Free Alibaba CSA-C01 Exam Flashcards

Alibaba Cloud secures the physical facilities, hardware, network fabric, and managed service platform. Customers secure identities, data, application code, guest OS settings, network rules, and workload configuration.

For ECS, the customer owns guest OS patching, host hardening, application security, RAM permissions, security groups, and data protection. Alibaba Cloud owns the underlying infrastructure and hypervisor.

Layer controls across identity, network, host, application, data, logging, and governance. Alibaba Cloud examples include RAM, security groups, Cloud Firewall, WAF, Security Center, KMS, ActionTrail, and Cloud Config.

Grant only the actions, resources, and conditions required for a role. Prefer scoped custom policies, groups, and temporary role credentials over broad system policies or shared AccessKeys.

Use the Alibaba Cloud account root identity only for account-level tasks. Enable MFA, avoid long-term root AccessKeys, and delegate daily work to RAM users, groups, and roles.

A RAM user represents a person or workload with long-term credentials. A RAM role is assumed by trusted users, services, or accounts to receive temporary STS credentials.

Security Token Service issues short-lived credentials for an assumed RAM role. Use STS for applications, cross-account access, and federated identities instead of embedding permanent AccessKeys.

RAM denies by default. A matching Allow grants access unless any matching explicit Deny exists. Explicit Deny overrides Allow, regardless of where the statements are attached.

Core policy elements include Effect, Action, Resource, and Condition. Use them to express who can perform which Alibaba Cloud API actions on which resources under which constraints.

System policies are Alibaba Cloud-managed permission sets. Custom policies are customer-authored JSON policies used for finer least-privilege control and customer-specific conditions.

Multi-factor authentication adds a second factor to console sign-in, reducing account takeover risk. Enforce MFA for root users, administrators, and other privileged RAM identities.

RAM supports federated single sign-on with corporate identity providers. SSO lets employees use enterprise authentication while RAM roles and policies control Alibaba Cloud authorization.

Resource Directory organizes multiple Alibaba Cloud accounts into folders and member accounts. Use it for centralized governance, delegated administration, and organization-wide guardrails.

Control policies set maximum allowed permissions for folders or member accounts. They act as guardrails that local RAM policies cannot exceed.

Treat AccessKeys as sensitive long-term API credentials. Avoid hardcoding them, rotate them regularly, monitor usage in ActionTrail, and prefer RAM roles with STS when possible.

A security group is a stateful virtual firewall for ECS instances or elastic network interfaces. Use it to allow only required inbound and outbound ports between trusted sources and destinations.

A network ACL is a stateless subnet-level control. Use it as an additional segmentation layer, especially when traffic rules must apply consistently to every resource in a vSwitch.

Security groups are stateful and attach near instances or ENIs. Network ACLs are stateless and apply at the subnet or vSwitch boundary. They complement each other for segmentation.

Cloud Firewall provides centralized traffic control, intrusion prevention, threat intelligence, and logs across internet boundaries, VPC boundaries, and internal east-west traffic.

Cloud Firewall is centralized and adds IPS, threat intelligence, and cross-network visibility. Security groups are distributed instance-level packet filters without managed intrusion prevention.

Web Application Firewall protects HTTP and HTTPS applications from web-layer attacks such as SQL injection, XSS, malicious bots, scanner traffic, and abusive request patterns.

Anti-DDoS mitigates volumetric and protocol-level denial-of-service attacks. Use Anti-DDoS services when traffic floods or SYN floods threaten availability.

WAF inspects application-layer HTTP/HTTPS requests. Anti-DDoS absorbs and scrubs high-volume network or transport-layer attacks. Many internet-facing apps need both.

North-south traffic enters or leaves the cloud environment. East-west traffic moves between internal workloads or VPCs. Cloud Firewall can help govern both patterns centrally.

Keep databases and internal services on private subnets, expose only necessary entry points through SLB or WAF, and use route tables, security groups, ACLs, and Cloud Firewall to restrict paths.

Cloud Security Center provides host security capabilities such as vulnerability detection, baseline checks, intrusion alerts, webshell detection, malware detection, and security posture visibility.

Baseline checks compare ECS and related configurations against hardening rules or compliance expectations. Use findings to fix weak passwords, exposed services, risky permissions, and insecure OS settings.

Continuously discover assets, scan for vulnerabilities, prioritize by severity and exposure, remediate, then verify closure. Security Center helps automate detection and tracking for Alibaba Cloud hosts.

Bastionhost centralizes privileged operations on servers, databases, and network devices. It supports account control, access approval, session recording, command auditing, and replay for accountability.

ActionTrail records Alibaba Cloud console and API activity. Use it to answer who did what, from where, against which resource, and when during audits or investigations.

Log Service centralizes logs from products such as WAF, Cloud Firewall, ActionTrail, and hosts. SOC teams use it for search, dashboards, alerts, and forwarding to SIEM tools.

Cloud Config continuously evaluates resource configuration against rules and compliance packs. Use it to detect public OSS buckets, missing encryption, risky security groups, and drift from policy.

Start by validating the signal, identifying affected assets, checking identity and network logs, estimating impact, and assigning severity. Preserve evidence before making destructive changes.

Prepare, detect and analyze, contain, eradicate, recover, and review lessons learned. On Alibaba Cloud, preserve ActionTrail, WAF, Cloud Firewall, Security Center, and host logs.

Disable or delete the leaked key, deploy a replacement safely, review ActionTrail for unauthorized use, remove the secret from source history, and rotate any downstream secrets that may be exposed.

Isolate the instance with a quarantine security group or firewall rule, preserve disks and logs, rotate credentials, identify persistence, rebuild from trusted images, and verify clean recovery.

A KMS CMK protects data keys and supports cryptographic operations. Use customer-managed keys when you need explicit key ownership, rotation control, auditability, or service-integrated encryption.

Encrypt data with a data key, then encrypt the data key with a KMS CMK. This scales encryption for large data while keeping master key material protected in KMS.

Bring Your Own Key lets a customer import key material into KMS for stronger control over key origin. Use it when policy requires customer-supplied cryptographic material.

Secrets Manager stores and manages sensitive values such as database passwords, API tokens, and certificates. It reduces hardcoded secrets and supports controlled retrieval by authorized workloads.

OSS can encrypt objects at rest with server-side encryption. Use SSE-KMS when you need KMS-managed keys, key auditability, and stronger control than provider-managed default encryption.

Block Public Access helps prevent accidental public exposure of OSS data. Use it as an account or bucket-level guardrail alongside private ACLs, bucket policies, and least-privilege RAM permissions.

RDS encryption protects database storage at rest, and Transparent Data Encryption helps encrypt database files. Pair encryption with RAM controls, network isolation, backups, and audit logging.

Use TLS for data moving over networks, including HTTPS listeners, API calls, database connections, and administrative access. Avoid plaintext protocols for sensitive traffic.

SDDP helps discover, classify, mask, and monitor sensitive data. Use it to identify where personal, financial, or regulated data resides before applying controls.

Multi-Level Protection Scheme is China's cybersecurity classification framework. For mainland China workloads, organizations must understand applicable levels and align technical and process controls accordingly.

Useful evidence includes ActionTrail records, Cloud Config evaluations, Security Center baseline results, WAF and Cloud Firewall logs, KMS key logs, access reviews, and documented incident procedures.

Common choices are mitigate, transfer, avoid, or accept. Cloud controls usually mitigate risk, but residual risk still requires business ownership, documentation, and periodic review.

Separate production, development, security, and logging accounts. Use Resource Directory guardrails, centralized ActionTrail, least-privilege RAM roles, and network segmentation between accounts.

A strong pattern combines DNS and Anti-DDoS, WAF for HTTP inspection, SLB or ALB, private ECS backends, security groups, Cloud Firewall, Security Center, KMS, and centralized logs.