Alibaba CSA-C01 Exam Flashcards

Q: What is the CSA-C01 exam format?

The Alibaba Cloud Certified Associate: Cloud Security Engineer exam uses 50 multiple-choice questions, lasts 90 minutes, is offered in English, and requires 70 out of 100 points to pass.

Q: Which Alibaba Cloud services should I know for CSA-C01?

Prioritize RAM, STS, Resource Directory, Security Center, Bastionhost, ActionTrail, Cloud Config, KMS, Secrets Manager, OSS encryption, WAF, Anti-DDoS, and Cloud Firewall.

Q: How should I use these flashcards?

Review by topic after studying the product docs, then retest weak areas with practice questions. Focus on choosing the correct Alibaba Cloud service for each security scenario.

Q: Does CSA-C01 require hands-on experience?

Alibaba Cloud does not list a formal prerequisite, but hands-on familiarity with VPC, RAM policies, ECS, OSS, logging, and managed security services makes the exam much easier.

Question 1

Alibaba Cloud shared responsibility model

Accepted Answer

Alibaba Cloud secures the physical facilities, hardware, network fabric, and managed service platform. Customers secure identities, data, application code, guest OS settings, network rules, and workload configuration.

Question 2

Customer responsibilities on ECS

Accepted Answer

For ECS, the customer owns guest OS patching, host hardening, application security, RAM permissions, security groups, and data protection. Alibaba Cloud owns the underlying infrastructure and hypervisor.

Question 3

Cloud security defense in depth

Accepted Answer

Layer controls across identity, network, host, application, data, logging, and governance. Alibaba Cloud examples include RAM, security groups, Cloud Firewall, WAF, Security Center, KMS, ActionTrail, and Cloud Config.

Question 4

Least privilege in RAM

Accepted Answer

Grant only the actions, resources, and conditions required for a role. Prefer scoped custom policies, groups, and temporary role credentials over broad system policies or shared AccessKeys.

Question 5

RAM root account best practice

Accepted Answer

Use the Alibaba Cloud account root identity only for account-level tasks. Enable MFA, avoid long-term root AccessKeys, and delegate daily work to RAM users, groups, and roles.

Question 6

RAM user vs RAM role

Accepted Answer

A RAM user represents a person or workload with long-term credentials. A RAM role is assumed by trusted users, services, or accounts to receive temporary STS credentials.

Question 7

RAM STS

Accepted Answer

Security Token Service issues short-lived credentials for an assumed RAM role. Use STS for applications, cross-account access, and federated identities instead of embedding permanent AccessKeys.

Question 8

RAM policy evaluation

Accepted Answer

RAM denies by default. A matching Allow grants access unless any matching explicit Deny exists. Explicit Deny overrides Allow, regardless of where the statements are attached.

Question 9

RAM policy elements

Accepted Answer

Core policy elements include Effect, Action, Resource, and Condition. Use them to express who can perform which Alibaba Cloud API actions on which resources under which constraints.

Question 10

RAM system policy vs custom policy

Accepted Answer

System policies are Alibaba Cloud-managed permission sets. Custom policies are customer-authored JSON policies used for finer least-privilege control and customer-specific conditions.

Question 11

MFA on Alibaba Cloud

Accepted Answer

Multi-factor authentication adds a second factor to console sign-in, reducing account takeover risk. Enforce MFA for root users, administrators, and other privileged RAM identities.

Question 12

SSO for Alibaba Cloud console access

Accepted Answer

RAM supports federated single sign-on with corporate identity providers. SSO lets employees use enterprise authentication while RAM roles and policies control Alibaba Cloud authorization.

Question 13

Resource Directory

Accepted Answer

Resource Directory organizes multiple Alibaba Cloud accounts into folders and member accounts. Use it for centralized governance, delegated administration, and organization-wide guardrails.

Question 14

Control policies in Resource Directory

Accepted Answer

Control policies set maximum allowed permissions for folders or member accounts. They act as guardrails that local RAM policies cannot exceed.

Question 15

AccessKey security

Accepted Answer

Treat AccessKeys as sensitive long-term API credentials. Avoid hardcoding them, rotate them regularly, monitor usage in ActionTrail, and prefer RAM roles with STS when possible.

Question 16

VPC security group

Accepted Answer

A security group is a stateful virtual firewall for ECS instances or elastic network interfaces. Use it to allow only required inbound and outbound ports between trusted sources and destinations.

Question 17

Network ACL

Accepted Answer

A network ACL is a stateless subnet-level control. Use it as an additional segmentation layer, especially when traffic rules must apply consistently to every resource in a vSwitch.

Question 18

Security group vs network ACL

Accepted Answer

Security groups are stateful and attach near instances or ENIs. Network ACLs are stateless and apply at the subnet or vSwitch boundary. They complement each other for segmentation.

Question 19

Cloud Firewall

Accepted Answer

Cloud Firewall provides centralized traffic control, intrusion prevention, threat intelligence, and logs across internet boundaries, VPC boundaries, and internal east-west traffic.

Question 20

Cloud Firewall vs security group

Accepted Answer

Cloud Firewall is centralized and adds IPS, threat intelligence, and cross-network visibility. Security groups are distributed instance-level packet filters without managed intrusion prevention.

Question 21

WAF use case

Accepted Answer

Web Application Firewall protects HTTP and HTTPS applications from web-layer attacks such as SQL injection, XSS, malicious bots, scanner traffic, and abusive request patterns.

Question 22

Anti-DDoS use case

Accepted Answer

Anti-DDoS mitigates volumetric and protocol-level denial-of-service attacks. Use Anti-DDoS services when traffic floods or SYN floods threaten availability.

Question 23

WAF vs Anti-DDoS

Accepted Answer

WAF inspects application-layer HTTP/HTTPS requests. Anti-DDoS absorbs and scrubs high-volume network or transport-layer attacks. Many internet-facing apps need both.

Question 24

North-south vs east-west traffic

Accepted Answer

North-south traffic enters or leaves the cloud environment. East-west traffic moves between internal workloads or VPCs. Cloud Firewall can help govern both patterns centrally.

Question 25

Private workload design

Accepted Answer

Keep databases and internal services on private subnets, expose only necessary entry points through SLB or WAF, and use route tables, security groups, ACLs, and Cloud Firewall to restrict paths.

Question 26

Cloud Security Center

Accepted Answer

Cloud Security Center provides host security capabilities such as vulnerability detection, baseline checks, intrusion alerts, webshell detection, malware detection, and security posture visibility.

Question 27

Baseline checks

Accepted Answer

Baseline checks compare ECS and related configurations against hardening rules or compliance expectations. Use findings to fix weak passwords, exposed services, risky permissions, and insecure OS settings.

Question 28

Vulnerability management lifecycle

Accepted Answer

Continuously discover assets, scan for vulnerabilities, prioritize by severity and exposure, remediate, then verify closure. Security Center helps automate detection and tracking for Alibaba Cloud hosts.

Question 29

Bastionhost

Accepted Answer

Bastionhost centralizes privileged operations on servers, databases, and network devices. It supports account control, access approval, session recording, command auditing, and replay for accountability.

Question 30

ActionTrail

Accepted Answer

ActionTrail records Alibaba Cloud console and API activity. Use it to answer who did what, from where, against which resource, and when during audits or investigations.

Question 31

Log Service for security operations

Accepted Answer

Log Service centralizes logs from products such as WAF, Cloud Firewall, ActionTrail, and hosts. SOC teams use it for search, dashboards, alerts, and forwarding to SIEM tools.

Question 32

Cloud Config

Accepted Answer

Cloud Config continuously evaluates resource configuration against rules and compliance packs. Use it to detect public OSS buckets, missing encryption, risky security groups, and drift from policy.

Question 33

Security alert triage

Accepted Answer

Start by validating the signal, identifying affected assets, checking identity and network logs, estimating impact, and assigning severity. Preserve evidence before making destructive changes.

Question 34

Incident response lifecycle

Accepted Answer

Prepare, detect and analyze, contain, eradicate, recover, and review lessons learned. On Alibaba Cloud, preserve ActionTrail, WAF, Cloud Firewall, Security Center, and host logs.

Question 35

Leaked AccessKey response

Accepted Answer

Disable or delete the leaked key, deploy a replacement safely, review ActionTrail for unauthorized use, remove the secret from source history, and rotate any downstream secrets that may be exposed.

Question 36

ECS compromise containment

Accepted Answer

Isolate the instance with a quarantine security group or firewall rule, preserve disks and logs, rotate credentials, identify persistence, rebuild from trusted images, and verify clean recovery.

Question 37

KMS Customer Master Key

Accepted Answer

A KMS CMK protects data keys and supports cryptographic operations. Use customer-managed keys when you need explicit key ownership, rotation control, auditability, or service-integrated encryption.

Question 38

Envelope encryption

Accepted Answer

Encrypt data with a data key, then encrypt the data key with a KMS CMK. This scales encryption for large data while keeping master key material protected in KMS.

Question 39

BYOK

Accepted Answer

Bring Your Own Key lets a customer import key material into KMS for stronger control over key origin. Use it when policy requires customer-supplied cryptographic material.

Question 40

Secrets Manager

Accepted Answer

Secrets Manager stores and manages sensitive values such as database passwords, API tokens, and certificates. It reduces hardcoded secrets and supports controlled retrieval by authorized workloads.

Question 41

OSS server-side encryption

Accepted Answer

OSS can encrypt objects at rest with server-side encryption. Use SSE-KMS when you need KMS-managed keys, key auditability, and stronger control than provider-managed default encryption.

Question 42

OSS Block Public Access

Accepted Answer

Block Public Access helps prevent accidental public exposure of OSS data. Use it as an account or bucket-level guardrail alongside private ACLs, bucket policies, and least-privilege RAM permissions.

Question 43

RDS encryption and TDE

Accepted Answer

RDS encryption protects database storage at rest, and Transparent Data Encryption helps encrypt database files. Pair encryption with RAM controls, network isolation, backups, and audit logging.

Question 44

Encryption in transit

Accepted Answer

Use TLS for data moving over networks, including HTTPS listeners, API calls, database connections, and administrative access. Avoid plaintext protocols for sensitive traffic.

Question 45

Sensitive Data Discovery and Protection

Accepted Answer

SDDP helps discover, classify, mask, and monitor sensitive data. Use it to identify where personal, financial, or regulated data resides before applying controls.

Question 46

MLPS

Accepted Answer

Multi-Level Protection Scheme is China's cybersecurity classification framework. For mainland China workloads, organizations must understand applicable levels and align technical and process controls accordingly.

Question 47

Compliance evidence on Alibaba Cloud

Accepted Answer

Useful evidence includes ActionTrail records, Cloud Config evaluations, Security Center baseline results, WAF and Cloud Firewall logs, KMS key logs, access reviews, and documented incident procedures.

Question 48

Risk treatment choices

Accepted Answer

Common choices are mitigate, transfer, avoid, or accept. Cloud controls usually mitigate risk, but residual risk still requires business ownership, documentation, and periodic review.

Question 49

Secure multi-account pattern

Accepted Answer

Separate production, development, security, and logging accounts. Use Resource Directory guardrails, centralized ActionTrail, least-privilege RAM roles, and network segmentation between accounts.

Question 50

Layered internet-facing application protection

Accepted Answer

A strong pattern combines DNS and Anti-DDoS, WAF for HTTP inspection, SLB or ALB, private ECS backends, security groups, Cloud Firewall, Security Center, KMS, and centralized logs.

Free Alibaba CSA-C01 Exam Flashcards

Filter by Topic

Jump to Card

About These Alibaba CSA-C01 Flashcards

Topics Covered

Frequently Asked Questions

Alibaba Cloud Security Engineer (Associate)

Explore More Alibaba Cloud Certifications

Alibaba Cloud ACA Cloud Business

Alibaba Cloud ACA Generative AI Engineer

Alibaba Cloud Certified Associate (ACA) Cloud Computing

Alibaba Cloud Certified Associate (ACA) Cloud Operator

Alibaba Cloud Certified Cloud Architect (Professional)

Alibaba Cloud Certified Professional - Cloud Computing (ACP-Cloud1)

More From This Family