61 free CSA CCSK v5 practice questions from the CertStash pack of 244, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 61 free here, all 244 in the pack, and each step includes the one before it.
Get all 244 questions (US$39) · Download the first 10 as a PDF
Question 1
Which practice best helps mitigate security risks by minimizing root/core access and restricting deployment creation?
Show answer and explanation
Correct answer: D. Enforcing the principle of least privilege
Least privilege means every user, role and workload receives only the permissions needed for its task and nothing more. Applied to a cloud account, it keeps root and core administrative access to a very small group and limits who may create deployments, so a stolen credential or a careless administrator can do far less damage. Granting access narrowly up front, and widening it only when a need is shown, shrinks the attack surface and the blast radius of any compromise, which is exactly what the scenario asks for.
Why the other options are wrong
- A. Verifying only after access has been granted leaves a window in which broad rights are already in the wrong hands, so it does not restrict root or deployment rights.
- B. Turning off multi-factor authentication for staff removes a barrier against credential theft and does nothing to limit privileged access.
- C. Starting with full access and trimming it later exposes every resource in the meantime, which is the reverse of limiting root and deployment rights.
Question 2
What is one primary operational challenge associated with using cloud-agnostic container strategies?
Show answer and explanation
Correct answer: D. Management plane compatibility and consistent controls
A cloud-agnostic container strategy runs the same workloads on several providers, but each provider has its own management plane, with different APIs, consoles, networking constructs and security services. The organization must therefore deal with differences in how each management plane works and still apply a consistent set of controls, policies and monitoring across all of them. Containers are portable, yet the surrounding control layer is not, so keeping management plane compatibility and uniform controls is the main operational burden.
Why the other options are wrong
- A. Avoiding dependence on one provider is the goal of a cloud-agnostic approach, so confining deployment to a single cloud is the opposite of the strategy and not a challenge it creates.
- B. Identity and access management is a requirement on every cloud and in every deployment model, so it is not a difficulty that arises specifically from running containers in a cloud-agnostic way.
- C. Containers do not shrink storage use, and storage volume is a cost matter rather than an operational challenge of running across providers.
Question 3
How can the use of third-party libraries introduce supply chain risks in software development?
Show answer and explanation
Correct answer: B. They might contain vulnerabilities that can be exploited
Third-party libraries bring code that the organization did not write and cannot fully control. If a library contains a vulnerability, every application that includes it inherits the flaw, and attackers can exploit it across many downstream users at once. A compromised or poisoned library has the same effect. This is why software composition analysis, dependency tracking and prompt patching are part of a secure supply chain, and why vulnerabilities in the components are the core risk to name.
Why the other options are wrong
- A. Open source libraries should be vetted like any other component, and assuming they need no review is a failure of control that creates risk rather than a property of the libraries.
- C. Trouble integrating with a pipeline is a build and delivery problem that does not expose the application to attack through the components it uses.
- D. A larger codebase raises maintenance effort but is an engineering concern, not a path by which an attacker reaches the software through its dependencies.
Question 4
Which aspect is most important for effective cloud governance?
Show answer and explanation
Correct answer: B. Implementing best-practice cloud security control objectives
Control objectives state the security outcomes the organization requires, and they are what control specifications and implementation guidance are built to meet. In the governance hierarchy they sit between policy and the specific controls, so well-chosen, best-practice objectives are what give the whole structure direction and make results measurable. Without sound objectives, controls get applied without a clear target, and there is nothing concrete against which to assess whether cloud use is adequately governed.
Why the other options are wrong
- A. A hierarchy only arranges the layers of governance, and by itself it does not define which security outcomes those layers must achieve.
- C. Policies set high-level intent, and without clear control objectives beneath them they cannot be turned into measurable requirements.
- D. SLA terms describe what a provider commits to deliver, and they do not define the organization's own security objectives or how it governs its cloud use.
Question 5
What are the essential characteristics of cloud computing as defined by the NIST model?
Show answer and explanation
Correct answer: C. On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service
The NIST definition of cloud computing (SP 800-145), which the CSA Security Guidance adopts, lists five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. Together they describe how consumers provision capacity themselves, reach it over standard networks, draw from a shared multi-tenant pool, scale quickly in either direction and pay for metered usage. A service missing these traits is not cloud computing under the NIST model.
Why the other options are wrong
- A. Automated recovery, universal connectivity, distributed costs and fair pricing are not terms in the NIST definition, and none of them maps onto its five characteristics.
- B. High availability, geographical distribution, scaled tenancy and market pricing are not in the NIST list, so this set does not match the five defined characteristics.
- D. Dedicated hosting and isolated networks are not NIST characteristics, and dedicated hosting runs against the shared resource pooling that the definition requires.
Question 6
Which of the following best describes the responsibility for security in a cloud environment?
Show answer and explanation
Correct answer: B. Cloud Service Providers (CSPs) and Cloud Service Customers (CSCs) share security responsibilities. The exact allocation of responsibilities depends on the technology and context.
Security in the cloud is a shared responsibility between the provider (CSP) and the customer (CSC), and the exact split changes with the technology and context. The service model matters a great deal: in IaaS the customer secures the operating system, applications and data, while in SaaS the provider takes on far more and the customer is left mainly with data, configuration and access. Contracts and the specific services in use shift the line further, so each customer must work out where it falls.
Why the other options are wrong
- A. The split is not fixed, because it moves with the service model, the specific service and the contractual terms.
- C. Customers always keep responsibilities such as managing their data, identities and configuration, so they are more than advisers and the provider is not solely responsible.
- D. Providers must secure the infrastructure and services they operate, so the customer is not solely responsible, and accountability does not rest only with the provider.
Question 7
When comparing different Cloud Service Providers (CSPs), what should a cybersecurity professional be mindful of regarding their organizational structures?
Show answer and explanation
Correct answer: B. Different CSPs may have similar structures but use varying terminology.
Major providers organize their environments in broadly comparable ways, with a top-level organization containing accounts, subscriptions or projects, and resources inside them. The names for these constructs differ from one provider to the next, so the same idea may be called an account on one platform and a subscription or project on another. A security professional comparing or working across CSPs needs to map the terms correctly so that controls and governance are applied to the right level of each environment.
Why the other options are wrong
- A. Providers do not share one structure and vocabulary, and the same concept often carries a different name depending on the platform.
- C. The structures are similar rather than vastly different, and the terminology is not identical, so this reverses both halves of the real picture.
- D. Misreading what a term means can leave a control applied at the wrong level or a resource unprotected, so terminology differences do influence security practice.
Question 8
What type of logs record interactions with specific services in a system?
Show answer and explanation
Correct answer: A. Service and Application Logs
In cloud security monitoring, service and application logs record how specific services and applications are being used, such as requests made to a service, its operations and its events. They sit alongside management plane logs, which record administrative actions on the cloud account, and network telemetry such as flow and DNS logs. When the question is about interactions with a particular service in a system, service and application logs are the category that covers them.
Why the other options are wrong
- B. Security logs is a broad, generic label, and it does not name the category that records how a given service is being used.
- C. Network logs capture traffic and connection details between systems, not what happens inside a specific service.
- D. Debug logs hold diagnostic detail meant for developers troubleshooting code, and they are not the log type defined for recording service interactions.
Question 9
Why is identity management at the organization level considered a key aspect in cybersecurity?
Show answer and explanation
Correct answer: B. It ensures only authorized users have access to resources
Managing identities centrally for the organization lets it establish who each user is, control the entitlements granted and make sure only authorized people and systems reach resources. Because cloud use often spans many accounts, services and providers, a single authoritative approach to identity (typically with federation to an identity provider) is what makes consistent authentication and authorization possible. Access control is the central purpose, and the other benefits flow from getting that right.
Why the other options are wrong
- A. Need to know still has to be enforced through the entitlements that identity management grants, so identity management does not replace it.
- C. Automation is not what makes identity management a key aspect, since its core role is controlling who may access what.
- D. Training and auditing remain necessary for people and for reviewing access, and identity management does not remove them or free up budget.
Question 10
Which of the following cloud essential characteristics refers to the capability of the service to scale resources up or down quickly and efficiently based on demand?
Show answer and explanation
Correct answer: D. Rapid Elasticity
Rapid elasticity is the NIST essential characteristic describing the ability to provision and release capabilities quickly, in some cases automatically, so capacity grows or shrinks in step with demand. To the consumer the available resources can appear unlimited and obtainable at any time. This lets an organization match capacity to load and pay only for what it uses, which is what the scenario in the question describes.
Why the other options are wrong
- A. On-demand self-service means a consumer can provision resources unilaterally without human interaction with the provider, and it says nothing about scaling with load.
- B. Broad network access concerns reaching services over the network from many types of client devices, not changing capacity.
- C. Resource pooling means the provider serves multiple consumers from a shared pool of resources, which describes how capacity is organized rather than how it scales.
What people say about the full CCSK v5 pack 5.0 from 6
Passed! Highly recommend this dump.
Passed the CCSK v5! Hard to find good prep material for this one. This dump has real questions and a lot came out in my exam. Solid resource for a niche cert.
Cleared my CCSK v5 exam. The questions are accurate and the dump is well maintained. Passed on first attempt. For the price this is a great find.
Question 11
What does orchestration automate within a cloud environment?
Show answer and explanation
Correct answer: D. Provisioning of VMs, networking and other resources
Orchestration automates the coordinated provisioning and management of cloud resources, such as virtual machines, networks, storage and other services, so that complete environments can be deployed consistently without manual steps. It is commonly driven by templates or code, which ties it closely to infrastructure as code and supports repeatable, auditable builds. From a security view, that consistency helps apply the same hardened configuration every time a stack is created.
Why the other options are wrong
- A. Application performance monitoring is carried out by observability tools and is not what orchestration automates.
- B. Orchestration exists to replace manual configuration with automation, so manual security configuration is the opposite of what it does.
- C. Installing an operating system does not describe orchestration, which coordinates the provisioning of compute, network and other resources.
Question 12
In the initial stage of implementing centralized identity management, what is the primary focus of cybersecurity measures?
Show answer and explanation
Correct answer: B. Integrating identity management and securing devices
The first stage of moving to centralized identity management concentrates on integrating the identity systems, so that one authoritative directory or identity provider governs access, and on securing the devices that connect to it. Identity is the foundation on which later controls depend, so bringing identities under central control and trusting the endpoints that authenticate come before more advanced capabilities. Later stages then build on this base with detection, response and network controls.
Why the other options are wrong
- A. Incident response plans are developed after the identity foundation exists and are not the opening focus of an identity rollout.
- C. Advanced threat detection depends on a consolidated identity foundation and so belongs to a later stage.
- D. Network segmentation is a separate infrastructure control and does not establish central identity management.
Question 13
Which Cloud Service Provider (CSP) security measure is primarily used to filter and monitor HTTP requests to protect against SQL injection and XSS attacks?
Show answer and explanation
Correct answer: C. Web Application Firewall (WAF)
A web application firewall inspects HTTP and HTTPS requests at the application layer and blocks or flags patterns that indicate attacks such as SQL injection and cross-site scripting. Cloud providers offer it as a managed service that can be placed in front of web applications, load balancers or content delivery networks, with rule sets that are updated as new attack techniques appear. It is the control designed for this purpose.
Why the other options are wrong
- A. A cloud provider's firewall filters on addresses, ports and protocols, so it cannot read the content of a web request to recognize an injection string or script.
- B. A virtual appliance is a general delivery format for a security product from a vendor, so the term does not name a control that filters web requests for these attacks.
- D. An intrusion detection system raises alerts on suspicious activity and does not filter HTTP requests inline to block these web attacks.
Question 14
What is a key characteristic of serverless functions in terms of execution environment?
Show answer and explanation
Correct answer: D. They are executed in isolated, ephemeral environments
Serverless functions run in isolated, short-lived execution environments that the provider creates when an event arrives and removes after the function finishes or has been idle. Customers do not provision or manage the servers underneath, and the environment cannot be relied on to keep anything between invocations, so state and secrets must be held in external services. This ephemeral, isolated model changes the security approach, shifting emphasis to code, permissions and event inputs.
Why the other options are wrong
- A. The provider runs the underlying infrastructure, so the customer has no servers to monitor continuously and focuses on function logs and behavior.
- B. Serverless platforms start execution environments on demand and do not keep dedicated instances running for each function.
- C. Capacity is allocated by the provider when the function runs, so the customer reserves no server space in advance.
Question 15
Which of the following enhances Platform as a Service (PaaS) security by regulating traffic into PaaS components?
Show answer and explanation
Correct answer: D. API Gateways
PaaS components are usually reached through APIs rather than through hosts the customer controls, so traffic into them is best regulated at an API gateway. The gateway sits in front of the service and can authenticate callers, authorize requests, apply rate limits and validate input before anything reaches the platform component. This gives the customer a policy enforcement point for a service whose underlying network and operating system belong to the provider.
Why the other options are wrong
- A. An intrusion detection system observes traffic and raises alerts, but it does not regulate what is allowed into the service.
- B. Hardware security modules protect cryptographic keys and perform cryptographic operations, and they have no role in controlling inbound traffic.
- C. Network ACLs filter by address and port at the network layer, so they cannot authenticate callers or inspect API requests for a PaaS service.
Question 16
Which of the following events should be monitored according to CIS AWS benchmarks?
Show answer and explanation
Correct answer: D. Unauthorized API calls
The CIS AWS Foundations Benchmark includes monitoring recommendations that call for log metric filters and alarms on security-relevant events, and unauthorized API calls are among the first of these. A rise in denied or unauthorized calls can signal compromised credentials, reconnaissance or attempted privilege escalation, so alerting on them gives early warning. The benchmark's monitoring items also cover console sign-in without multi-factor authentication, root account use and changes to IAM policies and network configuration.
Why the other options are wrong
- A. Backups are routine operational activity and are not a security event for which the benchmark requires alarms.
- B. Encryption at rest is a configuration setting checked by a control, and it does not produce events to alarm on.
- C. Successful logins are normal activity, and the benchmark targets suspicious sign-ins, such as those without multi-factor authentication, rather than every success.
Question 17
Which aspect of cybersecurity can AI enhance by reducing false positive alerts?
Show answer and explanation
Correct answer: A. Anomaly detection
Anomaly detection depends on separating real deviations from normal variation, and machine learning models can learn behavioral baselines for users, workloads and traffic. This lets them flag genuinely unusual activity while ignoring harmless fluctuations that fixed thresholds would alert on, which cuts false positives and the alert fatigue that comes with them. Better accuracy here means analysts spend their time on events that matter.
Why the other options are wrong
- B. Assisting analysts is a broad support role, and reducing false positives is not what defines it.
- C. Threat intelligence is about collecting and analyzing information on adversaries, and its main value is not reducing false alerts.
- D. Automated responses act on alerts that detection has already produced, so their quality depends on detection accuracy instead of improving it.
Question 18
What is a key consideration when handling cloud security incidents?
Show answer and explanation
Correct answer: D. Cloud service provider service level agreements
In the cloud, the provider controls much of the underlying environment, so handling an incident depends on what the provider contract commits to. Service level agreements and support terms determine response times, the provider's help with evidence and investigation, and how customer and provider duties are split during an incident. Customers should review these terms during preparation so that they know in advance what access and assistance they can count on when an incident occurs.
Why the other options are wrong
- A. Adding staff is a resourcing choice and does not address the cloud-specific dependency on the provider.
- B. Network traffic monitoring is one detection input among several, and it is not the cloud-specific consideration the question asks about.
- C. Technical fixes alone ignore the provider relationship, evidence access and coordination that cloud incident handling needs.
Question 19
Which technique involves assessing potential threats through analyzing attacker capabilities, motivations, and potential targets?
Show answer and explanation
Correct answer: A. Threat modeling
Threat modeling is the structured technique for working out what could go wrong with a system by looking at who might attack it, what they are capable of, why they would do so and what they would target. The result guides design decisions and helps prioritize defenses before the system is built or deployed. It starts from the adversary and the assets at risk, which is what distinguishes it from other assessment methods.
Why the other options are wrong
- B. A vulnerability assessment looks for weaknesses in systems and does not study the attacker's capabilities and motives.
- C. Incident response is the process for handling an event after it is detected and does not assess potential threats beforehand.
- D. A risk assessment weighs the likelihood and impact of risks across the organization, and it is not the technique built around analyzing the attacker's capabilities, motivations and targets.
Question 20
Why is it important to capture and centralize workload logs promptly in a cybersecurity environment?
Show answer and explanation
Correct answer: C. Logs may be lost during a scaling event
Cloud workloads are ephemeral. Instances, containers and functions are created and destroyed by autoscaling, deployments and failures, and any logs kept only on local storage disappear with them. Collecting logs promptly and sending them to a central, protected location preserves the telemetry needed for detection, investigation and audit even after the workload that produced it no longer exists. Centralization also lets analysts correlate events across many short-lived resources.
Why the other options are wrong
- A. Easier debugging is a side benefit for developers, but it is not the security reason for capturing logs promptly.
- B. Centralized logging generally adds storage and processing cost, and cost reduction is not its purpose.
- D. Regulatory requirements may call for retaining logs, but they do not explain why logs must be captured promptly given short-lived workloads.
Question 21
In cloud environments, why are Management Plane Logs indispensable for security monitoring?
Show answer and explanation
Correct answer: C. They track cloud administrative activities
Management plane logs record the administrative activity performed through the cloud provider's APIs and console, such as creating or deleting resources, changing permissions and altering policies. Because the management plane controls the whole environment, these logs show who changed what and when, which makes them essential for spotting unauthorized administrative actions and privilege abuse. They are available from the provider and are a core telemetry source for cloud security monitoring.
Why the other options are wrong
- A. Real-time detection comes from analytics and alerting built on many telemetry sources, and the logs themselves do not provide detection or response.
- B. Traffic between cloud services is described by network flow logs, which are a different telemetry type.
- D. Activity inside applications is recorded in application logs generated by the workload, not by the management plane.
Question 22
What is the primary function of Privileged Identity Management (PIM) and Privileged Access Management (PAM)?
Show answer and explanation
Correct answer: B. Manage the risk of elevated permissions
Privileged Identity Management and Privileged Access Management exist to manage the risk that comes with elevated permissions. Accounts with administrative rights can do the most harm if misused or stolen, so these tools grant privileges only when needed, often for a limited time, and record and review how they are used. This helps keep standing administrative access to a minimum and makes high-risk activity accountable.
Why the other options are wrong
- A. Encrypting data in transit is done by transport protocols and network security controls, and it is not what privileged access tooling does.
- C. Watching network traffic and detecting intrusions is the work of monitoring and detection tools, whereas PIM and PAM control who holds elevated rights.
- D. Uptime and reliability are handled by availability and resilience engineering, and privileged access management does not address them.
Question 23
What is the primary purpose of secrets management in cloud environments?
Show answer and explanation
Correct answer: B. Securely handling stored authentication credentials
Secrets management exists to handle credentials that applications and services use, such as API keys, database passwords, certificates, and tokens. A secrets management system stores them securely instead of leaving them in code or configuration files, controls which workloads can retrieve them, supports rotation, and records access. This reduces the chance that a leaked or hard-coded secret leads to unauthorized access.
Why the other options are wrong
- A. Watching network traffic for threats is the work of network monitoring and detection tools, which do not store credentials.
- C. Authenticating human users is the job of identity and access management, whereas secrets management mainly serves applications and services.
- D. Tuning infrastructure performance is a capacity and optimization task and has no connection to protecting credentials.
Question 24
Which of the following is the MOST common cause of cloud-native security breaches?
Show answer and explanation
Correct answer: B. IAM failures
Identity and access management failures are the most common cause of cloud-native breaches. In the cloud, identity is the control that decides who can reach the management plane, data and workloads, so overly permissive policies, stolen or leaked credentials, weak multi-factor authentication and poorly scoped roles give attackers direct access to resources without exploiting any infrastructure flaw. This is why identity is often called the new perimeter in the cloud, and why least privilege and strong authentication carry so much weight.
Why the other options are wrong
- A. The provider secures its physical facilities under the shared responsibility model, and breaches of customer environments rarely start there.
- C. Missing encryption increases the damage of a breach, but it is not how most attackers get in, since they typically use valid or over-privileged identities.
- D. Weak monitoring delays discovery of an attack, but it is a detection gap and not the initial cause of the compromise.
Question 25
Which practice minimizes human error in long-running cloud workloads’ security management?
Show answer and explanation
Correct answer: D. Implementing automated security and compliance checks
Human error is most reliably reduced by taking people out of repetitive checking. Automated security and compliance checks evaluate configurations and settings continuously against defined policy, flag drift as soon as it occurs and apply the same rules every time. For long-running workloads, which accumulate changes over a long life, continuous automated verification catches problems that periodic manual reviews would miss, and it does so consistently and at scale.
Why the other options are wrong
- A. More frequent manual audits still depend on people repeating detailed tasks, so they keep the same room for mistakes and leave long gaps between checks.
- B. Making every workload ephemeral changes the architecture, but it is neither practical for all workloads nor a way of reducing human error in managing security.
- C. Limiting who can reach configurations reduces exposure, yet the people who keep access can still make mistakes, so error is not removed.
Question 26
In a cloud computing incident, what should be the initial focus of analysis due to the ephemeral nature of resources and centralized control mechanisms?
Show answer and explanation
Correct answer: A. Management plane activity logs
In the cloud, every resource is created, changed and deleted through the management plane, so its activity logs record who did what, when and from where, even after short-lived instances have disappeared. Because resources can vanish within minutes, evidence held on the resources themselves may be gone, while the control plane record persists. Responders therefore start with management plane logs to reconstruct the timeline, find compromised credentials and see which resources were touched, then move on to other telemetry.
Why the other options are wrong
- B. A network perimeter is not the single control point in a cloud deployment, and traffic monitoring does not record the configuration changes and administrative actions that explain how an incident unfolded.
- C. Endpoint protection status covers only hosts that run an agent and says nothing about changes made through the provider's APIs, which is where cloud compromises are usually visible.
- D. Physical hardware belongs to the provider and customers cannot inspect it, so it gives responders no evidence to analyze.
Question 27
Which of the following best describes a risk associated with insecure interfaces and APIs?
Show answer and explanation
Correct answer: D. Data exposure to unauthorized users
Cloud services are managed and consumed through APIs, so weak authentication, missing authorization checks, poor input validation or excessive permissions on an interface let attackers reach data and functions they should not. The characteristic outcome is exposure of data to unauthorized users, and an exposed management API can also let attackers change the environment itself. This is why API security, including strong authentication, authorization and validation, is a major theme in the CSA guidance.
Why the other options are wrong
- A. Encrypting data at rest is a protective control and not a risk, so it cannot be the consequence of an insecure interface.
- B. Interception of traffic is addressed by transport encryption and is a different threat from the access failures an insecure API creates.
- C. Higher resource consumption is at most a side effect of abuse and is not the defining risk of an insecure interface.
Question 28
What is the primary purpose of Identity and Access Management (IAM) systems in a cloud environment?
Show answer and explanation
Correct answer: B. To govern identities’ access to resources in the cloud
The primary purpose of identity and access management is to govern which identities can access which resources and what they may do with them. It does this by establishing and managing identities, authenticating them, authorizing their actions through entitlements and policies, and recording what they do. In the cloud, where identity effectively replaces the network perimeter, IAM is the foundation for enforcing least privilege across users, services and workloads.
Why the other options are wrong
- A. Encrypting data is a data security function carried out with cryptographic controls and key management, not by IAM.
- C. Watching network traffic for suspicious activity is the job of network monitoring and detection tools.
- D. Backing up cloud data is a resilience and recovery function and has nothing to do with controlling access.
Question 29
What is the primary role of Identity and Access Management (IAM)?
Show answer and explanation
Correct answer: B. Ensure only authorized entities access resources
Identity and access management establishes who or what an entity is, through identity management and authentication, and then determines what it may do, through authorization. Its primary role is to ensure that only authorized entities can reach resources, and only the resources and actions they are entitled to. In the cloud this is the main control plane for security, because access to the management plane and to data is governed by identity.
Why the other options are wrong
- A. Encryption protects the confidentiality of data and is handled by cryptographic controls and key management, not by IAM.
- C. Logging and monitoring are the job of security monitoring tools, and IAM only produces some of the events they record.
- D. Giving everyone identical access violates least privilege, which IAM exists to enforce by granting each entity only what it needs.
Question 30
In the IaaS shared responsibility model, which responsibility typically falls on the Cloud Service Provider (CSP)?
Show answer and explanation
Correct answer: B. Ensuring physical security of data centers
In IaaS the provider secures the facilities and the underlying infrastructure: physical data centers, hardware, and the virtualization layer that sits beneath the customer's workloads. Customers have no way to inspect or control the buildings, access badges, or servers, so this duty necessarily stays with the provider. Everything above the hypervisor, including guest operating systems, data protection, application code, and virtual network controls, is configured and managed by the customer.
Why the other options are wrong
- A. The customer chooses and configures encryption of the data it stores, using its own tools or the provider's key services.
- C. Application code is written and deployed by the customer, so the provider has no role in managing it in IaaS.
- D. Firewall rules for instances and virtual networks are set by the customer, since the customer defines its own traffic policy.
Question 31
What is a primary objective of cloud governance in an organization?
Show answer and explanation
Correct answer: B. To align cloud usage with corporate objectives
Governance is how an organization directs and controls its use of cloud services so that it supports the business. A primary objective is to align cloud usage with corporate objectives, making sure adoption fits strategy, risk appetite, policy and legal requirements, and that responsibilities and oversight are clearly set. Technical features of the cloud are the means through which the business benefits, and governance decides how they are used toward the organization's goals.
Why the other options are wrong
- A. Multi-tenancy and resource pooling are inherent characteristics of how providers deliver cloud services, not objectives set by an organization's governance.
- C. Scalability and automation are operational capabilities of the platform, and they are not the purpose of governing cloud use.
- D. User experience and latency are performance matters for architects and engineers, and they are not what governance primarily aims to achieve.
Question 32
What is a primary objective during the Detection and Analysis phase of incident response?
Show answer and explanation
Correct answer: B. Validating alerts and estimating the scope of incidents
The Detection and Analysis phase turns raw alerts into confirmed incidents. Analysts validate alerts to weed out false positives, determine whether an event is a real incident, and estimate its scope, such as which systems, accounts, and data are involved. That understanding then guides the containment, eradication, and recovery steps that follow.
Why the other options are wrong
- A. Writing and updating response policies belongs to the preparation phase, which takes place before incidents occur.
- C. Detailed forensic investigation comes later, once the incident is confirmed and scoped and evidence is being preserved.
- D. Segmentation and isolation are containment actions taken after the incident has been validated and scoped.
Question 33
In the context of incident response, which phase involves alerts validation to reduce false positives and estimates the incident's scope?
Show answer and explanation
Correct answer: C. Detection & Analysis
Detection and Analysis is the phase in the NIST-style incident response lifecycle where alerts are triaged. Analysts validate each alert to filter out false positives, confirm that a real incident is under way, and estimate its scope and impact on systems and data. The findings from this work drive the decisions made in later phases, so scoping must come before any containment action is chosen.
Why the other options are wrong
- A. Preparation happens before any incident and covers tools, training, and readiness, so it involves no validation of live alerts.
- B. Post-incident analysis takes place after the incident is resolved and centers on lessons learned, not on validating alerts or scoping.
- D. Containment, eradication, and recovery act on an incident that has already been confirmed and scoped, so they follow alert validation.
Question 34
Which aspect of a Cloud Service Provider's (CSPs) infrastructure security involves protecting the interfaces used to manage configurations and resources?
Show answer and explanation
Correct answer: A. Management plane
The management plane is the set of interfaces, such as the web console, APIs and command-line tools, through which configurations and resources are created, changed and controlled. Because control of it means control over the whole environment, securing those interfaces, along with the authentication and authorization behind them, is a central part of a provider's infrastructure security. Customers rely on the provider to protect this layer and must also protect their own use of it.
Why the other options are wrong
- B. Virtualization layers isolate and run workloads on shared hardware, and they are not the interfaces used to manage configurations and resources.
- C. Physical components cover the data centers and hardware, and protecting them concerns facilities and equipment rather than management interfaces.
- D. PaaS and SaaS services are service models offered to customers and do not by themselves describe the interfaces used to manage configuration.
Question 35
What is a primary benefit of using Identity and Access Management (IAM) roles/identities provided by cloud providers instead of static secrets?
Show answer and explanation
Correct answer: B. They reduce the risk of credential leakage
Workload identities and IAM roles provided by the cloud platform let a workload obtain short-lived credentials automatically, so no long-lived key or password has to be created, embedded in code, or stored in configuration. With no static secret to copy, commit, or steal, the chance of credential leakage drops sharply, and rotation happens without human effort. This is why workload identities are preferred over static secrets.
Why the other options are wrong
- A. Storage cost is unrelated to how a workload authenticates, so roles are not adopted to reduce it.
- C. Encryption is provided by separate key management and cryptographic controls, whereas a role only determines identity and permissions.
- D. A role changes how credentials are issued, and it does not make the system run faster.
Question 36
Which concept focuses on maintaining the same configuration for all infrastructure components, ensuring they do not change once deployed?
Show answer and explanation
Correct answer: D. Immutable infrastructure
With immutable infrastructure, components are never changed after deployment. To update, patch or reconfigure, a new version is built from a known image and deployed to replace the old one. This prevents configuration drift, makes every instance identical and known, and makes it easy to roll back, which strengthens security and reliability. It also removes the need for administrators to log in and modify running systems.
Why the other options are wrong
- A. Infrastructure as code defines infrastructure through code, but resources it creates can still be modified in place afterward.
- B. Application integration connects applications and services to each other and says nothing about whether deployed components are changed.
- C. Component credentials are authentication secrets and do not govern whether a deployed system's configuration stays fixed.
Question 37
Which of the following best describes the primary benefit of utilizing cloud telemetry sources in cybersecurity?
Show answer and explanation
Correct answer: B. They provide visibility into cloud environments
Cloud telemetry includes management plane logs, service and application logs, network flow and DNS logs, and metrics. Together they give security teams visibility into what is happening in the environment, who is acting, and how resources are configured and used. That visibility is the foundation for detection, investigation and compliance evidence, and it matters especially because customers cannot see the provider's underlying infrastructure and rely on these sources.
Why the other options are wrong
- A. Telemetry is information collected about activity and does not perform encryption, which is done by cryptographic controls.
- C. Physical security is the provider's responsibility for its facilities, and telemetry in the customer's environment does not strengthen it.
- D. Collecting and storing telemetry adds cost, so it is not a way to reduce what the services cost.
Question 38
What is a key component of governance in the context of cybersecurity?
Show answer and explanation
Correct answer: A. Defining roles and responsibilities
Governance establishes who is accountable for security and who makes decisions. Defining roles and responsibilities is a key component because it assigns ownership of risks, controls and decisions, sets out authority and escalation paths, and allows oversight and accountability to work. In the cloud this extends to dividing responsibilities between the customer and the provider and among internal teams. Governance sets direction through people, authority and policy, and the technical work follows from it.
Why the other options are wrong
- B. Standardizing technical specifications for controls belongs to the implementation of controls rather than to the way governance assigns authority and accountability.
- C. Choosing tools and technologies is a management and engineering decision made under governance and does not define governance itself.
- D. Enforcing penetration testing procedures is one operational security activity and not a core element of how governance is structured.
Question 39
Which Identity and Access Management (IAM) principle focuses on implementing multiple security layers to dilute access power, thereby averting a misuse or compromise?
Show answer and explanation
Correct answer: C. Segregation of Duties
Segregation of duties divides a sensitive process or privilege among several people or accounts, so no single one can complete a critical action alone. Misuse or compromise then requires collusion or the compromise of multiple accounts, because the power is spread across layers instead of concentrated. In cloud environments it is applied, for example, by separating those who administer resources from those who manage keys or approve changes.
Why the other options are wrong
- A. Continuous monitoring detects and reports activity after it happens and does not divide authority among parties.
- B. Federation lets identities from one trust domain be used in another, and it does not divide privileges among multiple parties.
- D. Least privilege limits each identity to the minimum access it needs, but it does not split a critical action across several people.
Question 40
What is the primary objective of posture management in a cloud environment?
Show answer and explanation
Correct answer: C. Continuous monitoring of configurations
Cloud security posture management continuously assesses cloud configurations against security baselines, policies and compliance requirements. It finds misconfigurations and drift in resources and services, reports them and often helps remediate. Because cloud environments change constantly and a single misconfiguration can expose data, continuous monitoring of configuration is the primary objective of posture management.
Why the other options are wrong
- A. Automating incident response is handled by orchestration and response tooling, whereas posture management finds weak configurations before incidents occur.
- B. Cost optimization is a financial management function and is separate from assessing the security state of configurations.
- D. Managing user access permissions belongs to identity and access management, which is a different discipline from assessing configuration posture.
Question 41
Which aspect of cloud architecture ensures that a system can handle growing amounts of work efficiently?
Show answer and explanation
Correct answer: A. Scalability
Scalability is the ability of a system to handle a growing amount of work by adding resources, either by making existing ones larger or by adding more instances. Cloud platforms make this practical because capacity can be added on demand. It is the property the question describes, in contrast with the other qualities, which concern protection, consistent operation or speed.
Why the other options are wrong
- B. Security is about protecting confidentiality, integrity and availability, and it does not determine how much work a system can take on as demand grows.
- C. Reliability measures whether a system operates consistently over time, so a reliable system can still be unable to absorb more load.
- D. Performance describes how fast a system responds at a given load, and a fast system may still fail to cope as the load increases.
Question 42
Which term describes the practice in cloud compliance where a customer acquires a set of pre-approved regulatory or standards-based controls from a compliant provider?
Show answer and explanation
Correct answer: D. Compliance inheritance
Compliance inheritance is the practice in which a customer relies on the controls a compliant cloud provider has already implemented and had assessed against a regulation or standard. The customer inherits those controls for the parts of the stack the provider is responsible for, instead of duplicating the work, and remains responsible for the controls on its own side of the shared responsibility model.
Why the other options are wrong
- A. Automated compliance is about using tooling to check or enforce controls, and it does not mean acquiring a provider's pre-approved controls.
- B. Attestation inheritance is not the standard term used to describe this practice in cloud compliance.
- C. Audit inheritance is not the standard term for this practice, which is called compliance inheritance.
Question 43
Which areas should be initially prioritized for hybrid cloud security?
Show answer and explanation
Correct answer: A. IAM and networking
For hybrid cloud, the first areas to secure are identity and access management and networking. Identity determines who and what can reach resources across the on-premises and cloud environments, and networking determines how traffic is connected and segmented between them. Getting these two foundations right provides the control points that every later security measure for the hybrid environment relies on.
Why the other options are wrong
- B. Data center infrastructure and architecture are on-premises concerns that do not address how identities and connections span both environments.
- C. Application development and deployment security builds on identity and network controls, so it cannot be the first area to prioritize.
- D. Storage management and governance cover only one resource type and depend on identity and network controls being in place first.
Question 44
Which of the following is a common security issue associated with serverless computing environments?
Show answer and explanation
Correct answer: D. Misconfigurations
With serverless computing the provider manages the underlying servers and the customer is left responsible for the function code, its configuration and its permissions. Misconfigurations are therefore a common security issue, for example overly permissive roles attached to functions, publicly exposed triggers or endpoints, and weak handling of secrets. Because functions are small, numerous and deployed quickly, these mistakes are easy to introduce and hard to notice without automated checks.
Why the other options are wrong
- A. Complicated pipelines are a delivery and operations concern and not the typical security weakness of serverless functions.
- B. Operating cost is a financial matter and does not describe a security problem.
- C. Serverless platforms scale automatically, so limited scalability is not a characteristic issue, and scalability is not a security weakness in any case.
Question 45
In the context of FaaS, what is primarily defined in addition to functions?
Show answer and explanation
Correct answer: D. Trigger events
A function-as-a-service workload is event driven, so besides the function code itself the customer defines the trigger events that cause it to run, such as an HTTP request, a message on a queue, an object upload or a schedule. The trigger definition is what connects the function to the rest of the application, which is why serverless security reviews examine event sources and the data they pass in as carefully as the code.
Why the other options are wrong
- A. Storage is a separate service that a function may read from or write to, and it is not defined as part of the function in the way its triggers are.
- B. Network settings such as VPC attachment are optional settings on the platform, and a function does not need them defined to exist, whereas it always needs a trigger to run.
- C. Permissions are granted through the identity and access management service, usually as a role attached to the function, rather than being a defining element of the function itself.
Question 46
Which of the following cloud computing models primarily provides storage and computing resources to the users?
Show answer and explanation
Correct answer: D. Infrastructure as a Service (IaaS)
Infrastructure as a Service is the model that delivers fundamental compute, storage, and network resources on demand, which the customer then uses to run its own operating systems and applications. The customer gets virtualized servers and storage without owning physical hardware, while the provider manages the underlying facilities and hypervisor. The other service models layer more provider-managed functionality on top of these resources.
Why the other options are wrong
- A. FaaS offers an execution environment for individual functions, and the provider hides the servers and storage from the customer.
- B. PaaS supplies a managed platform for building and running applications, so the customer does not work with raw compute and storage.
- C. SaaS delivers a finished application to end users, who have no control over the underlying compute or storage resources.
Question 47
Which of the following is used for governing and configuring cloud resources and is a top priority in cloud security programs?
Show answer and explanation
Correct answer: B. Management plane
The management plane is the set of APIs, web consoles, and services through which cloud resources are provisioned, configured, and governed. Anyone who controls it can create, change, or delete resources across the whole environment, which is why protecting it, along with strong identity controls and logging of its activity, is a top priority in a cloud security program.
Why the other options are wrong
- A. A management console is just one web interface to the management plane, while the plane itself also includes APIs and command line access.
- C. Orchestrators automate workflows that run on top of the platform, and they do not form the layer used to govern and configure resources.
- D. The abstraction layer is what hides physical hardware behind virtual resources, and it is not the interface used to govern resources.
Question 48
In the context of cloud workload security, which feature directly contributes to enhanced performance and resource utilization without incurring excess costs?
Show answer and explanation
Correct answer: D. Elasticity of cloud resources
Elasticity lets a workload grow when demand rises and shrink when it falls, with resources provisioned and released automatically and billed on measured use. This keeps performance steady during peaks while avoiding payment for idle capacity during quiet periods, which is exactly the combination of better performance and efficient utilization without excess cost. Rapid elasticity and measured service are the essential cloud characteristics that make this possible.
Why the other options are wrong
- A. Fixed allocations cannot follow demand, so capacity is either idle and paid for at low load or insufficient at peak load.
- B. Unlimited storage capacity addresses only one resource type and does nothing to match compute to demand, and unused capacity still adds cost.
- C. Adding on-premise hardware means buying capacity up front for peak load, which is the opposite of paying only for what is used.
Question 49
Which of the following strategies best enhances infrastructure resilience against Cloud Service Provider (CSP) technical failures?
Show answer and explanation
Correct answer: D. Multi-region resiliency
A cloud provider's failures can affect a data center or a whole region, so the best protection is to spread workloads and data across multiple regions, allowing service to continue from another region if one fails. Multi-region resiliency is the strategy for outages that exceed what a single location can absorb, and the customer must design and test the failover themselves.
Why the other options are wrong
- A. High availability inside one data center does not help when the entire facility, or the provider's service for it, goes down.
- B. A local backup preserves data but does not keep services running, and recovery from it is slow when the provider has a failure.
- C. Resiliency within a single region leaves the workload exposed to any outage that affects that whole region.
Question 50
Which type of controls should be implemented when required controls for a cybersecurity framework cannot be met?
Show answer and explanation
Correct answer: C. Compensating controls
A compensating control is an alternative safeguard used when a required control cannot be implemented as written, for example because of technical limits or cost. It must meet the same intent and give comparable protection against the risk the original control addressed, and it is normally documented and approved as an accepted deviation. This lets an organization remain aligned with a framework while explaining how the underlying risk is still managed.
Why the other options are wrong
- A. Detective controls find events after the fact and do not replace the protection a missing required control would have given.
- B. Preventive is a control category that describes when a control acts, not a way of substituting for a control that cannot be met.
- D. Administrative controls are a category of policy and procedure measures, and the term does not mean an equivalent substitute for a required control.
Question 51
Which of the following best describes the shift-left approach in software development?
Show answer and explanation
Correct answer: D. Integrates security early in the development process
Shift left means moving security activities to the earliest stages of the software development lifecycle, so requirements, design, threat modeling, secure coding and automated checks in the pipeline all take place before release. Problems found early are far cheaper to fix than those found in production, and developers receive feedback while the code is still fresh. Security becomes part of how software is built rather than a gate added at the end.
Why the other options are wrong
- A. Automated testing is one tool within shift left, and the approach also covers design, threat modeling and secure coding practices carried out by people.
- B. Post-deployment audits happen at the far right of the lifecycle, which is the opposite of moving security earlier.
- C. Limiting security to the testing phase leaves requirements, design and coding without security input, whereas shift left spreads it across the whole development process.
Question 52
Which component is primarily responsible for filtering and monitoring HTTP/S traffic to and from a web application?
Show answer and explanation
Correct answer: C. Web Application Firewall
A web application firewall sits in front of a web application and inspects HTTP and HTTPS requests and responses at the application layer. It can block or alert on attacks such as injection and cross-site scripting using rules and policies, which a packet or port filter cannot do because it does not understand web request content. Cloud providers offer WAFs as managed services that can be attached to load balancers, gateways or content delivery networks.
Why the other options are wrong
- A. Anti-virus software looks for malware on hosts and does not filter web traffic going to an application.
- B. A load balancer distributes requests across servers for availability and scale, and filtering web attacks is not its role.
- D. An intrusion detection system watches for suspicious activity across traffic generally and is not the dedicated control that filters web application requests.
Question 53
Which of the following functionalities is provided by Data Security Posture Management (DSPM) tools?
Show answer and explanation
Correct answer: D. Visualization and management for cloud data security
Data Security Posture Management tools discover where data resides across cloud accounts and services, classify it by sensitivity, and show how it is exposed and who can access it. This gives security teams a visual map of their data and the means to manage and improve data security posture, for example by finding unprotected sensitive data. DSPM focuses on data visibility and risk, not on enforcing network or encryption controls directly.
Why the other options are wrong
- A. Firewall configuration is a network security function, and DSPM focuses on data and not on traffic filtering.
- B. Monitoring user activity belongs to general security monitoring tools, whereas DSPM concentrates on the data and its exposure.
- C. DSPM identifies sensitive data and its protection gaps, and it does not itself encrypt all data in storage and transit.
Question 54
What is an advantage of using Kubernetes for container orchestration?
Show answer and explanation
Correct answer: B. Automation of deployment and scaling
Kubernetes is a container orchestration platform that automates the deployment, scaling, and management of containerized applications. It can schedule containers across a cluster, scale them up or down with demand, roll out updates, and restart failed containers. This reduces manual operations and gives consistent, repeatable deployments that can be described declaratively.
Why the other options are wrong
- A. Kubernetes runs on many infrastructures and environments, so it widens deployment choices.
- C. Containers and Kubernetes abstract the underlying hardware, which lowers dependence on specific machines.
- D. Kubernetes is designed to replace manual resource handling with automated scheduling and management.
Question 55
In a containerized environment, what is fundamental to ensuring runtime protection for deployed containers?
Show answer and explanation
Correct answer: D. Implementing real-time visibility
Containers are short-lived and share a host kernel, so runtime protection depends on seeing what is happening inside and around them as they run: processes, system calls, file changes and network connections. Real-time visibility allows teams to detect abnormal behavior, such as an unexpected process or outbound connection, and respond quickly. Without it, other measures applied before deployment cannot show what a container is doing in production.
Why the other options are wrong
- A. Signature-based antivirus scanning detects only known malware and gives no view of how a container behaves as it runs.
- B. Capturing full network packets shows traffic but not the processes and file activity inside the container and on the host.
- C. Static code analysis runs in the build pipeline before deployment, so it cannot observe a running container.
Question 56
Which principle reduces security risk by granting users only the permissions essential for their role?
Show answer and explanation
Correct answer: C. Least-Privileged Access
Least privilege means giving each user, role, or workload only the permissions needed to perform its function, and nothing more. Limiting permissions this way shrinks the attack surface and the damage that can result from a compromised account or an error. Other access models, such as role-based control, can be used to implement it, but least privilege is the principle that sets the permission level.
Why the other options are wrong
- A. Mandatory Access Control enforces system-defined labels and clearances, and it is not defined by granting only the permissions a role needs.
- B. Unlimited access grants everything, which maximizes risk and contradicts the aim of limiting permissions.
- D. Role-Based Access Control is a mechanism for assigning permissions through roles, and roles can still be given more access than the job requires.
Question 57
Which cloud service model requires the customer to manage the operating system and applications?
Show answer and explanation
Correct answer: C. Infrastructure as a Service (IaaS)
In IaaS the provider supplies the underlying compute, storage and network, along with the virtualization layer, while the customer deploys and manages the operating system, middleware and applications on top. That is why IaaS customers carry the most security responsibility of the three standard service models, including patching the guest operating system and securing what they run on it. PaaS and SaaS move progressively more of that stack to the provider.
Why the other options are wrong
- A. In PaaS the provider runs the operating system and platform, and the customer manages its own application and data.
- B. Network as a Service is not one of the three standard NIST service models, and it supplies network connectivity rather than a place where the customer runs an operating system and applications.
- D. In SaaS the provider runs the entire application stack, so the customer manages neither the operating system nor the application itself.
Question 58
Which best practice is recommended when securing object repositories in a cloud environment?
Show answer and explanation
Correct answer: D. Encrypting all objects in the repository
The recommended practice for object repositories is to encrypt every object, usually through the provider's storage encryption with customer-managed keys where the risk warrants it. Encrypting everything removes dependence on correctly classifying each object first, so a mislabeled or newly added object is never left exposed. Encryption also protects data if access controls are misconfigured or someone reaches the underlying storage, so it is layered together with access controls and not replaced by them.
Why the other options are wrong
- A. Encrypting only the access paths protects data in transit but leaves the stored objects themselves unprotected at rest.
- B. Access controls are easy to misconfigure, and relying on them alone leaves data readable once they fail or are bypassed.
- C. Encrypting only the objects judged sensitive depends on accurate classification, so any misjudged or new object is left unprotected.
Question 59
Which of the following is a primary purpose of establishing cloud risk registries?
Show answer and explanation
Correct answer: D. Identify and manage risks associated with cloud services
A cloud risk registry is a central record where an organization identifies, documents and tracks the risks that come with using cloud services. Each entry typically captures the risk, its likelihood and impact, the owner and the treatment decision. Keeping this record supports governance by showing leadership which cloud risks exist, how they are being managed and where accountability lies, and it lets the organization review risks as its cloud use changes.
Why the other options are wrong
- A. SLAs are contract commitments negotiated with the provider and are not what a risk registry is for.
- B. Watching live performance is an operational monitoring task and has no connection to recording risks.
- C. Managing account credentials is an identity administration task and not a purpose of a risk registry.
Question 60
Which of the following from the governance hierarchy provides specific goals to minimize risk and maintain a secure environment?
Show answer and explanation
Correct answer: B. Control objectives
The cloud governance hierarchy runs from policies down to control objectives, control specifications and implementation guidance. Control objectives sit just below policy and state the specific goals that must be met to reduce risk and keep the environment secure. They turn the broad direction in policy into outcomes the organization can measure, and the more detailed levels below them then define how those outcomes are achieved.
Why the other options are wrong
- A. Implementation guidance sits at the bottom of the hierarchy and explains how to carry out controls, not what goals to meet.
- C. Policies give broad direction at the top of the hierarchy and do not state the specific goals that control objectives set.
- D. Control specifications describe the detailed requirements for a control and come after the goals have been set by control objectives.
Question 61
Which technique is most effective for preserving digital evidence in a cloud environment?
Show answer and explanation
Correct answer: D. Taking snapshots of virtual machines
In the cloud, a snapshot of a virtual machine's storage lets responders capture the state of the instance at the moment of the incident without relying on physical access. The copy can be preserved, protected and analyzed in an isolated forensic environment while the original is left unaltered, which supports evidence integrity and chain of custody. Because instances can be terminated or scaled away quickly, taking the snapshot early is the practical way to keep evidence that would otherwise disappear.
Why the other options are wrong
- A. Management plane logs help reconstruct what happened, but they are records of activity and do not preserve the state of the affected machine.
- B. Routine backups are meant for recovery, are taken on a schedule rather than at the time of the incident, and are not handled as controlled evidence.
- C. Isolation contains the incident and limits further damage, but it does not by itself create a preserved copy of the evidence.
That was 61 of 244.
The full CSA CCSK v5 pack has all 244 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 103 free as one PDF by email. Get the Half Pack →