CCSK (CSA) Basic 5 — Questions and Answers
Question 1: In CSA's guidance on Incident Response, what is the recommended first step when a cloud security incident is detected?
- Immediately terminate all affected cloud instances to stop the threat
- Contain the incident to prevent further damage while preserving forensic evidence (Correct answer)
- Notify law enforcement before taking any technical action
- Restore from the most recent backup to return to a known good state
Correct answer: Contain the incident to prevent further damage while preserving forensic evidence
Containment is the priority to limit damage, while evidence preservation ensures effective investigation and potential legal action.
Question 2: What does CSA define as 'tenant isolation' in multi-tenant cloud environments?
- Physically separating each customer's workload on dedicated hardware
- Logical and technical controls ensuring one tenant cannot access another tenant's data or resources (Correct answer)
- Assigning dedicated IP ranges to each cloud customer's virtual network
- Requiring each tenant to maintain their own encryption key management system
Correct answer: Logical and technical controls ensuring one tenant cannot access another tenant's data or resources
Tenant isolation uses logical controls—such as virtualization, namespaces, and access policies—to ensure tenants are separated even on shared infrastructure.
Question 3: According to CSA, what is the primary security concern with 'serverless computing' architectures?
- Serverless functions always run as root, increasing privilege escalation risk
- The expanded attack surface from numerous functions and increased reliance on third-party dependencies (Correct answer)
- Serverless platforms do not support encryption of function execution environments
- Functions cannot be monitored because the provider controls the runtime environment
Correct answer: The expanded attack surface from numerous functions and increased reliance on third-party dependencies
Serverless increases the number of deployed functions and dependencies, expanding the attack surface while requiring careful input validation and least-privilege IAM policies.
Question 4: In CSA's framework, what is the difference between 'data masking' and 'tokenization'?
- Data masking is reversible while tokenization permanently destroys the original value
- Data masking obscures data for display purposes while tokenization replaces sensitive data with a non-sensitive substitute token (Correct answer)
- Tokenization is applied only to data in transit while masking applies to data at rest
- Both are identical techniques; CSA uses the terms interchangeably
Correct answer: Data masking obscures data for display purposes while tokenization replaces sensitive data with a non-sensitive substitute token
Data masking hides data for display/testing, while tokenization replaces sensitive values with tokens that can be mapped back via a secure token vault.
Question 5: According to CSA, what role does a Security Information and Event Management (SIEM) system play in cloud environments?
- It acts as a cloud firewall by blocking malicious traffic in real time
- It aggregates and correlates logs and events from cloud services to detect and investigate threats (Correct answer)
- It enforces encryption policies across all cloud storage services automatically
- It manages user provisioning and de-provisioning across cloud platforms
Correct answer: It aggregates and correlates logs and events from cloud services to detect and investigate threats
A SIEM collects, correlates, and analyzes log data from across cloud environments to identify anomalies, threats, and compliance violations.
Question 6: What is the CSA-recommended strategy for 'cloud key management' to maintain customer control over data?
- Allow the cloud provider to manage all encryption keys for simplicity and reliability
- Use Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK) to retain customer control over encryption keys (Correct answer)
- Store encryption keys in the same cloud region as the encrypted data for low latency
- Rotate encryption keys only when a security incident is detected
Correct answer: Use Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK) to retain customer control over encryption keys
BYOK and HYOK models ensure customers control their own encryption keys, preventing providers from accessing data even when hosting the encrypted storage.
Question 7: In CSA's guidance, what is 'continuous compliance monitoring' in cloud environments?
- Running annual third-party audits against PCI-DSS and ISO 27001 standards
- Automated, real-time assessment of cloud configurations against security policies and regulatory requirements (Correct answer)
- Manually reviewing cloud security logs on a weekly basis for compliance violations
- Hiring a compliance officer to oversee all cloud deployments full-time
Correct answer: Automated, real-time assessment of cloud configurations against security policies and regulatory requirements
Continuous compliance monitoring uses automated tools to constantly assess cloud resource configurations against defined policies, enabling rapid detection of drift or violations.
CCSK (CSA) Basic 5
In CSA's guidance on Incident Response, what is the recommended first step when a cloud security incident is detected?