CCSK Certificate of Cloud Security Knowledge 2 — Questions and Answers
Question 1: Which CSA guidance domain focuses on ensuring that an organization's cloud usage aligns with its legal and regulatory obligations?
- Infrastructure Security
- Compliance and Audit Management (Correct answer)
- Data Security and Encryption
- Identity and Access Management
Correct answer: Compliance and Audit Management
Compliance and Audit Management addresses aligning cloud use with legal, regulatory, and contractual requirements and managing audit processes.
Question 2: In the shared responsibility model, which security control is ALWAYS the cloud customer's responsibility regardless of service model?
- Hypervisor patching
- Physical data center security
- Identity and access management for their users (Correct answer)
- Network firewall configuration at the data center level
Correct answer: Identity and access management for their users
Customers always retain responsibility for managing their own users' identities and access permissions, regardless of whether the service is IaaS, PaaS, or SaaS.
Question 3: What is the primary purpose of a Cloud Access Security Broker (CASB)?
- To replace on-premises firewalls with cloud-native alternatives
- To enforce security policies between cloud service consumers and providers (Correct answer)
- To provide cloud-based antivirus and malware protection
- To manage SSL/TLS certificates for cloud workloads
Correct answer: To enforce security policies between cloud service consumers and providers
A CASB sits between users and cloud services to enforce security policies, provide visibility, and control data movement.
Question 4: Which term describes the risk that a cloud provider's technical or business failure could disrupt a customer's operations?
- Shadow IT risk
- Provider lock-in risk
- Provider dependency risk (Correct answer)
- Elasticity risk
Correct answer: Provider dependency risk
Provider dependency risk captures the exposure created when a customer relies on a cloud provider whose failure—technical or commercial—would impact the customer.
Question 5: In cloud security, what does the term 'elasticity' primarily refer to?
- The ability to stretch data encryption keys across regions
- The ability to rapidly scale resources up or down to match demand (Correct answer)
- The flexibility of security policies to adapt to threats
- The capacity of a network to absorb DDoS attacks
Correct answer: The ability to rapidly scale resources up or down to match demand
Elasticity is the cloud characteristic of dynamically provisioning and releasing resources to match workload demand, which has direct implications for security tooling and cost.
Question 6: What is 'data remanence' and why is it a concern in cloud environments?
- Data that remains accessible after a user logs out of a cloud portal
- Residual data that persists on storage media after deletion, potentially accessible to others (Correct answer)
- Data that is replicated across multiple cloud regions automatically
- The latency introduced when retrieving archived cloud data
Correct answer: Residual data that persists on storage media after deletion, potentially accessible to others
Data remanence is the residual representation of data after deletion, which is a cloud concern because customers share physical storage with others and cannot verify physical sanitization.
Question 7: Which cloud deployment model is MOST appropriate for an organization that requires maximum control over its infrastructure while leveraging cloud technologies?
- Public cloud
- Community cloud
- Private cloud (Correct answer)
- Hybrid cloud
Correct answer: Private cloud
A private cloud is dedicated to a single organization, providing maximum control over infrastructure while still delivering cloud characteristics like on-demand self-service.
CCSK Certificate of Cloud Security Knowledge 2
Which CSA guidance domain focuses on ensuring that an organization's cloud usage aligns with its legal and regulatory obligations?