Blog
30 free CCSP practice questions with explanations
By Emmanuel Aigbehi Walstra — CISSP, CCSP, CEH, CCSE. Thirty-plus years in cybersecurity, Lead Cloud Security Trainer at TSTC since 2020, more than 10,000 people trained, and author of CCSP Excellence (2024).
I wrote these 30 questions for this article. They are not taken from ISC2 or any other question bank, and they are not "real exam questions". Nobody honest can give you those. They cover all six domains of the CCSP exam outline effective 1 August 2026, including the new AI and machine learning objectives.
The real exam is adaptive. You get 100 to 150 items in up to three hours, and each answer affects which item comes next. You also cannot go back and change an answer. So practise the way you will be tested: read the whole question, pick the best answer, commit to it, then read the explanation. A question you get right for the wrong reason should count as a wrong answer.
Not sure what changed in 2026? Start with what changed in the CCSP exam outline, domain by domain.
How to use these questions
- Cover the answers. Each answer and explanation is directly below its question. Scroll slowly or cover them with a sheet of paper.
- Write your answers down first. Then check your answers against the explanations.
- Sort your misses by domain. If most of your misses fall in one domain, that is where your next study block should go.
- Don't judge your readiness on 30 items. A short set can show your weak areas. It cannot predict an exam result.
Domain 1: Cloud Concepts, Architecture and Design
1. A developer creates virtual machines through a web portal at 2 a.m. without contacting anyone at the provider. Which essential cloud characteristic does this show?
- A. Broad network access
- B. Resource pooling
- C. On-demand self-service
- D. Measured service
Show the answer
Answer: C. On-demand self-service means a customer can provision resources without human interaction with the provider. Broad network access is about reaching services over the network from many kinds of device. Resource pooling is about multi-tenant sharing. Measured service is about metering usage.
2. Which statement best describes reversibility as a cloud shared consideration?
- A. The ability of two systems to exchange and use information
- B. The ability to move an application to another provider with little rework
- C. The ability to roll back a failed software release
- D. The ability to retrieve your data and artefacts from a provider and have the provider delete your data after exit
Show the answer
Answer: D. Reversibility is about leaving: getting your data and application artefacts back, and having the provider remove customer data within an agreed period. Option A is interoperability and option B is portability. A release rollback is a change-management concept.
3. Why is cryptographic erasure often the most practical sanitisation method for data in a public cloud?
- A. Customers usually cannot physically destroy or overwrite shared provider media, but they can destroy the keys
- B. FIPS 140-2 requires it for all cloud workloads
- C. It removes the need for any key management
- D. It is the only method that works on solid-state drives
Show the answer
Answer: A. In a multi-tenant environment you rarely control the physical disks. If your data was encrypted and you securely destroy every copy of the key, the remaining ciphertext is unreadable. That only works if key management was done well, so C is wrong. FIPS 140-2 validates cryptographic modules and does not require crypto-shredding, so B is wrong.
4. A company moves its email to a SaaS provider. Which responsibility stays with the customer?
- A. Patching the mail application
- B. Managing user accounts, access rights and the data the company puts into the service
- C. Securing the hypervisor
- D. Physical security of the data centre
Show the answer
Answer: B. In SaaS the provider runs the application, platform and infrastructure. The customer remains responsible for identities, access, configuration within the tenant, and its own data. The customer is always accountable for its data.
5. A security team trains a machine learning model to detect anomalous cloud API activity. Why is data source validation and verification critical?
- A. It reduces the model's compute cost
- B. Unvalidated or manipulated training data can poison the model so that it misses real attacks or raises false alarms
- C. It removes the need for human analysts
- D. It guarantees the model's decisions can be explained to regulators
Show the answer
Answer: B. An ML model is only as reliable as its data. If an attacker can influence the training or input data (data poisoning), they can teach the model to ignore their behaviour. Validating data sources is a basic control in the 2026 outline's AI/ML subdomain.
Domain 2: Cloud Data Security
6. In the cloud secure data lifecycle, which phase comes immediately after Create?
- A. Use
- B. Share
- C. Store
- D. Archive
Show the answer
Answer: C. The lifecycle phases are Create, Store, Use, Share, Archive and Destroy. Storing usually happens at almost the same moment as creation, which is why controls such as classification and encryption should be applied as early as possible.
7. Which statement best describes tokenisation?
- A. Sensitive values are replaced with surrogate values that have no mathematical relationship to the original, and the mapping is kept in a protected token vault
- B. Data is encrypted with a public key so only the private-key holder can read it
- C. A one-way hash replaces the value so it can never be linked back
- D. Characters in a field are shown as asterisks on screen only
Show the answer
Answer: A. A token cannot be decrypted, because there is nothing to decrypt. Only the tokenisation system can map it back. That is why tokenisation is common for payment card data. Option C describes hashing, and option D describes display (dynamic) masking.
8. A team must give researchers a dataset in which individuals can never be re-identified, not even by the team that produced it. Which technique fits best?
- A. Pseudonymisation
- B. Encryption with a key the team keeps
- C. Tokenisation
- D. Anonymisation
Show the answer
Answer: D. Anonymisation irreversibly removes the link to individuals. Pseudonymisation, encryption and tokenisation can all be reversed by whoever holds the key or the mapping, so the data is still personal data in their hands.
9. Your organisation receives notice of litigation involving data held in a cloud storage service. Your retention policy would normally delete some of that data next week. What should happen?
- A. Follow the retention schedule, because policy must be applied consistently
- B. Place the relevant data under legal hold so it is preserved and protected from deletion until the hold is released
- C. Move the data to cheaper archive storage and delete the originals
- D. Ask the cloud provider to decide what to keep
Show the answer
Answer: B. A legal hold overrides normal retention and deletion for the data in scope. Deleting it could amount to destroying evidence. The 2026 outline lists deletion prevention and authorised access as legal hold examples.
10. Which capability most clearly separates Information Rights Management (IRM) from ordinary file encryption?
- A. IRM uses stronger algorithms
- B. IRM works only inside one cloud provider
- C. Usage rights travel with the file and can be changed or revoked after the file has been shared
- D. IRM removes the need for user authentication
Show the answer
Answer: C. With IRM, protection and permissions (view, print, copy, expiry) stay with the document wherever it goes, and the owner can revoke access later. Plain encryption controls who can decrypt the file. Once it is decrypted, it controls nothing.
11. Which technique adds calibrated statistical noise so that a model or query result does not reveal whether a specific person's record was in the data set?
- A. Differential privacy
- B. Data dispersion
- C. Hashing
- D. Format-preserving encryption
Show the answer
Answer: A. Differential privacy limits how much any single record can affect the output, which reduces membership-inference risk. It is directly relevant to the new subdomain 2.9 on AI/ML data privacy. Data dispersion spreads data across locations for resilience, which is a different goal.
Domain 3: Cloud Platform and Infrastructure Security
12. The business says it can lose no more than 15 minutes of transactions in an outage. Which metric does that set?
- A. Recovery Time Objective (RTO)
- B. Recovery Point Objective (RPO)
- C. Maximum Tolerable Downtime (MTD)
- D. Mean Time Between Failures (MTBF)
Show the answer
Answer: B. RPO is the maximum acceptable data loss, measured backwards in time from the incident. It drives how often you back up or replicate. RTO is how quickly service must be restored.
13. Which control matters most for protecting a cloud management plane?
- A. A web application firewall in front of the public website
- B. Disk encryption on every virtual machine
- C. Strong (multi-factor) authentication with tightly limited, logged privileged access
- D. Data loss prevention on outbound email
Show the answer
Answer: C. Whoever controls the management plane can create, change or delete everything in the environment. Strong authentication, least privilege and monitoring of administrative actions are the core controls. The other options protect individual workloads, not the control layer.
14. An IaaS customer running a sensitive workload is worried about side-channel attacks from other tenants' virtual machines on the same physical host. What most directly reduces this risk?
- A. Using dedicated (single-tenant) hosts
- B. Choosing a larger VM size
- C. Turning on autoscaling
- D. Moving the data to object storage
Show the answer
Answer: A. Co-residency is what makes cross-tenant side-channel attacks possible. Dedicated hosts remove other customers from the hardware. VM size and autoscaling do not change who shares the host.
15. In data centre design, what does "multi-vendor pathway connectivity" refer to?
- A. Buying servers from several manufacturers
- B. Network connections from more than one carrier, entering the facility over physically separate paths
- C. Letting multiple cloud providers share one facility
- D. Running several hypervisor brands at once
Show the answer
Answer: B. The goal is to remove single points of failure in connectivity, both by carrier and by physical route. Two carriers in the same trench can still be cut by one excavator.
16. Which business continuity test actually shuts down or fails over production to the recovery site?
- A. Tabletop exercise
- B. Checklist review
- C. Parallel test
- D. Full interruption test
Show the answer
Answer: D. A full interruption test moves real operations to the alternate site. It is the most realistic test and the most disruptive. In a parallel test, recovery systems are brought up while production keeps running. Tabletop and checklist exercises are discussion-based.
Domain 4: Cloud Application Security
17. An attacker intercepts an API request and changes the payment amount before it reaches the server. In STRIDE, which threat category is this?
- A. Spoofing
- B. Tampering
- C. Repudiation
- D. Information disclosure
Show the answer
Answer: B. Unauthorised modification of data in transit is tampering. The countermeasures include integrity protection such as TLS, message signing and server-side validation.
18. Which tool identifies known vulnerabilities and licence problems in open-source libraries used by an application?
- A. Software Composition Analysis (SCA)
- B. Dynamic Application Security Testing (DAST)
- C. Database Activity Monitoring (DAM)
- D. A load balancer
Show the answer
Answer: A. SCA builds an inventory of third-party components and checks them against vulnerability and licence data. That supports the supply-chain and licensing topics in subdomain 4.5. DAST tests a running application from the outside.
19. In a SAML-based federation, which party authenticates the user and issues assertions about them?
- A. The service provider (relying party)
- B. The cloud access security broker
- C. The identity provider
- D. The API gateway
Show the answer
Answer: C. The identity provider (IdP) authenticates the user and sends a signed assertion. The service provider trusts that assertion and grants access based on it.
20. A public API is being flooded with requests that exhaust back-end resources. Which component most directly addresses this?
- A. A Hardware Security Module (HSM)
- B. An XML parser upgrade
- C. Static code analysis
- D. An API gateway enforcing authentication, rate limiting and throttling
Show the answer
Answer: D. API gateways sit in front of services and enforce authentication, quotas and rate limits, which addresses resource exhaustion directly. An HSM protects keys, and static analysis finds code flaws before deployment. Neither stops a flood that is already happening.
21. A customer-support chatbot built on a large language model reads a customer-uploaded document that contains hidden instructions. The bot follows them and reveals its internal system prompt. What is this risk called?
- A. SQL injection
- B. Prompt injection
- C. Cross-site scripting
- D. Model inversion
Show the answer
Answer: B. This is indirect prompt injection: instructions hidden in content the model processes override its intended behaviour. The OWASP Top 10 for LLM Applications covers it, and the 2026 CCSP outline now references that list. Model inversion means reconstructing training data from a model's outputs.
Domain 5: Cloud Security Operations
22. Which statement about a Type 1 hypervisor is correct?
- A. It runs as an application on top of a host operating system
- B. It is used only on desktop computers
- C. It runs directly on the physical hardware
- D. It cannot support more than one guest operating system
Show the answer
Answer: C. Type 1 (bare-metal) hypervisors run directly on hardware and are what cloud providers use. A Type 2 hypervisor runs on top of a host OS, which adds another layer of attack surface.
23. Several outages with the same symptoms have happened over two months. Which ITIL/ISO/IEC 20000 process is responsible for finding and removing the underlying cause?
- A. Incident management
- B. Change management
- C. Release management
- D. Problem management
Show the answer
Answer: D. Incident management restores service as quickly as possible. Problem management investigates the root cause of one or more incidents and works to eliminate it, often through a change request.
24. Autoscaling is about to terminate a compromised cloud instance automatically. What should the responder do first?
- A. Let it terminate and redeploy from a clean image
- B. Isolate the instance, protect it from termination, and capture disk snapshots and, where possible, memory, while recording chain of custody
- C. Reboot it to clear the malware from memory
- D. Run an antivirus scan on the live instance
Show the answer
Answer: B. In the cloud, evidence can disappear in seconds. Preserve it first: isolate, take snapshots, capture volatile data where possible, and document the handling. Rebooting or scanning changes the evidence, and terminating the instance destroys it.
25. What does a SOAR platform add on top of a SIEM?
- A. Long-term log storage
- B. Automated, playbook-driven response actions and case orchestration across tools
- C. Packet capture at line rate
- D. Physical access control logging
Show the answer
Answer: B. A SIEM collects and correlates events. SOAR (Security Orchestration, Automation and Response) takes action on them, for example enriching alerts, disabling an account or opening a ticket, according to playbooks. SOAR appears in both Domain 1's AI/ML subdomain and in cloud operations practice.
26. Before running a penetration test against your own application hosted on a public IaaS platform, what should you do?
- A. Nothing. You own the application, so no checks are needed
- B. Test the provider's shared infrastructure too, for completeness
- C. Review the provider's penetration testing policy, keep within its permitted scope, and get internal authorisation
- D. Notify every other tenant on the platform
Show the answer
Answer: C. Providers publish rules on what customers may test and how, and some activities, such as stress or denial-of-service testing, are often restricted. You also need written internal authorisation and a defined scope. Testing the provider's infrastructure without permission is out of bounds.
Domain 6: Legal, Risk and Compliance
27. What does a SOC 2 Type II report provide that a Type I report does not?
- A. An opinion on the operating effectiveness of controls over a period of time
- B. Coverage of financial reporting controls
- C. A guarantee that the provider will not be breached
- D. A certification issued by ISO
Show the answer
Answer: A. A Type I report looks at control design at a point in time. A Type II report also tests whether the controls operated effectively over a period, typically several months. SOC 1 covers financial reporting controls, and no audit report guarantees security.
28. Under GDPR, a company uses a cloud provider to host and process its customers' personal data on the company's instructions. What is the cloud provider's role?
- A. Data controller
- B. Data subject
- C. Supervisory authority
- D. Data processor
Show the answer
Answer: D. The company decides why and how personal data is processed, which makes it the controller. The provider processes the data on the company's behalf, which makes it the processor. The controller cannot hand its accountability over to the processor.
29. Which international standard provides guidance on electronic discovery?
- A. ISO/IEC 27017
- B. ISO/IEC 27050
- C. ISO/IEC 27018
- D. ISO/IEC 27036
Show the answer
Answer: B. ISO/IEC 27050 covers eDiscovery. 27017 gives cloud-specific security controls, 27018 covers protecting PII in public clouds acting as PII processors, and 27036 covers information security in supplier relationships.
30. A business depends on a small SaaS vendor's proprietary application. Which contract provision best protects it if the vendor goes out of business?
- A. A right-to-audit clause
- B. A service-level credit schedule
- C. A software (source code) escrow arrangement
- D. A cyber risk insurance requirement
Show the answer
Answer: C. With escrow, a neutral third party holds the source code and related materials and releases them to the customer on defined events such as insolvency. That addresses vendor viability risk. A right to audit and SLA credits do not help once the vendor no longer exists.
How did you do?
Count your correct answers per domain, not just the total. The exam is compensatory: strength in one domain can make up for some weakness in another. But weak spots in heavily weighted domains such as Cloud Data Security (20%) are expensive.
If you want more practice, Sectutor's free samples include another 30-question sample of the question bank, five per domain, that runs in your browser. There is also a book chapter and about 50 slides, with no email or account needed. The full CCSP Kit ($49) has a 600-question offline question bank and a 430-page PDF study book. There are no videos, classes, labs or exam vouchers, and sales are final, so try the samples first.
If you prepare a whole team for the CCSP, read how to run internal cloud security training with a ready-made slide deck.
FAQ
Are these real CCSP exam questions?
No. They are original practice questions written for this article to match the topics in the public CCSP exam outline. ISC2 exam content is confidential, and candidates agree not to disclose it under the ISC2 examination non-disclosure agreement.
How many questions are on the actual CCSP exam?
The CCSP exam uses Computerized Adaptive Testing. It has 100 to 150 items and a maximum of three hours, according to ISC2.
Are the real CCSP questions all multiple choice?
The 2026 exam outline describes the item format as "multiple choice and advanced item types". These practice questions all use a four-option multiple-choice format.
Are these questions updated for the 2026 CCSP outline?
Yes. They follow the six domains of the outline effective 1 August 2026 and include items on its new AI and machine learning objectives (subdomains 1.6 and 2.9).
Where can I find more free CCSP sample questions?
Sectutor's samples page has a 30-question interactive sample, five questions per domain, with no sign-up. ISC2 also publishes the official exam outline, which you should use as your study checklist.
CCSP and ISC2 are registered marks of ISC2, Inc. Sectutor (Intellfence) is not affiliated with, endorsed by, or sponsored by ISC2. These practice questions are original and are not ISC2 exam content. No pass rate is published or implied.