CCSP. Set it up and run it.

1. Refer to the exhibit. Based on the shared responsibility matrix shown, who is responsible for securing the runtime and middleware layer in a PaaS deployment?

• A. The cloud provider
• B. The cloud customer
• C. A joint responsibility split evenly
• D. The cloud carrier

Correct answer: A. The matrix marks the runtime and middleware row as Provider under the PaaS column, reflecting that PaaS providers manage the platform runtime and middleware so customers only handle their code and data above it.

Why the others are wrong. The cloud customer manages runtime and middleware only in IaaS, not PaaS as the matrix shows. There is no even joint split in the matrix; each cell names a single owner. The cloud carrier provides transport and appears nowhere in the responsibility rows. None of these three matches the PaaS runtime cell.

2. A cloud architect is selecting controls specifically for the store phase of the data lifecycle. Which two controls are MOST characteristic of protecting data at rest? (Choose two.)

• A. Certificate pinning on client sessions
• B. Encryption of the stored objects
• C. Managed key storage in a KMS or HSM
• D. Session timeout on interactive logins
• E. Rate limiting on the public API gateway

Correct answer: B. Protecting data at rest in the store phase relies on encrypting the stored objects and safeguarding the keys in a managed key store such as a KMS or HSM, which together keep persisted data unreadable if the media is exposed.

Why the others are wrong. Certificate pinning and session timeouts protect data in transit and interactive sessions during the use phase, not data sitting at rest. Rate limiting on an API gateway is an availability and abuse-prevention control at the application edge, addressing traffic volume rather than the confidentiality of stored objects.

3. A developer provisions additional virtual machines through a web portal at 2 a.m. without contacting the provider's staff. Which essential cloud characteristic does this BEST illustrate?

• A. Resource pooling
• B. On-demand self-service
• C. Measured service
• D. Broad network access

Correct answer: B. On-demand self-service means a consumer can unilaterally provision computing capabilities automatically without requiring any human interaction with the provider. Provisioning virtual machines from a portal at any hour with no staff involvement is exactly this.

Why the others are wrong. Resource pooling describes the provider serving multiple tenants from shared physical resources, not the act of self-provisioning. Measured service concerns metering consumption for billing. Broad network access refers to reaching services over standard networks from diverse client devices, none of which is the self-service behavior shown here.

4. In the create phase of the cloud data lifecycle, which control provides the GREATEST long-term benefit by shaping how the data is protected everywhere it later travels?

• A. Enabling verbose provider audit logging
• B. Deploying a web application firewall
• C. Scheduling periodic key rotation
• D. Assigning a data classification label

Correct answer: D. Classifying data at creation establishes its sensitivity and drives every downstream control decision, from encryption strength to access rules and retention, so the assigned label follows the data through storage, use, sharing, archiving, and destruction.

Why the others are wrong. Verbose audit logging records events but does not shape protection at the moment data is born. A web application firewall guards inbound application traffic, not the classification that governs handling. Key rotation strengthens an existing scheme but presumes protection decisions already made when the data was classified.

5. In a cloud data center, a Type 1 hypervisor runs directly on the physical host hardware. What is the PRIMARY security benefit of this bare-metal design over a Type 2 hypervisor?

• A. It encrypts all virtual machine memory by default automatically
• B. It eliminates the need for guest operating system patching
• C. It removes the host operating system as an attack surface
• D. It prevents tenants from ever sharing physical CPU cores

Correct answer: C. A Type 1 hypervisor runs on bare metal with no underlying host operating system, so there is no separate host OS layer an attacker could compromise to reach every guest, which meaningfully shrinks the attack surface.

Why the others are wrong. Type 1 hypervisors do not automatically encrypt guest memory; that requires separate features. They do not remove the requirement to patch each guest operating system, which the tenant still owns. And they do not stop physical CPU cores from being shared, since scheduling multiple tenants onto shared cores is exactly how virtualization achieves density.

6. A development team adopts DevSecOps and wants security integrated continuously rather than bolted on at the end. What practice MOST directly supports this shift-left approach?

• A. A final penetration test the week before release
• B. A production web application firewall blocking attacks
• C. An annual third-party security audit of the app
• D. Automated security testing inside the CI/CD pipeline

Correct answer: D. Shift-left DevSecOps embeds automated security testing into the CI/CD pipeline so flaws are caught continuously during development rather than late, which lowers remediation cost and reduces the risk reaching production.

Why the others are wrong. A pre-release penetration test still surfaces defects late, when they are expensive to fix. A production firewall only filters runtime traffic and never improves the underlying code. An annual audit is infrequent and reactive, catching issues long after developers introduced them.

7. Before deploying virtual machine images across its cloud estate, an operations team wants an industry-recognized, documented secure starting configuration to harden each image. What resource BEST provides this?

• A. A responsibility matrix
• B. A capacity forecast
• C. A CIS Benchmark
• D. A data retention schedule

Correct answer: C. CIS Benchmarks are consensus-developed, prescriptive hardening guides that define a secure baseline configuration for operating systems and platforms, giving teams a repeatable, industry-recognized standard to apply before deployment.

Why the others are wrong. A responsibility matrix clarifies who secures which layer but prescribes no configuration settings. A capacity forecast predicts resource demand and is unrelated to hardening. A data retention schedule governs how long records are kept, not how systems are securely configured.

8. A finance team receives a monthly invoice detailing exact storage gigabytes, compute hours, and egress consumed, with charges scaling to actual use. Which characteristic is demonstrated here?

• A. Measured service
• B. Rapid elasticity
• C. Resource pooling
• D. On-demand self-service

Correct answer: A. Measured service means cloud systems automatically control and optimize resource use by metering, so consumption can be monitored, reported, and billed transparently. A usage-based invoice tied to metered gigabytes and compute hours is the defining example.

Why the others are wrong. Rapid elasticity concerns scaling capacity up and down to match demand, not the metering that produces a bill. Resource pooling is the multi-tenant sharing of underlying hardware. On-demand self-service is the ability to provision without provider staff; none of these describes the metering and chargeback shown.