CCSK Cloud Architecture and Security Controls 2 — Questions and Answers
Question 1: In the CSA Cloud Controls Matrix (CCM), what is the primary purpose of the control domains?
- To list cloud vendors and their certifications
- To provide security controls mapped to industry standards and cloud service models (Correct answer)
- To define SLA requirements for cloud contracts
- To outline data sovereignty regulations by country
Correct answer: To provide security controls mapped to industry standards and cloud service models
The CCM provides a framework of security controls aligned to cloud service models and mapped to standards like ISO 27001, NIST, and PCI DSS.
Question 2: What is 'cloud bursting' and what security challenge does it introduce?
- A DDoS attack targeting cloud APIs; it introduces availability risk
- Dynamically extending workloads from private to public cloud; it creates data spillage risk (Correct answer)
- Encrypting data across cloud regions; it introduces key management complexity
- Migrating all data to cloud at once; it causes access control gaps
Correct answer: Dynamically extending workloads from private to public cloud; it creates data spillage risk
Cloud bursting moves workloads to public cloud under peak load, creating risk that sensitive data may leave the private environment without proper controls.
Question 3: Which of the following best describes a 'cloud broker' in the NIST cloud computing model?
- An entity that audits cloud provider compliance
- An entity that manages use, performance, and delivery of cloud services between providers and consumers (Correct answer)
- An entity that physically hosts cloud infrastructure
- An entity that certifies cloud security standards
Correct answer: An entity that manages use, performance, and delivery of cloud services between providers and consumers
A cloud broker acts as an intermediary who negotiates relationships and manages cloud services between providers and consumers.
Question 4: What security advantage does immutable infrastructure provide in cloud environments?
- It prevents all network-based attacks
- It eliminates the need for encryption
- It reduces configuration drift and ensures consistency across deployments (Correct answer)
- It allows real-time patching of running instances
Correct answer: It reduces configuration drift and ensures consistency across deployments
Immutable infrastructure replaces rather than patches instances, preventing configuration drift and ensuring every deployment matches a known good state.
Question 5: In cloud security architecture, what is the function of a 'security group'?
- A team responsible for cloud security policy
- A virtual firewall controlling inbound and outbound traffic to instances (Correct answer)
- A certificate authority for cloud services
- A logging mechanism for cloud API calls
Correct answer: A virtual firewall controlling inbound and outbound traffic to instances
Security groups act as virtual firewalls that control network traffic at the instance level in cloud environments like AWS and Azure.
Question 6: Which architectural pattern is recommended by CCSK to reduce the attack surface of cloud workloads?
- Monolithic deployments
- Micro-segmentation (Correct answer)
- Flat network topology
- Single availability zone deployments
Correct answer: Micro-segmentation
Micro-segmentation divides the network into small zones to limit lateral movement if one workload is compromised.
CCSK Cloud Architecture and Security Controls 2
In the CSA Cloud Controls Matrix (CCM), what is the primary purpose of the control domains?