CCSK Certificate of Cloud Security Knowledge 5

Question 1

Which technique BEST prevents unauthorized privilege escalation within a cloud management plane?

Accepted Answer

Implementing least-privilege IAM policies and enforcing multi-factor authentication

Answer

Least-privilege IAM policies limit what each identity can do, while MFA prevents stolen credentials from being used, together addressing the top management plane attack vectors.

Question 2

What is 'serverless computing' and what is its PRIMARY security consideration?

Accepted Answer

Function-based execution where the provider manages runtime; primary concern shifts to application code and dependencies

Answer

In serverless, the provider manages all infrastructure and runtime, so security responsibility shifts almost entirely to the customer's application code, libraries, and function permissions.

Question 3

Which cloud data security control ensures that data cannot be read even if an authorized cloud administrator is compromised?

Accepted Answer

Customer-managed encryption keys stored in a Hardware Security Module (HSM)

Answer

Customer-managed keys in HSMs mean the provider's administrators can never access plaintext because they don't possess the keys; only the customer controls decryption.

Question 4

What is 'cloud workload protection platform' (CWPP) designed to protect?

Accepted Answer

Workloads running in cloud environments, including VMs, containers, and serverless functions

Answer

CWPPs secure the workloads themselves—virtual machines, containers, and functions—by providing runtime protection, vulnerability management, and behavioral monitoring.

Question 5

In the CSA Guidance, what is the recommended approach to 'data classification' in cloud environments?

Accepted Answer

Classify data before moving it to the cloud and apply controls based on classification level

Answer

Organizations should classify data according to sensitivity before cloud migration and then apply appropriate security controls, encryption, and access policies based on each classification tier.

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK - Certificate of Cloud Security Knowledge Practice Test

CCSK Certificate of Cloud Security Knowledge 5