Cloud Security Alliance Updated CCSK Exam Questions and Answers by kamil

The CCSK v5.0 Study Guide defines cloud computing based on the NIST SP 800-145 definition, which outlines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Two key capabilities that underpin these characteristics areabstractionandresource pooling.

Abstractionrefers to the virtualization layer that hides the underlying physical infrastructure, allowing users to interact with resources (e.g., compute, storage, networking) without needing to manage the hardware directly.

Resource poolingenables the provider’s computing resources to be pooled to serve multiple consumers using a multi-tenant model, with resources dynamically assigned and reassigned based on demand.

From theCCSK v5.0 Study Guide, Domain 1 (Cloud Computing Concepts and Architectures), Section 1.2:

“Cloud computing relies on abstraction to simplify the user experience and resource pooling to efficiently allocate resources across multiple tenants. Resource pooling is a defining characteristic, where the provider’s computing resources are pooled to serve multiple consumers, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.”

Option B correctly identifiesabstraction and resource poolingas the two key capabilities.

Option A (Abstraction and orchestration) is incorrect because orchestration, while important for automation, is not a defining characteristic of cloud computing.

Option C (Multi-tenancy and isolation) is incorrect because, while multi-tenancy is a feature of resource pooling, isolation is a security mechanism, not a core capability of cloud computing.

Option D (Virtualization and multi-tenancy) is incorrect because virtualization is a technology that enables abstraction, but multi-tenancy alone is not sufficient to define cloud computing.

Correct Option: A. Failure to update access controls after employee role changes

This falls under one of the most common risk factors related to cloud misconfiguration and poor change management. Misconfiguration errors often stem from insufficient change control, especially in dynamic environments like the cloud. According to CSA’s Security Guidance v4.0, poor governance of identity and access management (IAM) changes — such as not updating access privileges when user roles change — introduces serious security risks.

"Cloud computing is dynamic by nature. This places more importance on automation and proper governance, especially for identity and access control. Failure to remove or update access permissions after personnel changes leads to orphaned or over-permissioned accounts, which are prime targets for attackers."

— Domain 2: Governance and Enterprise Risk Management, CSA Security Guidance v4.0

Also highlighted in ENISA’s Cloud Risk Assessment:

"Loss of governance includes failing to maintain proper control over access privileges and role assignments. Poor change management and inadequate configuration reviews can leave systems open to unauthorized access."

— ENISA Cloud Computing Risk Assessment, Section R.2: Loss of Governance

Why the Other Options Are Incorrect:

B. Lack of sensitive data encryption: While encryption is critical, it is not directly tied to change control or misconfiguration, but rather falls under Data Security and Encryption domain.

C. Lack of 3rd party service provider specialized in patch management procedures: This refers more to vendor management and Security-as-a-Service, not internal change control or misconfigurations.

D. Excessive SBOM focus: Software Bill of Materials (SBOM) is important for supply chain transparency, but excessive focus on it isn’t a typical misconfiguration or change control risk.

In the Infrastructure as a Service (IaaS) model, the cloud provider delivers the basic infrastructure components such as virtual machines, storage, and networking resources. However, the customer is responsible for managing the operating system, applications, and any software configurations that run on the infrastructure. This gives the customer more control over the environment while still benefiting from the cloud provider's hardware and scalability.

The provider manages the operating system, runtime, and infrastructure, and the customer is only responsible for managing the applications. NaaS focuses on network services, not the management of operating systems and applications. The provider manages everything, including the operating system and applications, and the customer simply uses the software.