ExamFinch.com My Study

Cheat sheet

Alibaba CSA-C01 Cheat Sheet

Practice this exam

Cloud Security Basics

  • 8% of exam
  • Shared Responsibility MLPS Threats Risk Treatment IR Lifecycle

Identity + Access

  • 18% of exam
  • RAM STS MFA SSO Resource Directory

Host + Operations

  • 24% of exam
  • Security Center Bastionhost ActionTrail Log Service Cloud Config

Data Protection

  • 22% of exam
  • KMS Secrets Manager OSS Encryption RDS TDE SDDP

Network Security

  • 28% of exam
  • Security Groups Network ACLs Cloud Firewall WAF Anti-DDoS

Quick Facts

  • Exam CSA-C01
  • Credential Cloud Security Engineer
  • Questions 50 MCQ
  • Time 90 min
  • Pass 70/100
  • Fee $200 USD
  • Language English
  • Delivery Pearson VUE
  • Retake 14 days
  • Replaces ACA Cloud Security

Exam Basics BA

  • CSA-C01 Current security exam
  • ACA Security Retired predecessor
  • Associate Entry practitioner level
  • Scenario focus Choose correct service
  • No prereq Cloud basics recommended
  • Pearson VUE Online or center
  • Nonrefundable Fee not returned
  • Course Eight Academy chapters

Security Basics BA

  • Shared model Provider plus customer
  • Alibaba owns Facilities hypervisor platform
  • Customer owns Data identities config
  • ECS customer Guest OS patches
  • Defense depth Layered cloud controls
  • Least privilege Minimum necessary access
  • MLPS China protection levels
  • ISO 27001 ISMS evidence

Secure Architecture BA

  • Private subnets Hide internal services
  • WAF entry Protect web ingress
  • Firewall egress Restrict outbound paths
  • No public DB Use private access
  • Tagged assets Scope policy audits
  • Central logs Preserve evidence
  • Break-glass Emergency admin path
  • Pen test notice Notify before testing

RAM Policy Core ID

  • EARC: Effect Action Resource Condition
  • Effect Action Resource Condition

RAM User vs Role ID

RAM user

  • Long-term identity
  • Human or workload
  • Can hold AccessKeys

RAM role

  • Assumed identity
  • Temporary STS tokens
  • Cross-account access
  • Static vs assumed

Identity Picker ID

  • Daily human admin → RAM user ( MFA required )
  • Many similar users → User group ( Attach policies )
  • Cross-account access → RAM role ( Trust policy )
  • App needs OSS → STS ( Temporary token )
  • Corporate login → SSO ( Federated access )
  • Many accounts → Resource Directory ( Central governance )
  • Maximum permissions → Control policy ( Guardrail )
  • API secret found → Rotate AccessKey ( Check ActionTrail )

RAM Core ID

  • Root account Account-level identity
  • RAM user Person or workload
  • User group Policy assignment set
  • RAM role Assumable identity
  • System policy Alibaba-managed policy
  • Custom policy Customer-authored policy
  • Implicit deny Default no access
  • Explicit Deny Overrides any Allow

System vs Custom Policy ID

System policy

  • Alibaba managed
  • Broad common access
  • Updated by provider

Custom policy

  • Customer authored
  • Fine-grained scope
  • Maintained by customer
  • Managed vs tailored

RAM Governance ID

  • STS Temporary scoped credentials
  • AccessKey Long-lived API secret
  • MFA Second login factor
  • SAML SSO Corporate identity federation
  • OIDC Token-based federation
  • Resource Directory Multi-account hierarchy
  • Control policy Account permission guardrail
  • Condition Context-based restriction

Ops Evidence Chain HO

  • Access, events, logs, config
  • Bastionhost ActionTrail Log Service Cloud Config

ActionTrail vs Log Service HO

ActionTrail

  • Control-plane events
  • Console API activity
  • Audit evidence

Log Service

  • Log analytics
  • Dashboards alerts
  • Multi-source logs
  • Events vs analytics

Operations Picker HO

  • Host risk posture → Security Center
  • Hardening drift → Baseline check
  • Admin shell access → Bastionhost
  • Trace API call → ActionTrail
  • Search security logs → Log Service
  • Detect config drift → Cloud Config
  • Protect object data → OSS SSE-KMS
  • Rotate app secret → Secrets Manager

Host Operations HO

  • Security Center Host threat posture
  • Vulnerability scan Find missing fixes
  • Baseline check Hardening drift detection
  • Webshell detection Malicious script finding
  • Malware alert Suspicious file signal
  • Ransomware defense Backup and detection
  • Image scan Container risk finding
  • Proactive defense Higher edition feature

Audit + Logging HO

  • Bastionhost Privileged access gateway
  • Session recording Replay admin activity
  • Command audit Track risky commands
  • ActionTrail API console events
  • Event lookup Who did what
  • Log Service Central log analytics
  • Log alert Detection notification
  • Cloud Config Configuration compliance rules

Data Lock Stack DA

  • Keys, secrets, encryption, immutability
  • KMS Secrets Manager SSE-KMS WORM

KMS vs Secrets Manager DA

KMS

  • Cryptographic keys
  • Envelope encryption
  • Service integrations

Secrets Manager

  • Passwords tokens
  • Secret rotation
  • Application retrieval
  • Keys vs secrets

Data Security DA

  • KMS Managed key service
  • CMK Customer master key
  • Data key Encrypts actual data
  • Envelope encryption CMK wraps data keys
  • BYOK Import customer key
  • Key rotation Limit key lifetime
  • HSM Hardware key protection
  • Scheduled deletion Delayed key destruction

Storage + Database DA

  • Secrets Manager Rotate application secrets
  • OSS SSE Server-side object encryption
  • SSE-KMS KMS-backed OSS encryption
  • Block Public Access Prevent public buckets
  • Bucket policy Object access rules
  • OSS WORM Immutable retention
  • RDS TDE Database at-rest encryption
  • RDS SSL Encrypted database transport

Edge Defense Triad NE

  • Flood, web exploit, traffic policy
  • Anti-DDoS WAF Cloud Firewall

Security Group vs ACL NE

Security group

  • Stateful rules
  • Instance or ENI
  • Workload firewall

Network ACL

  • Stateless rules
  • Subnet boundary
  • Extra segmentation
  • Instance vs subnet

Network Picker NE

  • Instance port control → Security group ( Stateful )
  • Subnet-wide control → Network ACL ( Stateless )
  • Central firewalling → Cloud Firewall ( Policy hub )
  • HTTP exploit attempts → WAF ( Layer seven )
  • Traffic flood → Anti-DDoS ( Scrubbing )
  • Bot abuse → Bot Management ( Behavior rules )
  • No public path → Private endpoint ( Internal access )
  • TLS offload → SLB certificate ( HTTPS entry )

Network Controls NE

  • Security group Stateful instance firewall
  • Network ACL Stateless subnet control
  • VPC Private network boundary
  • vSwitch Zone subnet segment
  • Route table Traffic path rules
  • Private endpoint No public internet
  • Internal endpoint Alibaba backbone access
  • SLB TLS Managed certificate termination

WAF vs Anti-DDoS NE

WAF

  • HTTP inspection
  • SQLi XSS bots
  • Application layer

Anti-DDoS

  • Traffic scrubbing
  • Flood protection
  • Availability defense
  • Exploit vs flood

Edge Defense NE

  • Cloud Firewall Central traffic control
  • Internet firewall North-south policy
  • VPC firewall East-west policy
  • IPS Inline threat blocking
  • WAF HTTP attack defense
  • Managed rules OWASP protections
  • Bot Management Automated abuse control
  • Anti-DDoS Volumetric flood scrubbing

Cloud Firewall vs Security Group NE

Cloud Firewall

  • Central policy
  • IPS intelligence
  • Cross-boundary logs

Security group

  • Distributed rules
  • Port allowlist
  • No managed IPS
  • Central vs local

Common Traps

Current vs Retired Exam

  • CSA-C01 current ≠ ACA Security retired

Customer vs Provider

  • Guest OS customer ≠ Hypervisor Alibaba

Temporary vs Permanent Credentials

  • STS temporary ≠ AccessKey long-lived

HTTP Exploit vs Flood

  • WAF blocks SQLi ≠ Anti-DDoS absorbs floods

Stateful vs Stateless

  • Security group stateful ≠ Network ACL stateless

Audit vs Access

  • ActionTrail records events ≠ Bastionhost controls sessions

Keys vs Secrets

  • KMS manages keys ≠ Secrets Manager rotates secrets

Evidence vs Deletion

  • Preserve logs first ≠ Do not delete trails

Last Minute

  • 1. Memorize 50 questions format
  • 2. Use CSA-C01 facts only
  • 3. Root account needs MFA
  • 4. Prefer roles plus STS
  • 5. Explicit Deny always wins
  • 6. Security groups are stateful
  • 7. Network ACLs are stateless
  • 8. WAF protects HTTP apps
  • 9. Anti-DDoS handles floods
  • 10. ActionTrail answers who did
  • 11. KMS enables envelope encryption
  • 12. Preserve logs during incidents

Alibaba Cloud Security Engineer (Associate)

  • Practice Questions 106 questions Study Guide 6 topics Cheat Sheet 88 facts Flashcards 50 cards Shorts 2 short s Blogs 1 blog Podcast