CCSK Certificate of Cloud Security Knowledge 4 — Questions and Answers
Question 1: Which cloud service model gives customers the LEAST control over the underlying infrastructure security?
- IaaS (Infrastructure as a Service)
- PaaS (Platform as a Service)
- SaaS (Software as a Service) (Correct answer)
- FaaS (Function as a Service)
Correct answer: SaaS (Software as a Service)
In SaaS, the provider manages everything from infrastructure to the application layer, leaving customers to control only their data and user access.
Question 2: What is the purpose of a 'Virtual Private Cloud' (VPC)?
- To provide dedicated physical servers exclusively for one customer
- To create an isolated, logically defined network segment within a public cloud (Correct answer)
- To encrypt all traffic between cloud regions automatically
- To enable customers to run their own cloud management plane
Correct answer: To create an isolated, logically defined network segment within a public cloud
A VPC provides logical network isolation within a public cloud, letting customers define IP ranges, subnets, routing, and access controls in a private network environment.
Question 3: In cloud incident response, what challenge is MOST unique compared to traditional on-premises incident response?
- Cloud incidents always involve more threat actors than on-premises incidents
- Customers may have limited forensic access to underlying infrastructure and logs controlled by the provider (Correct answer)
- Cloud environments cannot be isolated during an incident investigation
- On-premises tools cannot be used to investigate cloud incidents under any circumstances
Correct answer: Customers may have limited forensic access to underlying infrastructure and logs controlled by the provider
Cloud customers often cannot access physical hardware, hypervisor logs, or provider-side evidence, making forensic investigation dependent on what the provider exposes through APIs.
Question 4: What is 'infrastructure as code' (IaC) and what is its primary security benefit?
- A method of encrypting cloud infrastructure configurations using code-based keys
- Defining infrastructure through machine-readable files enabling consistent, auditable, and repeatable deployments (Correct answer)
- A programming language designed specifically for cloud security automation
- A technique for embedding security agents directly into cloud provider APIs
Correct answer: Defining infrastructure through machine-readable files enabling consistent, auditable, and repeatable deployments
IaC allows infrastructure to be defined in version-controlled code, enabling security review of configurations before deployment and ensuring consistent, drift-free environments.
Question 5: Which attack is MOST specific to cloud and virtualized environments, where a malicious workload escapes its isolated container to affect the host or neighboring workloads?
- Man-in-the-middle attack
- SQL injection
- VM/container escape (Correct answer)
- Credential stuffing
Correct answer: VM/container escape
VM or container escape exploits vulnerabilities in the hypervisor or container runtime to break isolation boundaries and access the host system or other tenants.
Question 6: What is the CSA STAR program primarily used for?
- Issuing cloud security certifications to individual professionals
- Providing a registry where cloud providers document their security controls and compliance (Correct answer)
- Conducting penetration tests against cloud provider infrastructure
- Rating cloud providers on service availability and uptime guarantees
Correct answer: Providing a registry where cloud providers document their security controls and compliance
CSA STAR (Security, Trust, Assurance, and Risk) is a publicly accessible registry where cloud providers self-document or have third-party audited their security controls using the CCM.
Question 7: What does 'right to audit' mean in a cloud services contract?
- The cloud provider's right to audit the customer's usage for billing accuracy
- The customer's contractual right to assess the cloud provider's security controls and practices (Correct answer)
- The regulator's authority to access cloud provider systems on behalf of customers
- The right of either party to exit the contract after a security audit finding
Correct answer: The customer's contractual right to assess the cloud provider's security controls and practices
Right to audit gives customers (or their designated third parties) the contractual ability to verify that the cloud provider's security controls meet agreed standards.
CCSK Certificate of Cloud Security Knowledge 4
Which cloud service model gives customers the LEAST control over the underlying infrastructure security?