CCSK Certificate of Cloud Security Knowledge 3 — Questions and Answers
Question 1: Which encryption approach best protects data stored in a cloud provider's object storage from unauthorized access by the provider?
- Server-side encryption using provider-managed keys
- Client-side encryption with customer-managed keys before upload (Correct answer)
- Transport layer encryption (TLS) during upload
- Database-level encryption using provider default settings
Correct answer: Client-side encryption with customer-managed keys before upload
Client-side encryption with customer-managed keys ensures the provider only ever sees ciphertext, preventing access even if the provider is compromised or compelled.
Question 2: What is the main security implication of 'multitenancy' in cloud computing?
- It requires customers to share their encryption keys with the provider
- It creates a risk that one tenant's actions or vulnerabilities could affect others (Correct answer)
- It mandates that all tenants use the same identity provider
- It prevents customers from applying their own security patches
Correct answer: It creates a risk that one tenant's actions or vulnerabilities could affect others
Multitenancy means multiple customers share the same underlying infrastructure, creating risks like VM escape, noisy neighbor attacks, or data leakage across tenants.
Question 3: In the context of the CSA Cloud Controls Matrix (CCM), what is the CCM's primary function?
- A tool for automatically scanning cloud environments for vulnerabilities
- A cybersecurity control framework specifically designed for cloud environments (Correct answer)
- A certification program for cloud security professionals
- A registry of known cloud service provider security incidents
Correct answer: A cybersecurity control framework specifically designed for cloud environments
The CCM is a controls framework that provides a detailed understanding of security controls applicable to cloud computing, mapped to industry standards like ISO 27001 and NIST.
Question 4: What distinguishes a 'security group' in IaaS from a traditional network firewall?
- Security groups operate at Layer 7 while firewalls operate at Layer 3
- Security groups are software-defined and attached per instance rather than per network boundary (Correct answer)
- Security groups cannot block inbound traffic, only outbound
- Security groups require physical hardware appliances to function
Correct answer: Security groups are software-defined and attached per instance rather than per network boundary
Security groups are software-defined, stateful packet filters that attach to individual virtual instances or interfaces rather than guarding a fixed network perimeter.
Question 5: Which risk is MOST associated with using a public cloud provider's default logging and monitoring settings?
- Logs may consume excessive storage, increasing costs significantly
- Default settings may not capture security-relevant events needed for incident response (Correct answer)
- The provider may sell log data to third parties for analytics
- Default monitoring always triggers too many false positive alerts
Correct answer: Default settings may not capture security-relevant events needed for incident response
Cloud providers' default logging often omits key security events, so customers must explicitly configure detailed logging to support incident detection and forensics.
Question 6: What is 'federation' in cloud identity management?
- Distributing user accounts across multiple cloud regions for redundancy
- Establishing trust between identity domains so users authenticate once across systems (Correct answer)
- Merging multiple cloud accounts into a single billing entity
- Federating firewall rules across hybrid cloud environments
Correct answer: Establishing trust between identity domains so users authenticate once across systems
Federation links separate identity systems using standards like SAML or OIDC, allowing users to authenticate with their home identity provider and access federated cloud services.
Question 7: According to CSA guidance, what is the recommended approach when a cloud provider cannot demonstrate compliance with a required regulatory standard?
- Accept the risk and implement compensating controls on the customer side (Correct answer)
- Immediately migrate all workloads to an on-premises data center
- Request the cloud provider to achieve compliance within 30 days
- File a complaint with the appropriate regulatory authority
Correct answer: Accept the risk and implement compensating controls on the customer side
When a provider lacks required certifications, the recommended approach is risk acceptance combined with compensating controls that customers implement themselves.
CCSK Certificate of Cloud Security Knowledge 3
Which encryption approach best protects data stored in a cloud provider's object storage from unauthorized access by the provider?