CCSK Certificate of Cloud Security Knowledge 3

Question 1

Which encryption approach best protects data stored in a cloud provider's object storage from unauthorized access by the provider?

Accepted Answer

Client-side encryption with customer-managed keys before upload

Answer

Client-side encryption with customer-managed keys ensures the provider only ever sees ciphertext, preventing access even if the provider is compromised or compelled.

Question 2

What is the main security implication of 'multitenancy' in cloud computing?

Accepted Answer

It creates a risk that one tenant's actions or vulnerabilities could affect others

Answer

Multitenancy means multiple customers share the same underlying infrastructure, creating risks like VM escape, noisy neighbor attacks, or data leakage across tenants.

Question 3

In the context of the CSA Cloud Controls Matrix (CCM), what is the CCM's primary function?

Accepted Answer

A cybersecurity control framework specifically designed for cloud environments

Answer

The CCM is a controls framework that provides a detailed understanding of security controls applicable to cloud computing, mapped to industry standards like ISO 27001 and NIST.

Question 4

What distinguishes a 'security group' in IaaS from a traditional network firewall?

Accepted Answer

Security groups are software-defined and attached per instance rather than per network boundary

Answer

Security groups are software-defined, stateful packet filters that attach to individual virtual instances or interfaces rather than guarding a fixed network perimeter.

Question 5

Which risk is MOST associated with using a public cloud provider's default logging and monitoring settings?

Accepted Answer

Default settings may not capture security-relevant events needed for incident response

Answer

Cloud providers' default logging often omits key security events, so customers must explicitly configure detailed logging to support incident detection and forensics.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Certificate of Cloud Security Knowledge 3