CCSP Cloud Concepts, Architecture and Design 3

Question 1

What is the primary purpose of identity federation in cloud computing environments?

Accepted Answer

To enable users to authenticate once and access resources across multiple cloud services using a single identity

Answer

To duplicate user accounts across multiple cloud platforms for redundancy

Answer

To encrypt user credentials stored across cloud identity providers

Answer

To restrict each user to accessing only a single cloud provider

Question 2

Which cloud security architecture model assumes that no user, device, or network segment should be inherently trusted and requires continuous verification for all access requests?

Accepted Answer

Zero Trust Architecture

Answer

Defense-in-depth model

Answer

Perimeter security model

Answer

Role-based access control model

Question 3

What does the concept of 'data sovereignty' refer to in cloud computing?

Accepted Answer

The legal principle that data is subject to the laws and regulations of the country where it physically resides

Answer

The customer's right to encrypt all data stored in the cloud

Answer

The cloud provider's ownership of customer data stored on their infrastructure

Answer

The ability to retrieve data from cloud storage at any time without restriction

Question 4

What is the key purpose of a Service Level Agreement (SLA) between a cloud customer and cloud service provider?

Accepted Answer

To establish measurable performance commitments, uptime guarantees, and remedies for service failures

Answer

To define the technical architecture of the cloud deployment

Answer

To specify the security tools the provider will use to protect customer data

Answer

To outline the customer's internal security policies for cloud use

Question 5

In cloud reference architectures, what does the term 'availability zone' typically refer to?

Accepted Answer

An isolated location within a cloud region with independent power, cooling, and networking infrastructure

Answer

A virtual network segment that limits access to authorized users only

Answer

A geographic region where a cloud provider operates multiple data centers

Answer

A software-defined perimeter protecting cloud workloads from external threats

Question 6

Which cloud architecture principle recommends designing systems to expect and handle component failures gracefully rather than trying to prevent all failures?

Accepted Answer

Design for failure

Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Question 7

When evaluating a cloud provider's security posture using the CSA STAR program, which level provides the highest assurance through ongoing automated attestation of security controls?

Accepted Answer

Level 3: Continuous monitoring-based certification with automated attestation

Answer

Level 1: Self-Assessment using the CAIQ questionnaire

Answer

Level 2: Third-party assessment-based certification (ISO 27001 or SOC 2 + CCM)

Answer

Level 4: Government-mandated compliance review and audit