Question 1

What is the recommended maximum relative humidity in a server equipment room?

Question 2

Which cloud service model offers attachable block storage for virtual machines and object storage for large datasets?

Question 3

Following a major migration to hosted services what is the primary challenge when implementing identity and access management for cloud resources?

Question 4

What is the formula for calculating annual loss expectancy using the single loss expectancy and the annual rate of occurrence?

Question 5

In a cloud disaster recovery plan, what should a company prioritize to maximize resilience and availability?

Question 6

What is the primary barrier to portability when migrating microservices from one cloud provider to another?

Question 7

How do dynamic policy controls work within data rights management?

Question 8

Which actions allow you to regain access to a Compute Engine VM after all network interfaces and firewall rules have been removed?

Question 9

Which of the following is an indirect identifier for an individual?

Question 10

Which Cloud Security Alliance publication provides a detailed framework of security controls for cloud environments?

Question 11

What is the primary security risk when employees use unsanctioned cloud applications to store or process organizational data?

Question 12

Which job title best describes a professional responsible for connecting an organization’s on premises systems and services to cloud platforms?

Question 13

Which section of a data retention policy defines the handling and storage requirements associated with each information classification?

Question 14

Which United States law governs the confidentiality and security of protected health information stored or transmitted in the cloud?

Question 15

Which service replicates object files to regional edge hosts to accelerate web content delivery?

Question 16

At which phase of the cloud data lifecycle does data transition from active hot storage to long term archival storage?

Question 17

Which architectural approach should be prioritized to protect an application from distributed denial-of-service attacks?

Question 18

Which capability is not typically considered a core component of a data loss prevention program?

Question 19

When preparing to conduct a cloud audit what is the first planning activity to perform?

Question 20

Which approach should be prioritized to provide automated assessment of cloud risks and continuous enforcement of security policies?

Question 21

Which method involves deliberately provisioning an isolated and monitored host or dataset to detect or divert unauthorized intrusions?

Question 22

How does the Cloud Controls Matrix assist organizations with cloud governance?

Question 23

Which aspect of encryption creates the greatest operational challenge and requires ongoing management?

Question 24

In which cloud deployment scenario is data masking not an appropriate control?

Question 25

In a Platform as a Service environment who is responsible for securing the platform?

Question 26

Which single security concern should a company prioritize when securing communications between containerized microservices?

Question 27

Which cloud characteristic enables datasets and workloads to be moved between cloud providers with minimal changes?

Question 28

Who is responsible for protecting the actual data in the SaaS, PaaS, and IaaS cloud service models?

Question 29

Which factor best addresses legal requirements regarding the physical location of cloud data and the potential applicability of foreign laws?

Question 30

Which standard emphasizes communication, consent, control, transparency, and independent annual audits for privacy in cloud services?

Question 31

Which party provides an application with identity attributes that are used to determine authorization?

Question 32

Which organization publishes best practice guidance for securing cloud deployments?

Question 33

Which cloud characteristic allows an organization to pay for actual resource consumption instead of provisioning for peak capacity?

Question 34

Which United States law governs the safeguarding of protected health information?

Question 35

Which cloud development principle involves integrating security into every phase of the application lifecycle?

Question 36

Which capability enables an entire application to be moved between cloud providers?

Question 37

What is the primary challenge investigators face when collecting forensic evidence in a hosted cloud environment?

Question 38

Which stage of the incident response process focuses on isolating affected assets to prevent further damage following a security incident?

Question 39

Which Trust Services principle is mandatory for every SOC 2 examination?

Question 40

Which guiding principle ensures identical configuration across public cloud environments and private data centers?

Question 41

Which of the following is not an overall countermeasure strategy used to mitigate cloud risks?

Question 42

Which compliance standard governs the protection of payment card data for a business that accepts credit card payments both in-store and online?

Question 43

Which ISO standard provides guidance on electronic discovery and the management of electronically stored information?

Question 44

In the three lines of defense model, where is the information security function typically placed?

Question 45

Which scenario would be most effectively mitigated by deploying a Data Loss Prevention solution?

Question 46

Which OSI layer does TLS protect and which layer does IPsec protect and how does that difference affect the range of traffic each can secure?

Question 47

What is the term for discrete block storage volumes that are presented from a storage pool to hosts?

Question 48

Which single security issue poses the greatest risk when deploying cluster orchestration across multiple cloud projects and environments?

Question 49

Which cloud specific risk list is published by the Cloud Safety Consortium?

Question 50

Which component of security control monitoring is most foundational for determining whether controls are operating as intended?

Question 51

Which approach continuously manages capacity by provisioning compute and storage where and when they are required?

Question 52

Which data sanitization method effectively removes data from provider owned virtual machines after a migration?

Question 53

Which cloud service model shifts responsibility for physical hardware to the provider while leaving the customer responsible for operating systems and applications?

Question 54

Which encryption method provides the most comprehensive protection for data at rest on cloud disks and in object storage?

Question 55

Which of the following statements about recovery time objectives is not accurate?

Question 56

What is the most effective approach to managing the security and configuration of hypervisors for a fleet of approximately 1,200 virtual machines with rapidly shifting workloads?

Question 57

Which cross cutting concern ensures that systems and processes comply with policies and legal requirements?

Question 58

In a cloud computing environment what is meant by interoperability?

Question 59

Which item commonly requested during an audit can a cloud customer not provide because the cloud provider controls the underlying physical infrastructure?

Question 60

Which of the following is not one of the core data security attributes confidentiality, integrity, and availability?

Question 61

Which data sanitization method can be used in a cloud environment to ensure that stored data is unrecoverable?

Question 62

Which testing type identifies open source components included in a codebase and verifies that their licenses are being complied with?

Question 63

What category of data would therapy records and psychiatric notes be classified as?

Question 64

Which of the following terms is not a standard risk severity level?

Question 65

Which aspect of a multi factor authentication deployment should be prioritized to most effectively reduce the risk of unauthorized access?

Question 1

60 percent relative humidity is correct. This is the recommended maximum relative humidity for a server equipment room to avoid condensation while limiting corrosion and moisture related failures.

Keeping humidity at or below 60 percent reduces the chance of moisture condensing on electronic components and rack cabling which can cause corrosion and electrical shorts. It also balances the need to avoid overly low humidity that increases electrostatic discharge risk while maintaining dew point control in the cooling system.

75 percent relative humidity is incorrect because that level is too high for server rooms. At 75 percent the risk of condensation and corrosion is much greater and it exceeds common industry guidance for noncondensing environments.

45 percent relative humidity is incorrect in the context of this question about the maximum. Forty five percent is a common and acceptable target operating value, but it is not the maximum allowed value that the question asks for.

Question 2

The correct answer is Infrastructure as a Service.

Infrastructure as a Service provides foundational compute and storage primitives that you can provision and manage. It offers attachable block storage volumes that behave like virtual disks for virtual machines and it integrates with object storage solutions for large unstructured datasets. These capabilities let you control disks, snapshots, and backups while you manage the operating system and applications on the virtual machines.

Software as a Service is incorrect because it delivers fully managed applications and does not give customers access to underlying virtual machines or raw block devices. Users configure the application but they do not manage disks or low level storage.

Container as a Service is incorrect because it focuses on deploying and orchestrating containers rather than exposing VM block devices. Container platforms may provide volume abstractions for containers but the provisioning of attachable VM block storage and separate object stores is handled at the infrastructure layer.

Question 3

The correct option is Balancing robust security controls with user friendly access.

This is the primary challenge because after a major migration organizations must enforce strong authentication and least privilege while keeping access simple enough for users and administrators to adopt. If controls are too restrictive users create workarounds and productivity suffers, and if controls are too permissive the attack surface grows.

Addressing this challenge requires designing fine grained but manageable policies, using single sign on and federation where possible, and applying conditional access and adaptive authentication so risk is reduced without undue friction. Automation and clear governance help, but the central issue remains achieving effective security that users can actually work with.

Managing role and policy sprawl is a common operational problem after migration but it is more of a symptom of the bigger tension between strict controls and usable access. Sprawl often results when teams create many ad hoc roles to avoid friction rather than from the fundamental trade off itself.

Centralizing identity across numerous SaaS and PaaS applications is an important and necessary objective in many migrations, but it is a means to an end rather than the main challenge. Federation and single sign on can centralize identities, yet the harder work is keeping access secure and convenient across that centralized environment.

Question 4

The correct answer is Single loss expectancy multiplied by annual rate of occurrence.

Single loss expectancy is the expected monetary loss from a single occurrence of an event and annual rate of occurrence is the expected number of times that event happens in a year. Multiplying the two yields the annual loss expectancy because you take the loss per event and scale it by how often the event occurs each year to produce an expected annual monetary loss.

Single loss expectancy is often calculated as the asset value multiplied by an exposure factor which represents the proportion of the asset lost in a single event. Once you have that per event loss you multiply it by the annual rate of occurrence to get the final yearly estimate.

Single loss expectancy divided by annual rate of occurrence is incorrect because dividing would reduce the per event loss by the frequency and would not produce an expected annual loss. You need to scale the per event loss by the frequency rather than divide by it.

Single loss expectancy plus annual rate of occurrence is incorrect because addition mixes monetary loss and event frequency and does not yield a meaningful annual monetary expectation. The units do not align so simple addition is not a valid calculation.

Question 5

The correct option is Replicating data and workloads across geographically distant regions.

Replicating data and workloads across distant regions provides the highest resilience and availability because it protects against region level failures and large scale outages. This approach allows for automated failover and for architectures that meet strict recovery time objectives and recovery point objectives. It also reduces the risk of correlated failures that can affect all availability zones inside a single region.

When implemented correctly cross region replication can be active active or active passive. Teams can use asynchronous or synchronous replication depending on consistency and latency needs and they should test failover procedures regularly to validate recovery goals.

Deploying across multiple availability zones within one region is useful for high availability in normal conditions but it does not protect against a full region outage. Availability zones are separate failure domains inside a region and they can still be affected by region wide incidents.

Minimizing disaster recovery costs is an important consideration but it should not be the primary priority when the goal is to maximize resilience and availability. Focusing only on cost can lead to insufficient redundancy and longer outages which defeats the objective of a robust disaster recovery plan.

Question 6

Rewriting code to use provider specific APIs and services is the correct answer because changing application code to call proprietary cloud services creates direct dependencies that prevent easy movement of microservices between providers.

When you must change business logic or the way an app interacts with storage, messaging, identity, or platform features you create tight coupling to the original provider. Using provider specific APIs and services usually forces code rewrites for SDKs, data models, error handling, and semantics which is much harder to automate than configuration changes.

Adapting to vendor specific hardware accelerators is not the primary obstacle for most microservices. Specialized accelerators matter for high performance computing and certain machine learning workloads. Typical microservices are CPU and memory bound and you can often package them in containers or use portable libraries so hardware differences are a secondary concern.

Reconciling networking and IAM differences across clouds is important but it is often solved with abstraction and configuration. Tools like service meshes, standard networking constructs, and federated identity providers let teams adapt networking and IAM without rewriting application logic. Those changes are operational and configuration focused rather than requiring wholesale code changes.

Question 7

Revocable access after distribution is correct because dynamic policy controls let an