Cloud Computing Concepts & Architectures
Not publishedof exam
Cloud Governance
Not publishedof exam
Risk, Audit & Compliance
Not publishedof exam
Organization Management
Not publishedof exam
Identity & Access Management
Not publishedof exam
Security Monitoring
Not publishedof exam
Infrastructure & Networking
Not publishedof exam
Cloud Workload Security
Not publishedof exam
Data Security
Not publishedof exam
Application Security
Not publishedof exam
Incident Response & Resilience
Not publishedof exam
Cloud Incident ResponseContainmentForensic EvidenceRecovery Objectives
Related Technologies & Strategies
Not publishedof exam
Quick Facts
- Certificate
- CCSK v5 (Cloud Security)
- Administrator
- Cloud Security Alliance (CSA)
- Exam Format
- 60 open-book online MCQs
- Time Limit
- 120 minutes, uninterrupted (CCSK v5)
- Passing Score
- 80% (48 of 60 correct)
- Token Attempts
- 2 attempts valid 2 years
- Prerequisites
- None required
- Validity
- Does not expire (no CPEs)
NIST 800-145 Cloud Model (5-3-4)
5 characteristics, 3 service models, 4 deployment models
5: On-demand, Network, Pooling5: Elasticity, Measured service3: IaaS, PaaS, SaaS4: Public, Private, Community, Hybrid
NIST SP 800-145 & Shared Responsibility
- Five Essential Characteristics
- On-demand, network, pooling, elasticity, measuredNIST 800-145
- Four Deployment Models
- Public, Private, Community, and Hybrid
- IaaS Customer Scope
- Guest OS, network, apps, IAM, data
- PaaS Customer Scope
- App code, config, IAM, data
- SaaS Customer Scope
- Data governance, tenant config, user IAM
- Management Plane (Metastructure)
- Administers resources within granted permission scopeTop target
Governance, Responsibility and Oversight
- Policy vs Procedure
- Required outcome vs operational implementation steps
- Shared Responsibility Matrix
- Assign provider/customer controls per service
- Service-Level Agreement
- Contracted commitments; verify exclusions and remedies
- Risk Acceptance
- Authorized owner accepts documented residual risk
CSA STAR Level 1 vs STAR Level 2
STAR Level 1
- CAIQ self-assessment based on CCM
- Optional automated CAIQ validation
- No independent Level 2 audit
STAR Level 2
- Independent third-party audit
- Certification: ISO 27001 + CCM
- Attestation: SOC 2 + CCM
- C-STAR: GB/T 22080 + CCM
Self-assessment/validation vs independent assurance
Governance, CCM, CAIQ & STAR
- Regulatory Accountability Rule
- Outsourcing tasks retains applicable customer duties
- CSA Cloud Controls Matrix (CCM)
- 207 controls across 17 security domainsCCM v4.1, 2026
- CAIQ Questionnaire
- Standardized provider self-assessment on CCM
- STAR Level 1
- Public CAIQ self-assessment based on CCM
- STAR Level 2
- ISO27001/SOC2/C-STAR audits with CCM
- ENISA 2009 Supplementary Risk Context
- Lock-in, governance loss, isolation failure
Compliance, SOC Reports and Jurisdiction
- Compliance Inheritance
- Provider evidence; customer controls remain separate
- SOC 2 Type I vs II
- Point-in-time design vs period effectiveness
- SOC 3 Report
- General-use report; less detailed evidence
- Data Residency vs Sovereignty
- Physical location vs governing legal jurisdiction
Organization, Tenancy and Shared Services
- Provider Organization Hierarchy
- Govern accounts/subscriptions through provider-specific hierarchy
- Policy Inheritance
- Parent controls apply within defined scope
- Organization Shared Services
- Owned identity, logging, security and connectivity
- Hybrid and Multi-Cloud Governance
- Common outcomes; verify each implementation separately
- Cloud Center of Excellence (CCoE)
- Cross-functional team setting cloud guardrails
- Rehost vs Replatform vs Refactor
- Lift-and-shift IaaS vs PaaS vs cloud-native
Cloud Identity Protocol Roles
SAML XML SSO, OIDC JWT authn, OAuth authz, SCIM lifecycle
SAML 2.0: XML SSOOIDC: JWT authenticationOAuth 2.0: API authorizationSCIM: automated provisioning
Cloud IAM & Federation Protocol Picker
- Enterprise browser SSO using XML assertions→Use SAML 2.0 federation
- Modern mobile/SPA authentication with JWTs→Use OpenID Connect (OIDC)
- Delegated API authorization without sharing password→Use OAuth 2.0 access tokens
- Automated joiner-mover-leaver SaaS account deprovisioning→Use SCIM REST/JSON provisioning
- Sprawling multi-cloud roles and unused permissions→Review roles/attributes; right-size with CIEM
Federated IAM, OIDC, SCIM & PAM
- IdP vs Relying Party (SP)
- IdP authenticates; SP enforces local access
- SAML 2.0
- XML assertions for browser enterprise SSO
- OAuth 2.0 vs OIDC
- Delegated API authorization vs JWT authentication
- SCIM Protocol
- REST/JSON automated user lifecycle provisioning
- ABAC & CIEM
- Attribute policies; effective-permission analysis
- Just-in-Time (JIT) PAM
- Temporary privilege through controlled approval
CSPM vs CDR / CWPP
CSPM
- Checks control-plane API configuration state
- Finds open buckets and IAM drift
- Static posture benchmark compliance
CDR & CWPP
- Monitors active runtime behavior/telemetry
- Protects VMs, containers, and FaaS
- Detects live credential/workload attacks
Static misconfiguration vs live runtime threat
Cloud Security Tooling Selector
- Detecting public buckets or permissive IAM→Use CSPM posture scanning
- Detecting active API credential abuse runtime→Use CDR runtime telemetry analytics
- Protecting VMs, containers, and serverless runtimes→Use CWPP (or unified CNAPP)
- Blocking unsanctioned Shadow IT SaaS uploads→Use CASB in Inline Proxy mode
- Restricting exposure to authenticated authorized users→Deploy Software-Defined Perimeter (SDP)
Cloud Telemetry, CSPM & Log Integrity
- Management Plane Audit Logs
- Record API calls and IAM changes
- VPC Network Flow Logs
- IP/port metadata without packet payloads
- CSPM (Posture Management)
- Detects cloud API/resource misconfigurations continuously
- CDR (Detection & Response)
- Detects active runtime attacks in telemetry
- Isolated Logging Account
- Separate administration; protected retention; integrity validation
- Alert on Audit Tampering
- Monitor logging changes and collection gaps
- AI-Assisted Security Monitoring
- Correlate anomalies; validate evidence and decisions
Virtualization, SDN, VPC & SDP
- Type 1 Bare-Metal Hypervisor
- Enforces tenant CPU/RAM isolation directly
- VM Escape Attack
- Breaking out of guest to hypervisor
- Software-Defined Networking (SDN)
- Separates control plane from data plane
- Microsegmentation
- Granular rules blocking east-west lateral movement
- AWS Security Groups vs Network ACLs
- Stateful return allowance; independent ACL directions
- Software-Defined Perimeter (SDP)
- Authenticate before authorizing protected resource connections
Virtual Machines vs Containers
Virtual Machines
- Hardware-assisted hypervisor isolation
- Separate guest OS kernel per VM
- Isolation depends on implementation and hardening
Containers
- Share underlying host OS kernel
- Isolated via namespaces and cgroups
- Privileged container risks whole host
Separate OS kernel vs shared kernel
Containers, Kubernetes, Serverless & CNAPP
- Container Shared Kernel Risk
- Namespaces/cgroups share host OS kernel
- Kubernetes Hardening Priorities
- Least privilege; secrets encryption; enforced NetworkPolicies
- Serverless / FaaS Top Risks
- Over-privileged execution roles, event injection
- CWPP (Workload Protection)
- Secures VMs, containers, FaaS at runtime
- CNAPP Platform
- Unifies CWPP, CSPM, CIEM, IaC scanning
- Immutable Infrastructure
- Replace tested images; remediate external persistence
CSA Data Security Lifecycle (CSU-SAD)
Create, Store, Use, Share, Archive, Destroy; classify early
Create: classify & tagStore & Use: encrypt/maskShare & Archive: DLP/retainDestroy: verify erasure prerequisites
BYOK vs External Key Management
BYOK
- Import customer-supplied key material
- Cloud KMS enforces configured policies
- Supported features vary by service
HYOK / External Key Management
- Keys controlled outside cloud service
- Availability and recovery require planning
- Features and latency depend on integration
Imported material vs externally controlled keys
Encryption & Key Sovereignty Picker
- Encrypting large cloud payloads efficiently→Use Envelope Encryption (KEK wraps DEK)
- Customer wants rotation/revocation inside cloud→Use customer-managed keys; BYOK optional
- Strict rule forbids keys in cloud→Evaluate external key management(Check availability and service support)
- Decommissioning multi-tenant cloud storage data→Verify suitable cryptographic-erasure prerequisites(Include plaintext and key-copy inventory)
Data Lifecycle, Storage & Key Management
- CSA Data Lifecycle (CSU-SAD)
- Create, Store, Use, Share, Archive, DestroyClassify early; reassess
- Object vs Block Storage Risk
- Public bucket ACLs vs unencrypted snapshots
- Envelope Encryption
- DEK encrypts data; KEK wraps DEK
- BYOK vs HYOK Keys
- Imported material vs externally controlled keys
- Cryptographic Erasure (Crypto-Shredding)
- Suitable encryption; destroy all recoverable keys
- Why Disk Wiping Fails
- Multi-tenant SSD wear-leveling and replication
- DSPM (Data Security Posture Management)
- Discover/classify data; prioritize exposure risks
DevSecOps, Pipeline & API Security
- Shift-Left DevSecOps
- Automate security early in CI/CD
- SAST vs DAST
- Static source analysis vs dynamic runtime
- SCA & SBOM
- Component inventory, vulnerabilities, licensing evidence
- IaC Scanning
- Check Terraform/K8s manifests before deploy
- API Gateway vs BOLA
- Gateway throttles; backend verifies object ownership
- CI/CD Pipeline Hardening
- Ephemeral runners + short-lived OIDC tokens
Cloud Incident Response Triage Tree
- IaaS VM suspected of active compromise→Apply tested isolation; verify traffic stops(Balance urgent containment and evidence)
- Preserving volatile and disk evidence→Capture supported volatile data and snapshots(Follow service-specific forensic procedure)
- Attacker holds instance IAM role session→Use supported credential/session revocation controls(Removing role alone may not revoke)
- Analyzing compromised disk snapshot safely→Mount in isolated clean forensic VPC
Cloud IR, Resilience, Zero Trust & AI
- VM Incident Quarantine Rule
- Contain harm; preserve feasible forensic evidence
- Multi-AZ vs Multi-Region
- Zone vs region failures; test recovery
- Zero Trust Core (NIST 800-207)
- Policy Engine, Policy Admin, PEP
- CASB Inline vs API Mode
- Real-time proxy vs out-of-band SaaS scan
- LLM Prompt Injection
- Manipulating model inputs to bypass guardrails
- AI Data Leakage Risk
- Retention/training depend on service terms
- Post-Incident Analysis
- Identify causes; test improvements; update playbooks
Zero Trust Logical Components (NIST 800-207)
Policy Engine decides, Policy Admin issues, PEP enforces inline
PE: evaluates trust signalsPA: configures session tokenPEP: inline gateway enforcement
CASB Inline Proxy vs Out-of-Band API
Inline Proxy Mode
- Sits in live traffic path
- Blocks Shadow IT and downloads real-time
- Requires network/agent traffic steering
Out-of-Band API Mode
- Connects directly to SaaS APIs
- Scans data at rest and permissions
- Zero inline network latency
Inline proxy vs out-of-band API
Common Traps
Task Delegation vs Legal Duties
Delegated operational task ≠ Retained applicable legal duty
Provider Assurance vs Customer Compliance
Provider control evidence ≠ Customer workload compliance conclusion
Authorization vs Authentication
OAuth: delegated API authorization ≠ OIDC: identity authentication layer
Isolation vs Termination
Isolation restricts access; preserves running state ≠ Termination destroys volatile state
Physical Sanitization vs Cryptographic Erasure
Media overwrite requires physical-storage control ≠ Crypto-erasure requires complete key destruction
Open Book vs Unlimited Time
Permitted reference access ≠ Uninterrupted 120-minute time budget
Last Minute
- 1.60 open-book MCQs; 80% passing score
- 2.2 attempts included, valid 2 years
- 3.IaaS: customer manages guest OS
- 4.IaaS: customer manages virtual network configuration
- 5.IaaS: customer manages apps, IAM, data
- 6.PaaS: customer manages application code/configuration
- 7.PaaS: customer manages IAM/data
- 8.SaaS: customer manages tenant configuration
- 9.SaaS: customer manages IAM/data governance
- 10.Provider: physical facilities and underlying infrastructure
- 11.PaaS: provider manages OS/runtime
- 12.SaaS: provider manages OS/runtime
- 13.Exact allocation varies by service/contract
- 14.Privileged management access risks authorized resources
- 15.CAIQ = self-assessment; STAR L2 = audited
- 16.SAML = XML; OIDC = JWT; SCIM = lifecycle
- 17.Protect logging access, retention and integrity
- 18.AWS SGs stateful; network ACLs stateless
- 19.Envelope encryption: KEK wraps DEK
- 20.Crypto-erasure requires suitable prior encryption
- 21.Crypto-erasure: destroy all recoverable key copies
- 22.Plaintext copies need separate sanitization
- 23.Contain harm; preserve feasible evidence
- 24.PE = Policy Engine; decides access
- 25.PA = Policy Administrator; establishes/ends sessions
- 26.PEP = Policy Enforcement Point; enforces access
Free CE
Buy on AmazonSame family resources
Explore More Cloud Security Alliance Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.