ISC2 CCSP Prep Online

A stateless architecture supports efficient horizontal scaling because instances do not need to retain client session data locally. This allows a load balancer to distribute requests to any healthy instance and enables auto-scaling groups to add or remove instances without disrupting in-progress operations, reducing downtime risk during scaling events or instance failures. Architectures that are stateful and depend on sticky sessions make scaling and failover harder because user state is tied to a specific instance. Approaches that rely on vertical scaling or a single-instance deployment limit scalability and increase downtime risk due to the single point of failure and the need for disruptive upgrades.

Multi-homing with diverse ISPs helps maintain connectivity when an outage affects only one carrier path, such as when “a backhoe cuts the fiber cable on the street that carries one provider’s circuit to the facility.” Traffic can fail over to the unaffected provider if routing and failover are properly configured. The choices mentioning “a misconfigured internal firewall” and “a critical top-of-rack switch fails” describe failures inside the organization’s network; having multiple ISPs does not fix an internal security policy error or an internal switching failure. The choice mentioning “a DDoS attack saturates the organization’s internet edge” is not reliably mitigated just by having multiple ISPs; it typically requires capacity planning and DDoS scrubbing/mitigation services.

Audit clauses are the contractual mechanism that grants audit rights, such as the right to conduct an audit, to request evidence, or to review independent audit/assurance reports (for example, SOC reports) to externally verify a vendor’s controls. Service level/service quality metrics focus on measuring performance outcomes (uptime, response times) rather than granting inspection or verification rights. Standards compliance statements indicate the vendor’s intent or obligation to meet certain requirements or maintain certifications, but they do not, by themselves, grant the customer the right to perform or demand an external verification. Legal dispute and arbitration terms address how conflicts are resolved and are not primarily about validating operational controls.