Hyper-V, can run on hardware from multiple vendors. C. The hardware vendor provides an open platform for software vendors: While some hardware vendors optimize for certain hypervisors, this is not a defining characteristic of Type 1 hypervisors. D. The hardware vendor and software vendor should always be different for security: Security concerns exist, but this is not a strict requirement. Some companies (like IBM or Oracle) offer both hardware and hypervisor solutions together.
S
Sa007788
2021-01-28
4 upvotes
Vmware d'ont produce any hardware but the developp Hyberviseur 1, answer is false
E
escaprix
2023-06-19
Selected A2 upvotes
In the case of Type 1 hypervisors, the hardware vendor and software vendor are typically different entities. The hardware vendor manufactures and sells the physical hardware, such as servers or devices that support virtualization, while the software vendor develops and provides the hypervisor software that enables virtualization on that hardware.
Question 22 of 25
When using a PaaS solution, what is the capability provided to the customer?
Show answer
Correct answer: B
How others answered
B100%
Explanation
According to ג€The NIST Definition of Cloud Computing,ג€ in PaaS, ג€the capability provided to the consumer is to deploy onto the cloud infrastructure consumer- created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.
Supporting references
nist.gov documentation
Permanent link to question 22 Report an issue
Candidate context
Question 22 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
C
ctux
2023-03-07
6 upvotes
No, B is the right one. Check here: https://csrc.nist.gov/glossary/term/Platform-as-a-Service
M
MaciekMT
2025-02-24
Selected B1 upvote
Why B is Correct? "Consumer-created or acquired applications" → The customer develops or acquires applications and deploys them on the PaaS platform. "Using programming languages, libraries, services, and tools that the provider supports" → The provider offers a pre-defined development environment (e.g., Google App Engine, AWS Elastic Beanstalk). "The consumer does not manage or control the underlying cloud infrastructure" → The provider manages networking, servers, storage, and OS. "Consumer has control over the deployed applications and possibly configuration settings" → The customer can configure aspects of the runtime environment but not the infrastructure.
M
MaciekMT
2025-02-24
Selected B1 upvote
In a Platform as a Service (PaaS) model, the consumer (customer) can deploy applications using programming languages, libraries, and tools that the provider supports. However, the consumer does not manage or control the underlying cloud infrastructure, including servers, storage, and operating systems. The consumer has control over their deployed applications and possibly some configuration settings for the application-hosting environment.
I
Irivera
2024-01-10
3 upvotes
its B because the consumer must adhere to the tools and languages that the provider supports
Question 23 of 25
How is an object stored within an object storage system?
Show answer
Correct answer: A
How others answered
A75%
D25%
Explanation
An object is typically stored in an object storage system as a collection of data associated with a unique identifier, known as the "key". The key is used to retrieve the object from the system. The object itself can be stored in a variety of ways, such as in a flat file system, a database, or a tree structure. The specific method used to store the object will depend on the particular object storage system being used.
Adapted from community discussion by DA95 · 2022-12-09 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
redhat.com documentation
Permanent link to question 23 Report an issue
Candidate context
Question 23 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
D
DA95
2022-12-09
7 upvotes
An object is typically stored in an object storage system as a collection of data associated with a unique identifier, known as the "key". The key is used to retrieve the object from the system. The object itself can be stored in a variety of ways, such as in a flat file system, a database, or a tree structure. The specific method used to store the object will depend on the particular object storage system being used.
T
TheFivePips
2024-06-20
Selected A1 upvote
A. Key value: In an object storage system, each object is stored with a unique identifier, known as a key. This key-value pairing allows for the storage and retrieval of objects based on their unique key. D. Tree structure: A tree structure is typically used in hierarchical file systems and directories, not in object storage systems. Object storage is flat, meaning there isn't a hierarchy of folders and subfolders. In the context of object storage systems, objects themselves are typically stored in a flat namespace without inherent hierarchical organization. Here's why: Unlike traditional file systems that use a hierarchical directory structure (tree structure), object storage systems do not impose directories or folders on objects. Are designed to scale horizontally across multiple storage nodes. A flat namespace simplifies the management and distribution of objects across these nodes, allowing for efficient scaling and access. Objects in object storage systems often include metadata (attributes or tags) that describe the object's characteristics or usage. Metadata provides flexibility and additional context without the need for hierarchical organization.
M
MaciekMT
2025-02-26
Selected A1 upvote
In an object storage system, data is stored in a key-value structure, where each object consists of: A unique key (identifier) The actual data (value) Metadata describing the object This structure allows scalability, durability, and efficient retrieval of unstructured data in cloud storage solutions like AWS S3, Google Cloud Storage, and Azure Blob Storage. Why Not the Others? B. Database → Object storage does not use relational databases; it is optimized for scalable unstructured data storage. C. LDAP (Lightweight Directory Access Protocol) → Used for directory services and authentication, not object storage. D. Tree structure → Traditional file systems use a hierarchical tree structure, but object storage stores objects in a flat namespace with unique keys.
N
nachoqueen
2022-10-30
Selected A3 upvotes
"In the case of object storage, data is saved as objects by associating metadata with it. This “Key + Value” (metadata and object) format is compatible with modern data formats and retrieval needs." Reference: https://www.ridge.co/blog/what-is-object-storage/
Question 24 of 25
What must be secured on physical hardware to prevent unauthorized access to systems?
Show answer
Correct answer: A
How others answered
A100%
Explanation
BIOS is the firmware that governs the physical initiation and boot up of a piece of hardware. If it is compromised, an attacker could have access to hosted systems and make configurations changes to expose or disable some security elements on the system.
Adapted from community discussion by Zeezee2 · 2022-05-20 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
nist.gov documentation
Oracle documentation
Permanent link to question 24 Report an issue
Candidate context
Question 24 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
Z
Zeezee2
2022-05-20
7 upvotes
Answers a way too specific physical hardware element. This question talks on hardware in general, and securing BIOS brings far more value.
T
TraceSplice
2024-09-21
Selected A1 upvote
A - BIOS Based on NIST 800-147B (BIOS Protection Guidelines for Servers) https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-147b.pdf
D
deegadaze1
2022-03-15
1 upvote
D - Correct answer: https://docs.oracle.com/cd/E19102-01/n440.srvr/817-5481-11/intro.html
Question 25 of 25
Which technique involves replacing values within a specific data field to protect sensitive data?
Show answer
Correct answer: B
How others answered
B67%
D17%
C17%
Only 67% agreed on this answer — treat it as contested rather than settled.
Explanation
The CCSP Official Guide states: "The term obfuscation refers to the application of any of these techniques in order to make the data less meaningful, detailed, or readable in order to protect the data or the subject of the data." The guide indicates that obfuscation can be achieved either by masking or anonymizing. And masking has several techniques. From that explanation: obfuscation does not always mean replacing values (it can be anonymized the information, meaning, removing the information). And tokenization may be an option, but a more general answer is masking. That's why the most accurate answer is masking.
Adapted from community discussion by evilwizardington · 2021-08-19 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.
Supporting references
AWS documentation
Permanent link to question 25 Report an issue
Candidate context
Question 25 discussion
These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CCSP or CertExamHQ.
E
evilwizardington
2021-08-19
14 upvotes
The CCSP Official Guide states: "The term obfuscation refers to the application of any of these techniques in order to make the data less meaningful, detailed, or readable in order to protect the data or the subject of the data." The guide indicates that obfuscation can be achieved either by masking or anonymizing. And masking has several techniques. From that explanation: obfuscation does not always mean replacing values (it can be anonymized the information, meaning, removing the information). And tokenization may be an option, but a more general answer is masking. That's why the most accurate answer is masking.
A
Ahbey_911
2021-07-19
8 upvotes
This is another case where the examiner decides what they want as the answer, all of the answers can be correct: Data masking or Obfuscation is a process of hiding, replacing, or omitting sensitive information e.g. PII, PHI, PCI Data Anonymization is a technique for information sanitization with an intent to protect privacy. Tokenization is substituting sensitive information with non-sensitive information
M
MaciekMT
2025-02-19
Selected B1 upvote
Masking involves replacing values within a specific data field to protect sensitive data while keeping it usable for testing or display. It ensures that sensitive data, such as credit card numbers or social security numbers, is hidden from unauthorized users. Anonymization (A) → Irreversibly removes personally identifiable information (PII) to prevent re-identification. Tokenization (C) → Replaces sensitive data with a non-sensitive equivalent (token) that can be mapped back to the original data through a secure token vault. Obfuscation (D) → Scrambles or alters data to make it difficult to understand but does not follow structured masking techniques.
W
Warriors
2022-04-15
3 upvotes
Tokenization is the most appropriate answer as there are more than one ways to mask or obfuscate data that includes tokenization. However, tokenization is the process of substituting a sensitive data with a non-sensitive data (token).

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

About this question bank

Community-contributed

Compiled from exam discussions posted publicly by other people on ExamTopics. Copyright in each contribution rests with its original author; it is reproduced here for study. Not verified by us — most items carry no explanation. To request removal, see our content policy.

Compiled from ExamTopics community discussions

Compiled from publicly posted community exam discussions. Contributed by third parties rather than written here, so accuracy varies and most items carry no explanation.

Across the private full bank: 398 explanations, 481 questions with candidate context and 6 questions with direct citations.

Version 1.0.0 · bank updated 2026-08-29. How we source questions