100+ Free Certified CSA STAR Auditor Practice Questions

Candidates must hold ISO/IEC 27001 qualified or lead auditor status before pursuing the Certified CSA STAR Auditor credential. This prerequisite ensures candidates have a solid ISMS auditing foundation before adding the cloud-specific CCM and STAR assessment layer. The training and exam are jointly delivered by BSI and CSA through an approximately 6-hour self-paced online course followed by a 2-hour exam.

The CSA STAR (Security, Trust, Assurance, and Risk) program is a publicly accessible cloud security assurance framework launched jointly by CSA and BSI in 2013. It has three levels: Level 1 (Self-Assessment via CAIQ), Level 2 (Third-Party Audit: STAR Certification based on ISO 27001+CCM, or STAR Attestation based on SOC 2+CCM), and Level 3 (STAR Continuous: ongoing automated monitoring). The STAR Registry publishes all submissions publicly.

CCM v4 contains 17 control domains covering approximately 197 individual controls. The domains are: AIS (Application & Interface Security), BCR (Business Continuity), CCC (Change Control & Configuration), CEK (Cryptography, Encryption & Key Management), DCS (Datacenter Security), DSP (Data Security & Privacy), GRC (Governance, Risk & Compliance), HRS (Human Resources Security), IAM (Identity & Access Management), IPY (Interoperability & Portability), IVS (Infrastructure & Virtualization Security), LOG (Logging & Monitoring), SEF (Security Incident Management, E-Discovery & Forensics), STA (Supply Chain, Transparency & Accountability), TVM (Threat & Vulnerability Management), UEM (Universal Endpoint Management), and A&A (Audit & Assurance).

The STAR maturity model scores each CCM control domain on a scale of 1 to 15, divided into five management capability groups. When evaluating a domain, auditors assess five capability factors and apply a weakest-link rule: the lowest factor score becomes the domain score. Control areas with major nonconformities are capped at a maximum score of 6. The overall organizational maturity score is the average of all domain scores.

STAR Certification is built on top of ISO/IEC 27001. A cloud provider must first achieve ISO/IEC 27001 certification and then undergo an additional CCM v4 maturity assessment conducted by an accredited certification body. In practice, the two audits are typically integrated so evidence can be shared. The STAR certificate is issued alongside the ISO 27001 certificate and follows the same three-year cycle with annual surveillance audits.

Both are Level 2 (third-party) STAR program offerings. STAR Certification is based on ISO/IEC 27001 plus CCM maturity scoring and is issued by accredited certification bodies. STAR Attestation is based on SOC 2 Trust Services Criteria plus CCM and is delivered by licensed CPA firms. Organizations choose based on their compliance framework preferences and target customer markets.

Complete the BSI/CSA STAR Lead Auditor self-paced training course (approximately 6 hours). Supplement it by studying the CSA CCM v4 documentation including the SSRM, Implementation Guidelines, and CAIQ. Review the STAR certification guidance document on auditing the CCM. Study ISO 19011 audit principles and ISO/IEC 27001 Annex A to CCM v4 mappings. Practice with scenario-based questions covering all 17 CCM domains, maturity scoring rules, and audit methodology.