CCSK (CSA) Basic 4 — Questions and Answers
Question 1: According to CSA, what distinguishes 'security as a service' (SecaaS) from traditional security products?
- SecaaS requires on-premises hardware appliances to function
- Security capabilities are delivered via cloud subscription rather than deployed on-premises (Correct answer)
- SecaaS exclusively protects SaaS applications but not IaaS workloads
- It provides physical security for cloud data center facilities
Correct answer: Security capabilities are delivered via cloud subscription rather than deployed on-premises
SecaaS delivers security functions—such as identity management, SIEM, or vulnerability scanning—as cloud-based subscription services without on-premises hardware.
Question 2: In CSA's Egress Monitoring guidance, what is the main goal of monitoring outbound cloud traffic?
- To reduce bandwidth costs by throttling non-essential transfers
- To detect data exfiltration and unauthorized transmission of sensitive data (Correct answer)
- To enforce routing policies for multi-cloud architectures
- To ensure compliance with cloud provider SLA uptime commitments
Correct answer: To detect data exfiltration and unauthorized transmission of sensitive data
Egress monitoring focuses on detecting when sensitive data leaves cloud environments without authorization, which is a key indicator of a breach.
Question 3: What is the purpose of 'object storage' in cloud environments, according to CSA infrastructure guidance?
- To provide block-level storage for virtual machine boot volumes
- To store unstructured data as discrete objects with associated metadata, accessed via APIs (Correct answer)
- To replace relational databases for transactional workloads
- To offer a shared file system for multiple compute instances
Correct answer: To store unstructured data as discrete objects with associated metadata, accessed via APIs
Object storage stores unstructured data (files, images, logs) as objects with metadata, accessed through REST APIs, making it highly scalable and durable.
Question 4: According to CSA, which is the most effective control for preventing unauthorized lateral movement after an initial cloud account compromise?
- Enabling multi-factor authentication on the root account only
- Implementing micro-segmentation and least-privilege network policies (Correct answer)
- Deploying a host-based antivirus on all cloud instances
- Rotating SSH keys on a monthly schedule
Correct answer: Implementing micro-segmentation and least-privilege network policies
Micro-segmentation limits blast radius by restricting east-west traffic so a compromised workload cannot freely access other resources in the environment.
Question 5: In CSA Guidance, what is 'immutable infrastructure'?
- Infrastructure protected from physical tampering by locked server cabinets
- Cloud resources that are replaced rather than modified when changes are needed (Correct answer)
- Read-only snapshots used exclusively for backup and recovery purposes
- Hardware security modules (HSMs) that cannot be reprogrammed after deployment
Correct answer: Cloud resources that are replaced rather than modified when changes are needed
Immutable infrastructure means servers and components are never modified after deployment; instead, new versions replace old ones, reducing configuration drift and attack surface.
Question 6: According to CSA, what is the key advantage of using 'infrastructure as code' (IaC) for cloud security?
- It eliminates the need for penetration testing by verifying code logic
- It enables consistent, version-controlled, and auditable provisioning of secure configurations (Correct answer)
- It automatically encrypts all resources created by the deployment scripts
- It provides real-time threat intelligence during resource provisioning
Correct answer: It enables consistent, version-controlled, and auditable provisioning of secure configurations
IaC enables security configurations to be version-controlled, peer-reviewed, and consistently applied, reducing human error and enabling security-as-code practices.
Question 7: Which CSA guidance concept refers to the risk that a cloud provider's technical or business failure could disrupt a customer's operations?
- Shadow IT exposure
- Provider dependency risk (Correct answer)
- Multi-tenancy isolation failure
- Hypervisor escape vulnerability
Correct answer: Provider dependency risk
Provider dependency risk recognizes that reliance on a single cloud provider creates exposure to that provider's outages, insolvency, or service changes.
CCSK (CSA) Basic 4
According to CSA, what distinguishes 'security as a service' (SecaaS) from traditional security products?