CCSP Practice Questions

The American Institute of Certified Public Accountants (AICPA) defines the Service Organization Control (SOC) reports. A SOC 2 report is specifically designed to provide assurance about a service organization's controls based on the Trust Services Criteria. These criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy. The question directly asks for the audit that reviews controls for confidentiality, integrity, and availability, which are three of the five Trust Services Criteria, making SOC 2 the correct answer.

A. SOC 1 reports focus on a service organization's controls that are relevant to a user entity's internal control over financial reporting (ICFR).

C. SOC 3 is a general-use, high-level summary of the SOC 2 report. While it covers the same criteria, the SOC 2 is the detailed audit review itself.

D. SOC 4 is not a standard, currently defined report type within the primary SSAE framework alongside SOC 1, 2, and 3.

1. AICPA. (2017). SOC 2® - SOC for Service Organizations: Trust Services Criteria. The official AICPA guidance defines the scope of a SOC 2 engagement as reporting on controls relevant to the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy).

2. Official (ISC)² Guide to the CCSP CBK, 5th Edition. Chapter 1, "Cloud Concepts, Architecture, and Design," details audit reports, stating, "A SOC 2 report is concerned with the service provider’s controls, related to the AICPA Trust Services Criteria (TSC)."

3. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Domain 2, "Governance and Enterprise Risk Management," page 32, describes SOC 2 as the report that "evaluates the service provider’s controls against the CSA Cloud Controls Matrix (CCM) and the AICPA Trust Service Principles."

Structured data storage, particularly Database-as-a-Service (DBaaS) offerings, poses the highest risk of vendor lock-in. Customers often write application code that relies on the provider's proprietary APIs, unique database extensions, and specific management features. Migrating such an application to a different cloud provider requires not only moving the data but also significant and costly refactoring of the application code to work with a new database system. This high switching cost is the essence of vendor lock-in.

A. Unstructured: This is a data classification, not a storage type. While moving large volumes can be difficult, the storage APIs (e.g., S3) are often standardized.

B. Object: Object storage has a de facto standard API (Amazon S3 API) that many providers support, which helps mitigate vendor lock-in compared to proprietary database services.

C. Volume: Volume (block) storage presents a standard block device to the OS. While snapshots can be proprietary, the filesystems and data on them are generally portable.

1. National Institute of Standards and Technology. (2011). NIST Cloud Computing Reference Architecture (NIST Special Publication 500-292). (Section 5.3.3, "Portability and Interoperability," discusses how a lack of standardized interfaces can lead to vendor lock-in, a problem most acute in complex PaaS/DBaaS offerings).

2. Weinman, J. (2011). The Other Side of the Cloud: The Realities of Cloud-based Services. IEEE Cloud Computing. (This article discusses the "Hotel California" effect, or vendor lock-in, highlighting data and application-level dependencies, which are most pronounced with structured database services). DOI: https://doi.org/10.1109/MCC.2011.82 (Page 3, "Data Lock-in")

3. Stanford University. (CS 142 Courseware). Web Applications, Lecture 18: Cloud Computing. (Lecture notes often discuss the trade-offs of cloud services, including how PaaS offerings like managed databases can increase development speed at the cost of portability and potential vendor lock-in).

The Cloud Service Business Manager role is specifically responsible for the commercial and financial aspects of a cloud service. This includes managing customer relationships, overseeing billing and accounting processes, and handling financial transactions. This role acts as the bridge between the customer's business needs and the provider's service delivery, focusing on contracts, pricing, and financial viability rather than the technical implementation or day-to-day operations of the service.

A. Cloud service manager: This is a broad, often technical, role; the business manager is the specific role for financial and customer relationship tasks.

B. Cloud service deployment: This is a purely technical role focused on the installation, configuration, and rollout of cloud services.

D. Cloud service operations manager: This role is responsible for the ongoing technical health, performance, and availability of the cloud services.

Liu, F., et al. (2011). NIST Cloud Computing Reference Architecture (NIST Special Publication 500-292). National Institute of Standards and Technology. Page 14, Section 4.2, "Cloud Service Management," describes the "Business Support" function, which includes customer management and billing.

ISO/IEC 17789:2014, Information technology — Cloud computing — Reference architecture. Section 6.3.2 describes the activities of the Cloud Service Provider, which are logically separated into business, operational, and development functions.

Ephemeral storage is, by definition, non-persistent; its contents are lost when the associated compute instance is terminated or fails. The most significant threat of using this storage type for sensitive, transactional data like payment information is the high probability of permanent data loss. This directly compromises data availability and integrity. The correct mitigation strategy is to use a storage service designed for durability and persistence, such as cloud block storage or object storage, for any data that must be retained beyond the lifecycle of a single compute instance.

A. Unauthorized access is a general threat to all storage types, not a unique or primary threat stemming from the ephemeral nature of the storage.

B. Data leakage through APIs is a threat related to the management and access plane, not the underlying persistence characteristic of the storage medium.

C. The problem is a lack of persistence, not a "data persistence issue." Encryption is a control for confidentiality, not for preventing data loss on termination.

1. Microsoft Azure Documentation. (n.d.). Temporary disk. In Sizes for virtual machines in Azure. Retrieved from Microsoft Docs. "The temporary disk is not persistent... Data on the temporary disk may be lost during a resize operation, when you redeploy a VM, or when the underlying hardware fails."

2. Amazon Web Services. (n.d.). Amazon EC2 instance store. Retrieved from AWS Documentation. "The data in an instance store persists only during the life of its associated instance. If an instance reboots (intentionally or unintentionally), data in the instance store persists. However, data in the instance store is lost under any of the following circumstances: The underlying drive fails, The instance stops, The instance terminates."

3. Cloud Security Alliance. (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Page 103. Discusses the need to understand the differences between persistent and non-persistent storage in IaaS environments.

A SOC 1 (Service Organization Control 1) report is specifically designed to address controls at a service organization that are relevant to a user entity's internal control over financial reporting (ICFR). When an auditor requests assurance on controls impacting financial statements, the SOC 1 report is the appropriate document. It provides the user entity's financial statement auditors with the information they need to assess the risks arising from the services provided by the service organization. This directly matches the auditor's request in the scenario.

A. SSAE 18 is the attestation standard under which SOC reports are issued, not the report itself.

B. A SOC 2 report focuses on controls related to the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

D. A SOC 3 report is a general-use, high-level summary of the SOC 2 report and does not contain the detailed information required for a financial audit.

1. American Institute of CPAs (AICPA). (2022). SOC 1®—SOC for Service Organizations: ICFR. "A SOC 1® report is designed to help service organizations that provide services to other entities, build trust and confidence in their service delivery processes and controls... through a report by an independent CPA... The report is on the controls at a service organization that are relevant to a user entity’s internal control over financial reporting (ICFR)." Retrieved from aicpa.org.

2. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Page 101, Section on "SOC 1/SSAE 18/ISAE 3402". "This report audits controls relevant to a client's financial reporting."

A traditional network firewall operates at Layers 3 (Network) and 4 (Transport) of the OSI model. Its primary function is to filter traffic based on information in the packet headers. This includes the source and destination IP addresses (Layer 3), the protocol being used such as TCP or UDP (Layer 4), and the source and destination port numbers (Layer 4). A standard firewall is not concerned with the payload of the packet. Therefore, it does not inspect or process encrypted data; it simply sees an encrypted packet and makes a pass/deny decision based on its header information.

A. IP address: Firewalls fundamentally rely on source and destination IP addresses to create access control rules.

C. Port: Port numbers (e.g., 80 for HTTP, 443 for HTTPS) are a critical component of firewall rules for filtering application traffic.

D. Protocol: Firewalls filter traffic based on the protocol type, such as TCP, UDP, or ICMP, as defined in the packet header.

1. National Institute of Standards and Technology (NIST). (2009). NIST Special Publication 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy. Section 2.1, "Firewall Technologies". (This document details that packet filter firewalls, the most basic type, examine the protocol, source/destination IP addresses, and source/destination ports).

2. Kent, S., & Seo, K. (2005). Security Architecture for the Internet Protocol. RFC 4301. Section 1.1. (This IETF standard, while focused on IPsec, implicitly distinguishes the role of firewalls in managing traffic by header information, separate from the encryption provided by protocols like IPsec).

3. Cheswick, W. R., Bellovin, S. M., & Rubin, A. D. (2003). Firewalls and Internet Security: Repelling the Wily Hacker (2nd ed.). Addison-Wesley Professional. Chapter 4, "Packet Filtering". (This foundational academic text explains that packet filters make decisions based on Layer 3 and 4 headers, not the data/payload within).

The scenario describes frequent outages, which is a service availability issue. According to ITIL and ISO/IEC 20000-1, the primary process for managing active service interruptions and restoring normal operations as quickly as possible is Incident Management. Establishing a formal Incident Management process provides a structured and efficient approach to detect, log, diagnose, and resolve incidents (outages). This directly addresses the problem of frequent outages and is the foundational step to improving service availability as prescribed by these standards. The other options are supporting activities but not the primary process for handling outages.

B. Penetration testing is a security activity to find vulnerabilities; it does not manage or resolve active outages to restore service availability.

C. Logging and monitoring are essential for detecting incidents, but they are inputs to the Incident Management process, not the process itself that restores service.

D. Data encryption is a security control for confidentiality and integrity, not a process primarily focused on ensuring service availability or managing outages.

1. ISO/IEC 20000-1:2018, Information technology — Service management — Part 1: Service management system requirements. Clause 8.6.2, "Incident management," states the purpose is "to restore normal service operation as quickly as possible and to minimize the adverse impact on business operations."

2. AXELOS. (2019). ITIL Foundation, ITIL 4 Edition. Section 5.2.5, "Incident management," defines the practice's purpose as minimizing the negative impact of incidents by restoring normal service operation as quickly as possible.

3. Iden, J., & Eikebrokk, T. R. (2013). Implementing IT Service Management: A systematic literature review. International Journal of Information Management, 33(3), 512-523. https://doi.org/10.1016/j.ijinfomgt.2013.01.004. The paper discusses the centrality of Incident Management in ITSM frameworks like ITIL for maintaining service levels.

Platform as a Service (PaaS) is the most suitable cloud service category. PaaS provides a complete development and deployment environment in the cloud, including application runtimes, middleware, operating systems, and development tools. This allows the company to focus solely on developing, deploying, and scaling their custom application without managing the underlying infrastructure (servers, storage, networking), which they currently lack. PaaS abstracts the infrastructure layer, accelerating the development lifecycle.

A. IaaS would require the company to manage the operating systems and middleware, adding overhead they wish to avoid.

B. NaaS only provides network services and is not a comprehensive platform for application development and deployment.

D. SaaS provides ready-to-use software applications, which is unsuitable as the company wants to develop its own custom application.

1. Mell, P., & Grance, T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology. Page 2, Section "Service Models".

2. Gordon, A., & Hernandez, S. (2023). Official (ISC)² CCSP Certified Cloud Security Professional Official Study Guide (3rd ed.). Wiley. Chapter 1, "Cloud Computing Concepts," Section "Platform as a Service (PaaS)".

3. Stanford University. (n.d.). CS 108: Cloud Computing. Course materials. Retrieved from Stanford courseware discussing cloud service models, specifically the role of PaaS in application development.

A data retention policy formally defines the rules for keeping and disposing of information. It specifies the duration (how long to keep data), the format (to ensure long-term readability), and accessibility (who can access the archived data). Costs associated with storage and management are a business consideration and a budgetary input when creating and implementing the policy, but they are not an element defined within the policy document itself. The policy dictates requirements, not the financial expenditure to meet them.

A. Format: The policy must specify the data format to ensure it remains usable throughout its retention lifecycle, preventing obsolescence.

C. Accessibility: The policy must define access controls, specifying who is authorized to view, modify, or delete the retained data.

D. Duration: This is the most fundamental component of a retention policy, defining the specific period for which data must be kept.

1. ISO 15489-1:2016. Information and documentation — Records management — Part 1: Concepts and principles. Section 9.2, "Retention and disposition," outlines the need for policies to specify retention periods and disposition actions. It does not list cost as a policy component.

2. Hofmann, P., & Samp, C. (2014). Managing Information and Records. Facet Publishing. Chapter 5, "Retention Scheduling," details the components of a retention schedule, including record series, retention period, and disposition method. Financial costs are treated as an implementation factor, not a policy attribute.

3. University of California. (n.d.). UCOP Records Retention Schedule. UC Office of the President. This official university policy document provides examples of retention schedules that specify duration and disposition but do not include cost information within the schedule itself.

A Type 1 hypervisor, or bare-metal hypervisor, is a software layer that installs directly onto the physical hardware. In the vast majority of enterprise and cloud deployments, the hypervisor software (e.g., VMware ESXi, Microsoft Hyper-V) is developed by a different vendor than the physical server hardware (e.g., Dell, HPE, Cisco). This decoupling of the virtualization software from the underlying hardware is a key market characteristic that allows for flexibility and choice in building virtualized infrastructure.

B. The hardware vendor and software vendor are the same: This is only true for specific, less common integrated systems (e.g., IBM PowerVM) and is not the general case.

C. The hardware vendor provides an open platform for software vendors: This statement is too generic and applies to most forms of computing, not specifically to Type 1 hypervisors.

D. The hardware vendor and software vendor should always be different for the sake of security: This is a subjective security opinion, not a defining technical characteristic of the technology.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication 800-125, Guide to Security for Full Virtualization Technologies. Section 2.1, "Virtualization Architectures," defines Type 1 hypervisors by their direct installation on hardware, an architecture that facilitates the common market model of separate hardware and software vendors.

2. VMware, Inc. VMware Compatibility Guide. This official vendor documentation lists hundreds of server models from dozens of different hardware vendors that are certified to run VMware's Type 1 hypervisor (ESXi), demonstrating the separation of software and hardware vendors as the standard model.