CCSK (CSA) Basic 3 — Questions and Answers
Question 1: According to CSA, what is the primary purpose of a Cloud Access Security Broker (CASB)?
- To replace on-premises firewalls with cloud-native equivalents
- To act as an intermediary enforcing security policies between cloud users and cloud services (Correct answer)
- To provide encrypted tunnels between cloud regions
- To automate compliance reporting for SaaS applications
Correct answer: To act as an intermediary enforcing security policies between cloud users and cloud services
A CASB sits between cloud consumers and providers to enforce security policies such as visibility, compliance, data security, and threat protection.
Question 2: What does CSA identify as a key risk of 'vendor lock-in' in cloud computing?
- Increased latency due to proprietary hardware
- Difficulty migrating workloads due to proprietary technologies and data formats (Correct answer)
- Inability to negotiate SLA terms with the provider
- Loss of physical access to servers during an outage
Correct answer: Difficulty migrating workloads due to proprietary technologies and data formats
Vendor lock-in risk arises when proprietary APIs, data formats, or services make it costly or technically challenging to move to another provider.
Question 3: In the CSA Cloud Controls Matrix (CCM), what is the primary purpose of the tool?
- To generate automated penetration test reports for cloud infrastructure
- To provide a security controls framework specifically designed for cloud environments (Correct answer)
- To benchmark cloud provider pricing and SLA quality
- To map cloud regions to applicable data privacy laws
Correct answer: To provide a security controls framework specifically designed for cloud environments
The CCM provides a detailed controls framework aligned to cloud security domains, helping organizations assess and implement appropriate security measures.
Question 4: According to CSA, which technique best protects against SQL injection attacks in cloud-hosted applications?
- Encrypting the database at rest using AES-256
- Using parameterized queries and input validation (Correct answer)
- Deploying a WAF without application-level code changes
- Restricting database access to a single subnet
Correct answer: Using parameterized queries and input validation
Parameterized queries prevent attackers from injecting malicious SQL by treating user input as data rather than executable code.
Question 5: What is the CSA-recommended approach for managing secrets (API keys, passwords) in cloud-native applications?
- Hard-code secrets in environment variables within the container image
- Store secrets in a dedicated secrets management service with strict access controls (Correct answer)
- Rotate secrets annually during scheduled maintenance windows
- Encrypt secrets and embed them in the application's source code repository
Correct answer: Store secrets in a dedicated secrets management service with strict access controls
Secrets management services (such as HashiCorp Vault or cloud-native equivalents) centralize secret storage with auditing, rotation, and least-privilege access.
Question 6: In CSA's guidance, what is 'data residency'?
- The encryption state of data while it is stored in cloud object storage
- The requirement that data must be stored and processed within specific geographic boundaries (Correct answer)
- The classification level assigned to data based on sensitivity
- The replication factor applied to highly available cloud databases
Correct answer: The requirement that data must be stored and processed within specific geographic boundaries
Data residency refers to the legal and regulatory requirements mandating that certain data remain within defined geographic or national boundaries.
Question 7: Which CSA Guidance domain specifically addresses the security considerations for cloud-based application development?
- Business Continuity and Disaster Recovery
- Application Security (Correct answer)
- Compliance and Audit Management
- Supply Chain Management
Correct answer: Application Security
The Application Security domain in CSA Guidance covers secure SDLC, DevSecOps, testing, and cloud-specific application security challenges.
CCSK (CSA) Basic 3
According to CSA, what is the primary purpose of a Cloud Access Security Broker (CASB)?