CCSK v5 Cheat Sheet

Cloud Computing Concepts & Architectures

Not published of exam
NIST SP 800-145 & Shared Responsibility Cloud Models Shared Responsibility Management Plane

Cloud Governance

Not published of exam
Governance, Responsibility and Oversight Policy Hierarchy Decision Rights Risk Ownership

Risk, Audit & Compliance

Not published of exam
Governance, CCM, CAIQ & STAR CCM CAIQ STAR Assurance

Organization Management

Not published of exam
Organization, Tenancy and Shared Services Tenancy Hierarchy Shared Services Hybrid Governance

Identity & Access Management

Not published of exam
Federated IAM, OIDC, SCIM & PAM Federation Least Privilege SCIM Lifecycle

Security Monitoring

Not published of exam
Cloud Telemetry, CSPM & Log Integrity Audit Logs Posture Runtime Detection

Infrastructure & Networking

Not published of exam
Virtualization, SDN, VPC & SDP SDN Segmentation Provider Infrastructure

Cloud Workload Security

Not published of exam
Containers, Kubernetes, Serverless & CNAPP VM Images Containers Serverless

Data Security

Not published of exam
Data Lifecycle, Storage & Key Management Encryption Key Management Lifecycle

Application Security

Not published of exam
DevSecOps, Pipeline & API Security Secure SDLC API Authorization Pipeline Credentials

Incident Response & Resilience

Not published of exam
Cloud Incident Response Containment Forensic Evidence Recovery Objectives

Related Technologies & Strategies

Not published of exam
Zero Trust, SASE and AI Zero Trust SASE AI Security

Quick Facts

Certificate CCSK v5 (Cloud Security)
Administrator Cloud Security Alliance (CSA)
Exam Format 60 open-book online MCQs
Time Limit 120 minutes, uninterrupted (CCSK v5)
Passing Score 80% (48 of 60 correct)
Token Attempts 2 attempts valid 2 years
Prerequisites None required
Validity Does not expire (no CPEs)

NIST 800-145 Cloud Model (5-3-4) CO

5 characteristics, 3 service models, 4 deployment models
5: On-demand, Network, Pooling 5: Elasticity, Measured service 3: IaaS, PaaS, SaaS 4: Public, Private, Community, Hybrid

IaaS vs PaaS vs SaaS Responsibility CO

IaaS Customer Owns

Guest OS and kernel patching
Virtual network firewall rules
Apps, IAM, and customer data

Typical Managed-Service Responsibilities

CSP patches OS and runtime
PaaS: app code, IAM, data
SaaS: tenant config, IAM, data
Verify each service’s shared-responsibility matrix

NIST SP 800-145 & Shared Responsibility CO

Five Essential Characteristics On-demand, network, pooling, elasticity, measured NIST 800-145
Four Deployment Models Public, Private, Community, and Hybrid
IaaS Customer Scope Guest OS, network, apps, IAM, data
PaaS Customer Scope App code, config, IAM, data
SaaS Customer Scope Data governance, tenant config, user IAM
Management Plane (Metastructure) Administers resources within granted permission scope Top target

Governance, Responsibility and Oversight GO

Policy vs Procedure Required outcome vs operational implementation steps
Shared Responsibility Matrix Assign provider/customer controls per service
Service-Level Agreement Contracted commitments; verify exclusions and remedies
Risk Acceptance Authorized owner accepts documented residual risk

CSA STAR Level 1 vs STAR Level 2 RI

STAR Level 1

CAIQ self-assessment based on CCM
Optional automated CAIQ validation
No independent Level 2 audit

STAR Level 2

Independent third-party audit
Certification: ISO 27001 + CCM
Attestation: SOC 2 + CCM
C-STAR: GB/T 22080 + CCM
Self-assessment/validation vs independent assurance

Governance, CCM, CAIQ & STAR RI

Regulatory Accountability Rule Outsourcing tasks retains applicable customer duties
CSA Cloud Controls Matrix (CCM) 207 controls across 17 security domains CCM v4.1, 2026
CAIQ Questionnaire Standardized provider self-assessment on CCM
STAR Level 1 Public CAIQ self-assessment based on CCM
STAR Level 2 ISO27001/SOC2/C-STAR audits with CCM
ENISA 2009 Supplementary Risk Context Lock-in, governance loss, isolation failure

Compliance, SOC Reports and Jurisdiction RI

Compliance Inheritance Provider evidence; customer controls remain separate
SOC 2 Type I vs II Point-in-time design vs period effectiveness
SOC 3 Report General-use report; less detailed evidence
Data Residency vs Sovereignty Physical location vs governing legal jurisdiction

Organization, Tenancy and Shared Services OR

Provider Organization Hierarchy Govern accounts/subscriptions through provider-specific hierarchy
Policy Inheritance Parent controls apply within defined scope
Organization Shared Services Owned identity, logging, security and connectivity
Hybrid and Multi-Cloud Governance Common outcomes; verify each implementation separately
Cloud Center of Excellence (CCoE) Cross-functional team setting cloud guardrails
Rehost vs Replatform vs Refactor Lift-and-shift IaaS vs PaaS vs cloud-native

Cloud Identity Protocol Roles IA

SAML XML SSO, OIDC JWT authn, OAuth authz, SCIM lifecycle
SAML 2.0: XML SSO OIDC: JWT authentication OAuth 2.0: API authorization SCIM: automated provisioning

Cloud IAM & Federation Protocol Picker IA

Enterprise browser SSO using XML assertions → Use SAML 2.0 federation
Modern mobile/SPA authentication with JWTs → Use OpenID Connect (OIDC)
Delegated API authorization without sharing password → Use OAuth 2.0 access tokens
Automated joiner-mover-leaver SaaS account deprovisioning → Use SCIM REST/JSON provisioning
Sprawling multi-cloud roles and unused permissions → Review roles/attributes; right-size with CIEM

Federated IAM, OIDC, SCIM & PAM IA

IdP vs Relying Party (SP) IdP authenticates; SP enforces local access
SAML 2.0 XML assertions for browser enterprise SSO
OAuth 2.0 vs OIDC Delegated API authorization vs JWT authentication
SCIM Protocol REST/JSON automated user lifecycle provisioning
ABAC & CIEM Attribute policies; effective-permission analysis
Just-in-Time (JIT) PAM Temporary privilege through controlled approval

CSPM vs CDR / CWPP MO

CSPM

Checks control-plane API configuration state
Finds open buckets and IAM drift
Static posture benchmark compliance

CDR & CWPP

Monitors active runtime behavior/telemetry
Protects VMs, containers, and FaaS
Detects live credential/workload attacks
Static misconfiguration vs live runtime threat

Cloud Security Tooling Selector MO

Detecting public buckets or permissive IAM → Use CSPM posture scanning
Detecting active API credential abuse runtime → Use CDR runtime telemetry analytics
Protecting VMs, containers, and serverless runtimes → Use CWPP (or unified CNAPP)
Blocking unsanctioned Shadow IT SaaS uploads → Use CASB in Inline Proxy mode
Restricting exposure to authenticated authorized users → Deploy Software-Defined Perimeter (SDP)

Cloud Telemetry, CSPM & Log Integrity MO

Management Plane Audit Logs Record API calls and IAM changes
VPC Network Flow Logs IP/port metadata without packet payloads
CSPM (Posture Management) Detects cloud API/resource misconfigurations continuously
CDR (Detection & Response) Detects active runtime attacks in telemetry
Isolated Logging Account Separate administration; protected retention; integrity validation
Alert on Audit Tampering Monitor logging changes and collection gaps
AI-Assisted Security Monitoring Correlate anomalies; validate evidence and decisions

Virtualization, SDN, VPC & SDP IN

Type 1 Bare-Metal Hypervisor Enforces tenant CPU/RAM isolation directly
VM Escape Attack Breaking out of guest to hypervisor
Software-Defined Networking (SDN) Separates control plane from data plane
Microsegmentation Granular rules blocking east-west lateral movement
AWS Security Groups vs Network ACLs Stateful return allowance; independent ACL directions
Software-Defined Perimeter (SDP) Authenticate before authorizing protected resource connections

Virtual Machines vs Containers WO

Virtual Machines

Hardware-assisted hypervisor isolation
Separate guest OS kernel per VM
Isolation depends on implementation and hardening

Containers

Share underlying host OS kernel
Isolated via namespaces and cgroups
Privileged container risks whole host
Separate OS kernel vs shared kernel

Containers, Kubernetes, Serverless & CNAPP WO

Container Shared Kernel Risk Namespaces/cgroups share host OS kernel
Kubernetes Hardening Priorities Least privilege; secrets encryption; enforced NetworkPolicies
Serverless / FaaS Top Risks Over-privileged execution roles, event injection
CWPP (Workload Protection) Secures VMs, containers, FaaS at runtime
CNAPP Platform Unifies CWPP, CSPM, CIEM, IaC scanning
Immutable Infrastructure Replace tested images; remediate external persistence

CSA Data Security Lifecycle (CSU-SAD) DA

Create, Store, Use, Share, Archive, Destroy; classify early
Create: classify & tag Store & Use: encrypt/mask Share & Archive: DLP/retain Destroy: verify erasure prerequisites

BYOK vs External Key Management DA

BYOK

Import customer-supplied key material
Cloud KMS enforces configured policies
Supported features vary by service

HYOK / External Key Management

Keys controlled outside cloud service
Availability and recovery require planning
Features and latency depend on integration
Imported material vs externally controlled keys

Encryption & Key Sovereignty Picker DA

Encrypting large cloud payloads efficiently → Use Envelope Encryption (KEK wraps DEK)
Customer wants rotation/revocation inside cloud → Use customer-managed keys; BYOK optional
Strict rule forbids keys in cloud → Evaluate external key management ( Check availability and service support )
Decommissioning multi-tenant cloud storage data → Verify suitable cryptographic-erasure prerequisites ( Include plaintext and key-copy inventory )

Data Lifecycle, Storage & Key Management DA

CSA Data Lifecycle (CSU-SAD) Create, Store, Use, Share, Archive, Destroy Classify early; reassess
Object vs Block Storage Risk Public bucket ACLs vs unencrypted snapshots
Envelope Encryption DEK encrypts data; KEK wraps DEK
BYOK vs HYOK Keys Imported material vs externally controlled keys
Cryptographic Erasure (Crypto-Shredding) Suitable encryption; destroy all recoverable keys
Why Disk Wiping Fails Multi-tenant SSD wear-leveling and replication
DSPM (Data Security Posture Management) Discover/classify data; prioritize exposure risks

DevSecOps, Pipeline & API Security AP

Shift-Left DevSecOps Automate security early in CI/CD
SAST vs DAST Static source analysis vs dynamic runtime
SCA & SBOM Component inventory, vulnerabilities, licensing evidence
IaC Scanning Check Terraform/K8s manifests before deploy
API Gateway vs BOLA Gateway throttles; backend verifies object ownership
CI/CD Pipeline Hardening Ephemeral runners + short-lived OIDC tokens

Cloud Incident Response Triage Tree RE

IaaS VM suspected of active compromise → Apply tested isolation; verify traffic stops ( Balance urgent containment and evidence )
Preserving volatile and disk evidence → Capture supported volatile data and snapshots ( Follow service-specific forensic procedure )
Attacker holds instance IAM role session → Use supported credential/session revocation controls ( Removing role alone may not revoke )
Analyzing compromised disk snapshot safely → Mount in isolated clean forensic VPC

Cloud IR, Resilience, Zero Trust & AI RE

VM Incident Quarantine Rule Contain harm; preserve feasible forensic evidence
Multi-AZ vs Multi-Region Zone vs region failures; test recovery
Zero Trust Core (NIST 800-207) Policy Engine, Policy Admin, PEP
CASB Inline vs API Mode Real-time proxy vs out-of-band SaaS scan
LLM Prompt Injection Manipulating model inputs to bypass guardrails
AI Data Leakage Risk Retention/training depend on service terms
Post-Incident Analysis Identify causes; test improvements; update playbooks

Zero Trust Logical Components (NIST 800-207) RE

Policy Engine decides, Policy Admin issues, PEP enforces inline
PE: evaluates trust signals PA: configures session token PEP: inline gateway enforcement

CASB Inline Proxy vs Out-of-Band API RE

Inline Proxy Mode

Sits in live traffic path
Blocks Shadow IT and downloads real-time
Requires network/agent traffic steering

Out-of-Band API Mode

Connects directly to SaaS APIs
Scans data at rest and permissions
Zero inline network latency
Inline proxy vs out-of-band API

Zero Trust, SASE and AI RE

Zero Trust Access Verify subject, device, resource and context
SASE Converged networking and cloud-delivered security
AI Tool Permissions Least privilege; validate consequential actions
Untrusted Retrieved Content Data sources are not privileged instructions

Common Traps

Task Delegation vs Legal Duties

Delegated operational task ≠ Retained applicable legal duty

Provider Assurance vs Customer Compliance

Provider control evidence ≠ Customer workload compliance conclusion

Authorization vs Authentication

OAuth: delegated API authorization ≠ OIDC: identity authentication layer

Isolation vs Termination

Isolation restricts access; preserves running state ≠ Termination destroys volatile state

Physical Sanitization vs Cryptographic Erasure

Media overwrite requires physical-storage control ≠ Crypto-erasure requires complete key destruction

Open Book vs Unlimited Time

Permitted reference access ≠ Uninterrupted 120-minute time budget

Last Minute

1. 60 open-book MCQs; 80% passing score
2. 2 attempts included, valid 2 years
3. IaaS: customer manages guest OS
4. IaaS: customer manages virtual network configuration
5. IaaS: customer manages apps, IAM, data
6. PaaS: customer manages application code/configuration
7. PaaS: customer manages IAM/data
8. SaaS: customer manages tenant configuration
9. SaaS: customer manages IAM/data governance
10. Provider: physical facilities and underlying infrastructure
11. PaaS: provider manages OS/runtime
12. SaaS: provider manages OS/runtime
13. Exact allocation varies by service/contract
14. Privileged management access risks authorized resources
15. CAIQ = self-assessment; STAR L2 = audited
16. SAML = XML; OIDC = JWT; SCIM = lifecycle
17. Protect logging access, retention and integrity
18. AWS SGs stateful; network ACLs stateless
19. Envelope encryption: KEK wraps DEK
20. Crypto-erasure requires suitable prior encryption
21. Crypto-erasure: destroy all recoverable key copies
22. Plaintext copies need separate sanitization
23. Contain harm; preserve feasible evidence
24. PE = Policy Engine; decides access
25. PA = Policy Administrator; establishes/ends sessions
26. PEP = Policy Enforcement Point; enforces access

CCSK

Practice Questions 224 questions Study Guide 47 topics Cheat Sheet 75 facts Flashcards 57 cards Games 20 terms Shorts 3 short s Blogs 1 blog Podcast
Word games 20 terms Guess the Term T E R M S Read the clue and guess the term in 6 tries. Word games 20 terms Term Match Swap tiles to line up three of the same term. Word games 20 terms Term Pairs ? ✓ ✓ ? ? Flip two cards at a time to find matching terms. Word games 20 terms Term Search Q T E R M X Find five hidden terms in a grid of letters.