Module 2: Key Cloud Characteristics
The CCSP exam does not simply ask you to list the five essential characteristics. It presents scenarios and expects you to determine whether those characteristics are present — or critically, which one is missing.
The Five Essential Characteristics
NIST SP 800-145 defines five essential characteristics that a service must exhibit to qualify as cloud computing. The exam treats these as a checklist — if any characteristic is absent, the scenario may not be cloud. Understanding these deeply gives you an analytical framework for dozens of questions.
1. On-Demand Self-Service
A consumer can unilaterally provision computing capabilities without requiring human interaction with the service provider. The key word is "unilaterally." If a customer must submit a ticket, call someone, or wait for manual provisioning, this characteristic is not met.
Exam scenario: "A company requests virtual machines through an email to their provider, who provisions them within 24 hours." This is NOT on-demand self-service. The human interaction requirement disqualifies it.
2. Broad Network Access
Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous platforms. This means the service is accessible via standard protocols (HTTPS, APIs) from multiple device types. A service accessible only through a proprietary terminal in a specific building does not meet this characteristic.
3. Resource Pooling
The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model. Resources are dynamically assigned and reassigned according to demand. The customer generally has no control or knowledge over the exact location of the provided resources.
Exam trap: Resource pooling does not mean customers cannot specify location at a higher level of abstraction (country, region, data center). They simply cannot demand specific physical hardware. If a question describes a customer choosing a region but not a specific rack, resource pooling is still satisfied.
4. Rapid Elasticity
Capabilities can be elastically provisioned and released to scale rapidly. To the consumer, available capabilities often appear unlimited and can be appropriated in any quantity at any time. The exam distinguishes between elasticity (automatic, rapid scaling) and scalability (ability to grow, but possibly manual). True cloud elasticity is automatic and fast.
5. Measured Service
Cloud systems automatically control and optimize resource use through metering. Resource usage is monitored, controlled, and reported, providing transparency for both the provider and consumer. This is what enables pay-per-use billing, but measured service is about metering and transparency, not just billing.
How the Exam Tests These
The exam's favorite technique is presenting a scenario that meets four of five characteristics and asking what is missing — or whether the scenario qualifies as cloud. Another common pattern is presenting two deployment options and asking which better satisfies a specific characteristic.
For example: "An organization uses a shared computing platform where resources are pre-allocated in fixed amounts for each tenant, cannot be adjusted without a contract change, and billing is flat-rate monthly." Which characteristic is missing? The answer is both rapid elasticity (fixed allocations, contract-based changes) and measured service (flat-rate, not usage-based). But if forced to choose one, measured service is the most clearly absent.
Beyond NIST: What the Exam Adds
While NIST provides the foundation, the CCSP exam also considers multi-tenancy as a practical requirement of cloud computing, even though NIST embeds it within resource pooling rather than listing it separately. Questions may present multi-tenancy as a standalone concept and test whether you understand the security implications: data isolation, noisy neighbor effects, and side-channel risks.
Characteristics vs. Benefits — Do Not Confuse Them
Cost savings, business agility, and reduced time to market are benefits of cloud computing, not essential characteristics. The exam may include these as distractors in questions asking you to identify characteristics. If an answer choice sounds like a business advantage rather than a technical property, it is probably wrong.
Key Takeaways
Memorize the five characteristics, but more importantly, practice evaluating scenarios against them. The exam rewards the ability to identify which characteristic is present, absent, or compromised in a given situation. When you see a question about whether something "is cloud," run through the five-characteristic checklist systematically.