Free CCSP practice questions

On-demand self-service: the customer provisions capabilities alone, when needed, without human interaction with the provider.

The deciding detail is that nobody at the provider handled the request. NIST SP 800-145 names exactly that as on-demand self-service. Rapid elasticity is the tempting near-twin, but it describes capacity scaling up and down with demand, not the customer acting without the provider.

1. Find the deciding detail: the customer provisioned resources with no provider staff involved.
2. Match it to the characteristic whose definition mentions no human interaction with the provider.
3. Rule out elasticity, which is about scaling with demand, and pooling and metering, which describe the provider side.

Exam tip: No ticket and no provider staff in the loop means on-demand self-service.

The cloud data security lifecycle has six phases: Create, Store, Use, Share, Archive and Destroy.

The Cloud Security Alliance describes data moving from creation, through storage that happens almost immediately, to active use and sharing, then into long-term archive and finally destruction. The wrong sequences each swap two neighbours: Use before Store ignores that storage accompanies creation, and moving Share after Use or Archive breaks the idea that archiving is the end of active life.

1. Recall that storage happens nearly at the moment of creation.
2. Place the active phases next: Use, then Share.
3. End with the inactive phases: Archive, then Destroy.

Exam tip: Create, Store, Use, Share, Archive, Destroy: active life first, then retention, then destruction.

Physical security of cloud data centers belongs to the provider under every service model.

The shared responsibility split moves up and down the stack with the service model, but it never reaches below the hypervisor for the customer in public cloud. Facilities, power, cooling, racks, hosts and media are owned and run by the provider in IaaS, PaaS and SaaS. The tempting answer that IaaS customers own the hosts confuses responsibility for the guest operating system with responsibility for the physical server it runs on.

1. Identify the layer in question: buildings, racks and hosts are the physical layer.
2. Recall that the customer's IaaS responsibility starts at the guest operating system.
3. Conclude that the physical layer stays with the provider under every service model.

Exam tip: Whatever the service model, the provider owns the physical layer; the customer's share starts above it.

OWASP publishes awareness lists (the Top 10 family) and a verification standard (ASVS); they serve different jobs.

ASVS was written to be used as requirements and as a verification baseline: each requirement can be tested, and its levels let an organization choose how much assurance an application needs. The Top 10 lists, including the LLM list, raise awareness of the most important risk categories, and the CWE Top 25 ranks weakness types. None of those three gives a team acceptance criteria to test against.

1. Note what the team needs: testable requirements and a verification baseline.
2. Separate awareness lists (Top 10 family, CWE Top 25) from standards.
3. Choose the OWASP resource built for verification.

Exam tip: Top 10 lists raise awareness; ASVS is what you verify against.

A hardware security module (HSM) is a hardened appliance that generates, stores and uses keys inside a tamper-resistant boundary on behalf of many applications.

The need has three parts: shared by many applications, reachable over the network, and keys that never leave hardware. An HSM is built for exactly that. A TPM also keeps keys in hardware, but it is bound to a single host and protects that host's boot and secrets. A BMC is a management controller, and a self-encrypting drive only protects data on its own disk.

1. Note that the service must be shared across many applications.
2. Separate per-host hardware roots of trust from shared cryptographic appliances.
3. Choose the appliance that performs operations with keys it never releases.

Exam tip: Shared, network-reachable key operations in tamper-resistant hardware: HSM. One host's root of trust: TPM.