Certified CSA STAR Auditor

What does the acronym STAR stand for in the CSA STAR program?

• ASecurity Trust Assurance and Risk
• BStandardized Testing and Audit Requirements
• CSecurity Technology and Risk
• DStandards Testing Assurance Registry

Which two organizations jointly developed the STAR Lead Auditor training and the Certified CSA STAR Auditor credential?

• AISO and ISACA
• BCSA and BSI
• CNIST and Cloud Security Alliance
• DENISA and ISO

What is the mandatory prerequisite for candidates seeking the Certified CSA STAR Auditor credential?

• ACCSK or CCSP certification
• BISO/IEC 27001 qualified or lead auditor status
• CCompletion of the CAIQ self-assessment
• DThree years of cloud operations experience

The STAR Lead Auditor training course is estimated to take approximately how long to complete?

• A2 hours
• B12 hours
• C6 hours
• D20 hours

The CSA STAR program organizes assurance into multiple levels. Which level involves third-party independent audits?

• ALevel 1 – Self-Assessment
• BLevel 2 – Third-Party Audit
• CLevel 3 – Continuous Monitoring
• DLevel 4 – Attestation

At STAR Level 1, cloud service providers demonstrate their security posture by completing which document?

• ASTAR Certification report signed by an accredited auditor
• BISO/IEC 27001 Statement of Applicability
• CConsensus Assessments Initiative Questionnaire (CAIQ)
• DSOC 2 Type II audit report

How many control domains does the Cloud Controls Matrix (CCM) version 4 contain?

• A10
• B13
• C17
• D25

Which CCM v4 domain abbreviation corresponds to Cryptography, Encryption, and Key Management?

• ACCC
• BCEK
• CIAM
• DDSP

In the STAR Capability Maturity Model, management capability scores are assigned on what scale?

• A1 to 5
• B0 to 100
• C1 to 15
• D1 to 10

When assigning a management capability score to a CCM control area, what principle governs the final score when multiple capability factors are evaluated?

• AThe highest factor score is used as the final score
• BAll factor scores are averaged to produce the final score
• CThe lowest factor score across all evaluated factors becomes the final score
• DThe median factor score is used as the final score

STAR Certification is built on which foundational management system standard?

• AISO/IEC 27017
• BISO/IEC 27001
• CSOC 2 Trust Services Criteria
• DNIST SP 800-53

What is the maximum management capability score a CCM control area can receive if the organization has a major nonconformity in that area?

• A3
• B6
• C9
• D12

Which CCM v4 domain covers the security of application programming interfaces (APIs) and software development lifecycle security?

• ACCC – Change Control and Configuration Management
• BAIS – Application and Interface Security
• CIVS – Infrastructure and Virtualization Security
• DTVM – Threat and Vulnerability Management

The CSA STAR Registry serves what primary purpose for cloud customers?

• AIt hosts the CAIQ questionnaire templates for download
• BIt provides a free publicly accessible listing of CSP security assessments to promote tra…
• CIt issues audit certificates to accredited STAR auditors
• DIt stores encrypted copies of cloud provider security policies

The GRC domain in CCM v4 primarily addresses which set of cloud security concerns?

• AHypervisor isolation and virtual machine separation
• BGovernance, Risk, and Compliance management programs and policies
• CCryptographic key rotation and hardware security modules
• DLog retention and security information event management

In the shared responsibility model for cloud security, who is responsible for ensuring that the audit scope clearly delineates CSP responsibilities from customer responsibilities?

• AThe cloud customer alone
• BThe cloud service provider alone
• CThe auditor, in collaboration with both the CSP and the customer
• DResponsibility delineation is not relevant to STAR audits

The STA domain in CCM v4 covers which area of cloud security?

• AStatic analysis and code review
• BSupply Chain Management, Transparency, and Accountability
• CSecurity testing and assurance
• DStorage access and tier management

Which CCM v4 domain specifically addresses datacenter physical security, environmental controls, and physical access management?

• AIVS – Infrastructure and Virtualization Security
• BUEM – Universal Endpoint Management
• CDCS – Datacenter Security
• DHRS – Human Resources Security

A STAR Auditor is conducting a combined ISO/IEC 27001 and STAR Certification audit. Which approach is recommended for audit efficiency?

• AConduct ISO 27001 and STAR audits as entirely separate engagements
• BComplete ISO 27001 certification first, then begin STAR assessment from scratch
• CIntegrate the CCM assessment into the ISO 27001 audit to leverage shared evidence and red…
• DFocus exclusively on CCM controls and use them to satisfy ISO 27001 requirements

The BCR domain in CCM v4 addresses which cloud security area?

• ABrowser Configuration and Restrictions
• BBusiness Continuity Management and Operational Resilience
• CBaseline Control Requirements
• DBreach and Compliance Reporting

What is the primary purpose of the CAIQ in the context of a STAR Level 2 audit?

• AThe CAIQ is only used at Level 1 and has no role in Level 2 audits
• BThe CAIQ provides a structured questionnaire baseline that auditors can use to evaluate C…
• CThe CAIQ replaces the CCM control assessment entirely at Level 2
• DThe CAIQ is completed by the auditor on behalf of the CSP

Which CCM v4 domain covers requirements for data classification, data handling, and privacy lifecycle management?

• ALOG – Logging and Monitoring
• BDSP – Data Security and Privacy Lifecycle Management
• CIAM – Identity and Access Management
• DGRC – Governance, Risk, and Compliance

In the STAR audit process, what must a cloud provider demonstrate before the auditor can begin assessing management capability scores?

• ACompletion of a CAIQ self-assessment published to the STAR Registry
• BThat all applicable CCM controls are in place and operating effectively
• CAchievement of STAR Level 1 certification for at least one year
• DISO/IEC 27017 certification as a cloud-specific control supplement

The IPY domain in CCM v4 addresses which cloud-specific security concern?

• AIdentity Provisioning and Yielding
• BInteroperability and Portability
• CIP Address and Routing Management
• DIncident Prevention and Yield Rate

Which body accredits certification organizations to perform CSA STAR Certification audits?

• AThe Cloud Security Alliance directly accredits all audit firms
• BNational accreditation bodies accredit certification bodies under ISO/IEC 17021, and thos…
• CBSI is the sole organization authorized to conduct STAR Certification audits worldwide
• DISACA accredits firms to perform STAR Certification audits

The IAM domain in CCM v4 requires cloud providers to implement which type of control to ensure only authorized users access cloud resources?

• AOnly physical access controls such as badge readers
• BIdentity proofing, authentication, authorization, and access lifecycle management controls
• CIP allowlisting as the sole access control mechanism
• DAnnual user access reviews without ongoing monitoring

What is the role of the LOG domain in CCM v4 from an audit perspective?

• ADefine logging hardware specifications for data centers
• BEnsure cloud providers collect, protect, and retain audit logs to support security monito…
• CMandate that all logs be stored in the customer's on-premises environment
• DRestrict logging to security events only, excluding operational events

Which CCM v4 domain addresses security incident response, e-discovery capabilities, and digital forensics in cloud environments?

• ABCR – Business Continuity Management
• BTVM – Threat and Vulnerability Management
• CSEF – Security Incident Management, E-Discovery, and Cloud Forensics
• DGRC – Governance, Risk, and Compliance

When auditing CCM controls under the CCC domain, a STAR Auditor would primarily evaluate evidence related to which activities?

• ACryptographic algorithm selection and key management procedures
• BChange management processes, configuration baselines, and patch management
• CCloud customer contract and SLA terms
• DDatacenter temperature monitoring and cooling system maintenance

In a STAR audit, what does 'audit trail' evidence provide when assessing the IAM domain?

• AProof that the CSP has registered a CAIQ on the STAR Registry
• BDocumentation that user access provisioning and deprovisioning followed approved workflows
• CConfirmation of physical datacenter access logs
• DEvidence that the CSP subscribes to a threat intelligence feed

How does CCM v4 differ from CCM v3.0.1 in terms of structural scope?

• ACCM v4 reduced the number of control domains from 17 to 13
• BCCM v4 expanded and restructured controls, added implementation guidance, and introduced…
• CCCM v4 eliminated all references to ISO/IEC 27001 mappings
• DCCM v4 removed the CAIQ questionnaire from the framework

The Shared Security Responsibility Model (SSRM) in CCM v4 is designed to accomplish what?

• AAllocate all security responsibilities to the cloud customer
• BClearly delineate which CCM controls are the responsibility of the CSP versus the cloud c…
• CTransfer audit liability from the CSP to BSI
• DEliminate the need for customer security assessments

A STAR Auditor reviewing the TVM domain would examine evidence of which activities?

• APhysical building inspections and emergency exit testing
• BVulnerability scanning, penetration testing, and patch management processes
• CSubcontractor contract reviews and data processing agreements
• DEmployee onboarding and security awareness training completion

Which CCM v4 domain addresses the security of endpoint devices that connect to cloud services, including mobile device management?

• AIAM – Identity and Access Management
• BUEM – Universal Endpoint Management
• CAIS – Application and Interface Security
• DIVS – Infrastructure and Virtualization Security

During a STAR audit, what distinguishes a 'minor nonconformity' from a 'major nonconformity'?

• AMinor nonconformities affect fewer than five controls; major nonconformities affect five…
• BA major nonconformity represents a systemic failure or complete absence of a required con…
• CMinor nonconformities only affect the GRC domain; major nonconformities affect all domains
• DMinor and major nonconformities have identical impacts on the maturity score

What is the HRS domain in CCM v4 primarily concerned with?

• AHardware replacement schedules for cloud infrastructure
• BHuman resources security, including personnel vetting, security training, and termination…
• CHigh availability and redundancy requirements for cloud services
• DHealth and safety regulations in cloud data centers

A cloud provider is seeking STAR Certification for the first time. Which of the following best describes the required sequence of steps?

• AComplete CAIQ self-assessment, publish to STAR Registry, then request a STAR Certificate
• BObtain ISO/IEC 27001 certification, then engage an accredited certification body to perfo…
• CHire a STAR Auditor, complete the CCM assessment, then apply for ISO/IEC 27001 after cert…
• DComplete the STAR Level 3 continuous monitoring program before attempting Level 2 certifi…

Which CCM v4 domain is specifically concerned with managing the security risks posed by multi-tenancy and hypervisor vulnerabilities?

• ADCS – Datacenter Security
• BCCC – Change Control and Configuration Management
• CIVS – Infrastructure and Virtualization Security
• DSTA – Supply Chain Management, Transparency, and Accountability

When reviewing audit evidence for the CEK domain, which document would provide the strongest assurance that the CSP's key management practices meet CCM requirements?

• AThe CSP's marketing brochure on encryption capabilities
• BA documented key management policy with evidence of key rotation logs, HSM usage, and dua…
• CThe CSP's CAIQ answer for the CEK domain marked 'Yes'
• DA single sample of an encrypted database backup

In STAR audit terminology, what is meant by the 'scope' of the certification?

• AThe number of control domains assessed in the audit
• BThe specific cloud services, infrastructure, and geographies included in the STAR assessm…
• CThe maturity score range covered by the certificate
• DThe time period for which the audit findings are valid

What does the STAR Registry publication of a STAR Certification indicate to cloud customers?

• AThe CSP has achieved perfect maturity scores across all CCM domains
• BThe CSP has been independently verified to meet ISO/IEC 27001 requirements and CCM contro…
• CThe CSP has completed a self-assessment without external verification
• DThe CSP is exempt from customer security audits

A STAR Auditor discovers that the CSP has no documented process for revoking access when an employee is terminated. Under which CCM v4 domain would this finding be raised?

• AGRC – Governance, Risk, and Compliance
• BIAM – Identity and Access Management
• CHRS – Human Resources Security
• DBoth IAM and HRS domains

In the context of STAR Certification, what is a 'surveillance audit'?

• AAn unannounced spot-check conducted by the STAR Registry team
• BAn annual interim audit between full recertification cycles to verify continued conforman…
• CA customer-sponsored audit of the CSP using CAIQ
• DA penetration test conducted as part of the TVM domain assessment

Under the STAR assessment framework, the overall organizational maturity score is calculated by doing what with the individual CCM domain scores?

• ASelecting the highest domain score as the organizational score
• BSelecting the lowest domain score as the organizational score
• CCalculating the average of all domain capability scores
• DSumming all domain scores and dividing by 10

A STAR Auditor is asked to assess a cloud provider that operates as both an IaaS provider (to some customers) and a SaaS provider (to others). How should the auditor approach the CCM scope?

• AAssess only the IaaS layer since SaaS security is the customer's responsibility
• BConduct separate STAR assessments for the IaaS and SaaS offerings with scopes reflecting…
• CApply identical CCM control scope to both IaaS and SaaS assessments since all 197 control…
• DExclude the STA domain since there are no supply chain risks in a single-provider model

Which domain in CCM v4 would contain controls related to verifying that a cloud provider properly manages and monitors its sub-service providers (subprocessors)?

• AGRC – Governance, Risk, and Compliance
• BDSP – Data Security and Privacy Lifecycle Management
• CSTA – Supply Chain Management, Transparency, and Accountability
• DAIS – Application and Interface Security