CSA Cert CCSK Practice Exams
Last updated on Oct 22,2026- Exam Code: CCSK
- Exam Name: Certificate of Cloud Security Knowledge
- Certification Provider: CSA Cert
- Latest update: Oct 22,2026
CCM: A hypothetical company called: “Health4Sure” is located in the United States and provides cloud based services for tracking patient health. The company is compliant with HIPAA/HITECH Act among other industry standards. Health4Sure decides to assess the overall security of their cloud service against the CCM toolkit so that they will be able to present this document to potential clients.
Which of the following approach would be most suitable to assess the overall security posture of Health4Sure’s cloud service?
- A . The CCM columns are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.
- B . The CCM domain controls are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company’s overall security posture in an efficient manner.
- C . The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.
An important consideration when performing a remote vulnerability test of a cloud-based application is to
- A . Obtain provider permission for test
- B . Use techniques to evade cloud provider’s detection systems
- C . Use application layer testing tools exclusively
- D . Use network layer testing tools exclusively
- E . Schedule vulnerability test at night
CCM: A company wants to use the IaaS offering of some CSP.
Which of the following options for using CCM is NOT suitable for the company as a cloud customer?
- A . Submit the CCM on behalf of the CSP to CSA Security, Trust & Assurance Registry (STAR), a free, publicly accessible registry that documents the security controls provided by CSPs
- B . Use CCM to build a detailed list of requirements and controls that they want their CSP to implement
- C . Use CCM to help assess the risk associated with the CSP
- D . None of the above
In the IaaS shared responsibility model, which responsibility typically falls on the Cloud Service Provider (CSP)?
- A . Encrypting data at rest
- B . Ensuring physical security of data centers
- C . Managing application code
- D . Configuring firewall rules
B
Explanation:
In the Infrastructure as a Service (IaaS) shared responsibility model, the Cloud Service Provider (CSP) is typically responsible for securing the physical infrastructure, which includes the physical security of data centers, servers, networking hardware, and the physical security controls that protect them from unauthorized access or damage.
Encrypting data at rest is typically the responsibility of the consumer, though the CSP may offer tools to help with this. Managing application code is the responsibility of the consumer, as they control and deploy the applications on the infrastructure provided by the CSP. Configuring firewall rules is also the responsibility of the consumer, as they manage the configuration of the virtual network, including security rules like firewalls.
Which cloud-based service model enables companies to provide client-based access for partners to databases or applications?
- A . Platform-as-a-service (PaaS)
- B . Desktop-as-a-service (DaaS)
- C . Infrastructure-as-a-service (IaaS)
- D . Identity-as-a-service (IDaaS)
- E . Software-as-a-service (SaaS)
In the context of incident response, which phase involves alerts validation to reduce false positives and estimates the incident’s scope?
- A . Preparation
- B . Post-Incident Analysis
- C . Detection & Analysis
- D . Containment, Eradication, & Recovery
C
Explanation:
The Detection & Analysis phase of incident response involves the validation of alerts to reduce false positives and estimating the scope of the incident. During this phase, security teams assess whether the alerts indicate an actual incident, investigate the nature and severity of the threat, and determine the affected systems, data, and potential impact. This phase is critical for accurately identifying the scope of the issue and ensuring appropriate actions are taken in subsequent phases, such as containment and eradication.
What are the primary security responsibilities of the cloud provider in compute virtualizations?
- A . Enforce isolation and maintain a secure virtualization infrastructure
- B . Monitor and log workloads and configure the security settings
- C . Enforce isolation and configure the security settings
- D . Maintain a secure virtualization infrastructure and configure the security settings
- E . Enforce isolation and monitor and log workloads
In the cloud provider and consumer relationship, which entity manages the virtual or abstracted infrastructure?
- A . Only the cloud consumer
- B . Only the cloud provider
- C . Both the cloud provider and consumer
- D . It is determined in the agreement between the entities
- E . It is outsourced as per the entity agreement
If in certain litigations and investigations, the actual cloud application or environment itself is relevant to resolving the dispute in the litigation or investigation, how is the information likely to be obtained?
- A . It may require a subpoena of the provider directly
- B . It would require a previous access agreement
- C . It would require an act of war
- D . It would require a previous contractual agreement to obtain the application or access to the environment
- E . It would never be obtained in this situation
What type of logs record interactions with specific services in a system?
- A . (Service and Application Logs
- B . Security Logs
- C . Network Logs
- D . Debug Logs
A
Explanation:
Service and Application Logs record interactions with specific services within a system. These logs track how users and systems interact with various applications and services, such as API calls, service requests, and responses. They are essential for monitoring service performance, troubleshooting issues, and auditing service usage.
Security Logs primarily focus on security-related events, such as unauthorized access attempts or security breaches. Network Logs capture network traffic data and information about the movement of data across a network. Debug Logs are typically used for debugging purposes and may include detailed technical information, but they do not specifically track service interactions like service and application logs do.