CCSK Certificate of Cloud Security Knowledge 5 — Questions and Answers
Question 1: Which technique BEST prevents unauthorized privilege escalation within a cloud management plane?
- Encrypting all management plane API calls at rest
- Implementing least-privilege IAM policies and enforcing multi-factor authentication (Correct answer)
- Storing management plane credentials in an encrypted S3 bucket
- Restricting management plane access to business hours only
Correct answer: Implementing least-privilege IAM policies and enforcing multi-factor authentication
Least-privilege IAM policies limit what each identity can do, while MFA prevents stolen credentials from being used, together addressing the top management plane attack vectors.
Question 2: What is 'serverless computing' and what is its PRIMARY security consideration?
- Computing without any servers; primary concern is physical security of the customer's devices
- Function-based execution where the provider manages runtime; primary concern shifts to application code and dependencies (Correct answer)
- Computing using only encrypted servers; primary concern is key management
- Distributed computing across user devices; primary concern is endpoint security
Correct answer: Function-based execution where the provider manages runtime; primary concern shifts to application code and dependencies
In serverless, the provider manages all infrastructure and runtime, so security responsibility shifts almost entirely to the customer's application code, libraries, and function permissions.
Question 3: Which cloud data security control ensures that data cannot be read even if an authorized cloud administrator is compromised?
- Data Loss Prevention (DLP) policies
- Customer-managed encryption keys stored in a Hardware Security Module (HSM) (Correct answer)
- Role-based access control on cloud storage buckets
- Network ACLs blocking admin access to storage services
Correct answer: Customer-managed encryption keys stored in a Hardware Security Module (HSM)
Customer-managed keys in HSMs mean the provider's administrators can never access plaintext because they don't possess the keys; only the customer controls decryption.
Question 4: What is 'cloud workload protection platform' (CWPP) designed to protect?
- End-user devices accessing cloud services from remote locations
- Workloads running in cloud environments, including VMs, containers, and serverless functions (Correct answer)
- Cloud provider management consoles and billing interfaces
- Network traffic between on-premises data centers and cloud regions
Correct answer: Workloads running in cloud environments, including VMs, containers, and serverless functions
CWPPs secure the workloads themselves—virtual machines, containers, and functions—by providing runtime protection, vulnerability management, and behavioral monitoring.
Question 5: In the CSA Guidance, what is the recommended approach to 'data classification' in cloud environments?
- Let the cloud provider auto-classify data based on content scanning
- Classify data before moving it to the cloud and apply controls based on classification level (Correct answer)
- Apply the highest classification level to all cloud data to ensure maximum protection
- Classification is unnecessary in cloud because providers apply uniform security to all data
Correct answer: Classify data before moving it to the cloud and apply controls based on classification level
Organizations should classify data according to sensitivity before cloud migration and then apply appropriate security controls, encryption, and access policies based on each classification tier.
Question 6: What does 'geo-residency' or 'data sovereignty' mean for cloud customers?
- The requirement that cloud data be accessible from any geographic location at all times
- Legal requirements mandating that data be stored and processed within specific geographic boundaries (Correct answer)
- The cloud provider's ability to replicate data globally to improve performance
- Restrictions on which countries can access the cloud management portal
Correct answer: Legal requirements mandating that data be stored and processed within specific geographic boundaries
Data sovereignty laws in many jurisdictions require that certain types of data remain physically within national borders, which customers must verify their cloud provider can guarantee.
Question 7: Which practice is MOST critical for maintaining cloud security posture over time as cloud environments evolve?
- Conducting a one-time security assessment at initial cloud deployment
- Implementing continuous monitoring and automated compliance scanning of cloud configurations (Correct answer)
- Requiring manual approval for every cloud resource change via a change management board
- Limiting cloud environment changes to quarterly update windows only
Correct answer: Implementing continuous monitoring and automated compliance scanning of cloud configurations
Cloud environments change constantly; continuous monitoring and automated scanning detect configuration drift, new vulnerabilities, and policy violations in real time.
CCSK Certificate of Cloud Security Knowledge 5
Which technique BEST prevents unauthorized privilege escalation within a cloud management plane?