Free Certificate of Cloud Security Knowledge v5 (CCSK) practice test: 30 questions with answers

IaaS gives the customer control over the operating system, middleware, and applications while the provider runs the underlying compute, storage, and network. SaaS and PaaS shift more of the stack to the provider, and a private cloud is a deployment model, not a service model.

NIST SP 800-145 lists on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service as the essential characteristics. Dedicated hardware per tenant runs against resource pooling and is not on that list, while the other three options are among the five characteristics.

In IaaS the customer manages the guest operating system and its patches, along with the virtual network controls applied to its own instances. The provider handles physical facilities, the hypervisor, and hardware such as storage disks, so those three options are wrong.

An acceptable use and approved services policy sets which cloud services may be used and which data classes they can handle. The other options govern travel costs, recovery testing, and invoice approvals, so they do not control cloud service adoption.

ISO/IEC 27017 gives cloud-specific guidance that builds on ISO/IEC 27002 for both sides of the cloud relationship. ISO/IEC 27018 focuses on protecting personal data in public clouds, ISO 9001 covers quality management, and ISO/IEC 27035 covers incident management, so each of those is the wrong answer here.

A standard sets mandatory, specific technical requirements that implement a policy. A guideline is advisory, a procedure is a sequence of steps, and a policy states high-level intent, so none of those three sets mandatory technical specifications on its own.

A SOC 2 Type II report tests whether controls operated effectively across a period, which matches the request. A SOC 2 Type I report only covers design at one point in time, a SOC 1 report targets financial reporting controls, and a penetration test is a point-in-time technical test rather than an attestation of controls.

Insurance moves part of the financial impact of a risk to another party, which is risk transfer. Accepting the risk, avoiding it by removing the activity, or mitigating it with controls are different treatment options that do not shift the financial exposure.

GDPR Chapter V requires a lawful transfer basis, such as an adequacy decision or appropriate safeguards like standard contractual clauses, for transfers outside the EU. A SOC 2 report is an audit attestation rather than a transfer mechanism, and uptime reporting and paper copies do not address the transfer rules.

A central inventory of cloud accounts with named owners makes every subscription visible and accountable for security. Penetration tests, training, and single-provider rules are useful practices, but none of them would reveal unknown subscriptions or who is responsible for them.

Separation of duties ensures that no single person can both perform a sensitive action and approve it. Least privilege limits what an account can do but does not split the request and approval steps, while defense in depth and obscurity address different concerns.

Third-party risk management due diligence evaluates a supplier's security posture and contract terms before and during the relationship. Penetration testing looks for technical flaws rather than contract terms, capacity planning concerns performance, and a post-mortem happens after an incident.

Federated single sign-on delegates authentication to the corporate identity provider, so the application receives assertions or tokens rather than passwords. Shared accounts, local accounts, and embedded keys all add credential sprawl and do not rely on the corporate directory.

OAuth 2.0 is a delegated authorization framework that issues tokens granting scoped access to a resource. Issuing identity assertions is the job of OpenID Connect, which sits on top of OAuth 2.0, while directory services and encryption standards are unrelated to OAuth's role.

Attribute-based access control evaluates attributes of the user, resource, and context against policy, so it avoids a role explosion. Role-based control keys on roles alone, discretionary control lets owners decide without central policy, and a shared admin account removes accountability entirely.

Consistent timestamps depend on every log source using the same trusted clock, typically through NTP. Larger log files, encryption keys, or reduced logging do not correct clock skew, and turning logging off actually removes evidence.

A SIEM aggregates logs and events from many sources and correlates them to detect and alert on threats. Key management, patch management, and identity services are separate functions that a SIEM does not perform.

Control plane audit logs record management API calls such as creating users or changing permissions, along with the caller identity and time. Web access, slow query, and disk usage records describe application or resource activity and would not show the identity change.

A stateful filter records connection state, so reply traffic for an allowed session matches without its own rule. The first option reverses the two behaviours, the third claims stateless filtering is always safer, and the fourth ignores what state tracking does.

Micro-segmentation restricts east-west traffic so each workload can reach only the services it needs, which blocks unnecessary paths between tiers. Public addresses, shared passwords, and disabled firewalls all widen reachability or weaken control instead of narrowing it.

Containers isolate processes within a shared host kernel, whereas a VM includes its own guest kernel behind a hypervisor boundary. The other options invert the kernel relationship or make claims about hardware and scanning that are not true of containers.

Least privilege requires the function's role to grant only the access its task needs, so narrowing the role to one bucket fixes the exposure. Separation of duties, defense in depth, and availability are real principles, but none of the other options describes the over-broad permission or fixes it.

Customer-managed keys let the customer disable or revoke a key, which blocks decryption by the provider. Provider-managed keys stay under provider control, and keys stored beside the data or compiled into binaries are exposed and cannot be revoked independently.

Tokenization swaps the sensitive value for a random token, and only the vault can map the token back to the original. Hashing cannot be reversed to recover the value, encryption is reversible mathematically with the key, and compression is not a protection technique.

Software composition analysis inventories third-party components and checks them against known vulnerabilities, and running it in the pipeline shifts that check earlier. Runtime protection, dynamic testing of production, and annual pen test reviews all act later in the lifecycle and do not inspect bundled libraries at build time.

Threat modeling examines design artifacts such as data flows and trust boundaries to find threats early, when fixes are cheapest. Static analysis works on written code, load testing measures capacity, and scanning production hosts finds issues only after deployment.

In multi-tenant SaaS, customers usually work through logs, exports, and support terms that the contract defines, since host-level access would expose other tenants. Demanding data center access, imaging shared hypervisors, or waiting for an annual audit are not realistic or timely responses.

RPO sets how much recent data the organization can afford to lose, expressed as an interval before the failure. Restore time is the recovery time objective (RTO), uptime percentage is an SLA figure, and backup count is a retention choice rather than a recovery target.

Zero Trust verifies every request using identity, device, and context, and it assumes compromise so that access is limited and segmented. Trusting internal traffic, standing admin rights, and a single VPN as the main control all contradict those principles.

Prompt injection occurs when crafted input changes how the model follows its instructions, so it is specific to AI-enabled applications. Expired certificates, unpatched hypervisor modules, and duplicate DNS records are general infrastructure issues unrelated to how a model interprets input.