10 free, exam-style Certificate of Cloud Security Knowledge (CCSK) v5 (CCSK) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CCSK practice test to study every exam domain.
These 10 free CCSK questions are organized by exam domain, so you can see how each part of the Certificate of Cloud Security Knowledge (CCSK) v5 blueprint is tested. Reveal the answer and explanation under each question.
A startup chooses a cloud provider where they can deploy web applications by uploading code and the provider automatically handles server provisioning, load balancing, and scaling. The startup manages only the application code and its data. This BEST describes:
Correct answer: B - PaaS
An organization's cloud registry reveals that it is using 47 different SaaS applications, 12 of which were unknown to the IT team. The MOST appropriate governance response is to:
Correct answer: B - Assess each application against security policies, perform risk analysis, and bring unapproved services into compliance or decommission them
During risk monitoring (Step 4), a security team discovers that a cloud provider has changed its encryption practices. The MOST appropriate response is to:
Correct answer: B - Reassess the risk, evaluate the impact of the change, and determine if additional controls are needed
A company has three business divisions: Finance, Engineering, and Marketing. Each division runs both production and development workloads. The MOST effective hierarchy design would be:
Correct answer: B - Separate OUs for each division, with sub-OUs for production and development within each
A user wants to allow a third-party application to access their cloud storage files without sharing their password. The MOST appropriate standard is:
Correct answer: B - OAuth 2.0, which enables delegated authorization without sharing credentials
An organization needs to manage application vulnerabilities across its CI/CD pipeline, from code to production. The MOST appropriate tool category is:
Correct answer: C - ASPM
An organization needs to allow HTTP (port 80) traffic to a web server and deny all other inbound traffic at the instance level. The MOST appropriate component is:
Correct answer: B - A security group with an allow rule for port 80 inbound
An organization discovers a VM that was launched from an unapproved image not created by the image factory. The MOST appropriate action is:
Correct answer: B - Investigate and remediate - replace the VM with one launched from an approved image and investigate how the unapproved image was used
An organization wants to encrypt data at rest but maintain full control of the encryption keys without the CSP storing them. The MOST appropriate approach is:
Correct answer: C - Customer-supplied keys (BYOK) where keys are provided for each operation but not stored by the CSP
An organization wants to monitor the security configuration of its SaaS applications. The MOST appropriate tool is:
Correct answer: B - SSPM (SaaS Security Posture Management)
The CCSK exam also covers these domains. Drill them in the full free practice test:
Practice hundreds more CCSK questions with instant scoring, weak-area drills, and full exam simulations.