Certificate of Cloud Security Knowledge v5 (CCSK)

Last checked November 10, 2026 against the official Cloud Security Alliance exam page.

1. Question 1Cloud Computing Concepts & Architectures

   A company rents virtual machines and block storage from a cloud provider. Its own team installs and manages the guest operating system, middleware, and application code. Which service model does this describe?

   1. ASoftware as a Service (SaaS)
   2. BPlatform as a Service (PaaS)
   3. CInfrastructure as a Service (IaaS)
   4. DPrivate cloud deployment model for internal teams
   Show answer and explanationHide answer

   Correct answer: C

   IaaS gives the customer control over the operating system, middleware, and applications while the provider runs the underlying compute, storage, and network. SaaS and PaaS shift more of the stack to the provider, and a private cloud is a deployment model, not a service model.

2. Question 2Cloud Governance

   Staff in several departments have been signing up for file-sharing and project tools without security review, and some are storing customer records in them. Which policy would most directly define which cloud services are approved and what data they may hold?

   1. ACloud acceptable use and approved services policy
   2. BQuarterly disaster recovery exercise schedule
   3. CEmployee travel and expense reimbursement standard
   4. DVendor invoice approval procedure
   Show answer and explanationHide answer

   Correct answer: A

   An acceptable use and approved services policy sets which cloud services may be used and which data classes they can handle. The other options govern travel costs, recovery testing, and invoice approvals, so they do not control cloud service adoption.

3. Question 3Risk, Audit, & Compliance

   A customer's procurement team wants independent evidence that a SaaS provider's security controls operated effectively over a review period, not just that they were designed correctly on paper. Which assurance report should the team request?

   1. ASOC 1 Type I report on financial reporting controls
   2. BSOC 2 Type I report for a single date
   3. CPenetration test summary from the last quarter
   4. DSOC 2 Type II report covering a review period
   Show answer and explanationHide answer

   Correct answer: D

   A SOC 2 Type II report tests whether controls operated effectively across a period, which matches the request. A SOC 2 Type I report only covers design at one point in time, a SOC 1 report targets financial reporting controls, and a penetration test is a point-in-time technical test rather than an attestation of controls.

4. Question 4Organization Management

   Finance discovers several cloud subscriptions it paid for, but no security team member knew they existed or who owned them. Which organizational control would most directly have prevented this gap?

   1. AQuarterly penetration tests of the main production application
   2. BA central inventory of cloud accounts with named owners
   3. CAnnual security awareness training for all developers
   4. DMandatory use of one cloud provider across departments
   Show answer and explanationHide answer

   Correct answer: B

   A central inventory of cloud accounts with named owners makes every subscription visible and accountable for security. Penetration tests, training, and single-provider rules are useful practices, but none of them would reveal unknown subscriptions or who is responsible for them.

5. Question 5Identity & Access Management

   A company wants employees to sign in to a new cloud application with their corporate directory credentials, while the application never stores those passwords. Which approach best meets this requirement?

   1. ALocal user accounts created separately in each application
   2. BFederated single sign-on using SAML or OpenID Connect
   3. CHard-coded API keys stored in the application source code
   4. DShared service account with a password stored in a wiki
   Show answer and explanationHide answer

   Correct answer: B

   Federated single sign-on delegates authentication to the corporate identity provider, so the application receives assertions or tokens rather than passwords. Shared accounts, local accounts, and embedded keys all add credential sprawl and do not rely on the corporate directory.