CCSK flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST essential characteristics

Five criteria from NIST SP 800-145: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A service must exhibit all five to qualify as cloud.

IaaS customer boundary

In IaaS the provider secures facilities, hardware, hypervisor, and physical network, while the customer is responsible for the guest operating system, middleware, runtime, applications, and data.

Cloud deployment models

Public, private, hybrid, and community. Hybrid joins two distinct models through data or application portability; community infrastructure is shared by organizations with common concerns and requirements.

CSA Cloud Controls Matrix

A cloud-specific control framework organized into domains and mapped to ISO 27001, PCI DSS, and NIST. It underpins the CAIQ self-assessment questionnaire and provider assurance comparisons.

SOC 2 Type II

An attestation report covering both the design and operating effectiveness of controls over a period, usually six to twelve months. Type I covers design only at a single point in time.

Compliance inheritance limits

A provider's certification covers only the provider's own scope of control. Customer-side obligations and the controls the customer operates are never inherited and must be evidenced separately.

Cloud Center of Excellence

A cross-functional team that defines cloud standards, guardrails, and reusable patterns centrally, while business units retain accountability for their own workloads under a federated governance model.

Data owner and custodian

The data owner is accountable for classification and access decisions; the custodian implements and operates the technical controls on the owner's behalf, often the cloud platform team.

OAuth 2.0

A delegated authorization framework that issues access tokens so a client can act on a resource owner's behalf. It is not an authentication protocol on its own.

SAML versus OpenID Connect

SAML 2.0 is an XML-based federation standard for browser single sign-on; OpenID Connect is a JSON and REST identity layer built on OAuth 2.0 that returns an ID token.

Short-lived credentials

Temporary tokens issued by a cloud security token service with a fixed expiry. They replace long-lived access keys and limit the damage from a leaked secret.

Least privilege

Granting only the permissions needed for a task and only for as long as needed, enforced in cloud with scoped roles, permission boundaries, and periodic entitlement review.

CloudTrail and Activity Logs

Control-plane audit logs record each API call in an account, capturing identity, source IP, timestamp, and outcome. They are the primary evidence source in cloud investigations.

VPC flow logs

Records metadata about IP traffic to and from network interfaces in a virtual network, including source, destination, port, protocol, bytes, and accept or reject action. Payloads are not captured.

Log immutability

Storing audit logs in write-once or object-lock storage prevents an attacker holding admin credentials from deleting evidence, preserving integrity for forensics and compliance obligations.

Security group versus NACL

Security groups are stateful instance-level virtual firewalls with allow-only rules. Network ACLs are stateless, subnet-level, and evaluate ordered rules that can both allow and deny.

Private endpoint

A provider-managed private connection that routes traffic to a service over the provider backbone instead of the public internet, reducing exposure and supporting residency requirements.

Infrastructure as code

Declarative templates that provision cloud resources repeatably under version control, enabling peer review, drift detection, and automated policy checks before anything is deployed.

Container escape

Because containers share the host kernel, a kernel or runtime vulnerability can let a process break isolation and reach other containers or the host itself.

Cloud Security Posture Management

A service that continuously assesses cloud configuration against benchmarks and policy, flagging exposures such as public storage buckets, open management ports, and overly permissive roles.

Immutable infrastructure

Servers and containers are never patched in place; a freshly built hardened image is deployed and the old one destroyed, which eliminates configuration drift and shrinks patch windows.

Envelope encryption

A data key encrypts the data, and a master key held in a key management service encrypts the data key. The wrapped data key is stored alongside the ciphertext.

Crypto-shredding

Destroying the encryption key rather than the data renders all ciphertext permanently unrecoverable, satisfying sanitization requirements for encrypted data at rest when no key copies remain.

BYOK versus HYOK

Bring Your Own Key means the customer generates or controls the key inside the provider's key service; Hold Your Own Key keeps the key material entirely outside the provider.

SAST versus DAST

Static application security testing inspects source code without executing it and finds flaws early; dynamic testing exercises a running application and finds runtime and configuration issues.

Secrets sprawl

Credentials hard-coded into source code, container images, or CI variables. It is mitigated with a secrets manager issuing short-lived tokens and automated commit and image scanning.

Metadata service SSRF

A server-side request forgery flaw lets an attacker query the instance metadata endpoint and steal the workload's temporary credentials, countered by hardened metadata access and egress filtering.

NIST incident response phases

Preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, as defined in NIST SP 800-61 and applied to cloud investigations.

RTO and RPO

Recovery Time Objective is the maximum acceptable downtime; Recovery Point Objective is the maximum acceptable data loss measured in time. Both derive from business impact analysis.

Cloud evidence preservation

Isolate a compromised instance by tightening its security group and snapshot its disks and memory before remediation, because terminating the instance destroys volatile forensic evidence.

Zero trust architecture

The NIST SP 800-207 model in which no entity is trusted because of network location; every request is authenticated and authorized per session by a policy decision point.

Function as a service

Event-driven serverless compute that scales automatically, is billed per invocation and execution duration, and is stateless with a maximum permitted execution time.