I85PREP
⌘ K
CSA study materials
CSA study resources

CSA (Other exams) practice questions

One question at a time. Build your CSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Architecture Foundations and Governance

Which statement best describes the primary purpose of an information security governance framework within an organization?

  1. To align security investment and decisions with business objectives and risk appetite Correct answer.
  2. To guarantee that no security incident can ever occur
  3. To replace operational security monitoring with annual audits
  4. To document the technical configuration of every production server

Explanation

Security governance provides the decision-making structures, accountability, and direction that connect security activities to business goals and the organization's stated risk appetite. It is a management and oversight layer, not a technical configuration record or a guarantee of zero incidents.

Question 2Security Architecture Foundations and Governance

In security architecture, the principle of least privilege is best implemented by which approach?

  1. Granting each identity only the access required for its current tasks, for the time needed Correct answer.
  2. Relying on user agreements not to access resources beyond their role
  3. Giving administrators full access so they can respond quickly to incidents
  4. Assigning permissions by department so all members share identical rights

Explanation

Least privilege limits access to the minimum necessary and, ideally, for a limited duration, reducing the blast radius of misuse or compromise. Broad administrative rights, department-wide uniform permissions, and honor-based agreements all violate the principle by over-provisioning access.

Question 3Security Architecture Foundations and Governance

An organization separates the duties of requesting, approving, and provisioning access among different people. Which security principle does this control primarily support?

  1. Defense in depth
  2. Fail-safe defaults
  3. Separation of duties Correct answer.
  4. Non-repudiation

Explanation

Separation of duties divides critical functions among multiple parties so that no single individual can complete a sensitive action alone, reducing fraud and error. Defense in depth concerns layered controls, fail-safe defaults concern deny-by-default behavior, and non-repudiation concerns proving an action occurred.

Question 4Security Architecture Foundations and Governance

A security architect is defining how data should be classified and handled across its lifecycle. Which artifact most directly establishes the required handling rules for each classification level?

  1. A vulnerability scan report
  2. An incident response runbook
  3. A network topology diagram
  4. A data classification and handling policy Correct answer.

Explanation

A data classification and handling policy defines classification tiers and the required controls for storing, transmitting, and disposing of data at each tier. Topology diagrams, runbooks, and scan reports support operations but do not set handling rules.

Question 5Security Architecture Foundations and Governance

Which concept describes the total set of resources, identities, and trust relationships that an organization must protect and govern?

  1. The recovery point objective
  2. The attack surface Correct answer.
  3. The service level agreement
  4. The change advisory board

Explanation

The attack surface comprises all points where an adversary could interact with or exploit the environment, including identities, interfaces, and trust relationships. RPO, SLAs, and change boards are related to recovery, service commitments, and change control respectively.

Question 6Security Architecture Foundations and Governance

Which of the following is the clearest example of a detective security control?

  1. Encryption of data at rest
  2. Log monitoring that alerts on anomalous privileged access Correct answer.
  3. A firewall rule that blocks unauthorized traffic
  4. A policy requiring annual security training

Explanation

Detective controls identify and report events after or while they occur, such as monitoring and alerting on suspicious activity. Blocking traffic and encryption are preventive controls, while a training requirement is an administrative preventive measure.

Question 7Security Architecture Foundations and Governance

What is the primary role of a risk register in a security governance program?

  1. To record identified risks with owners, ratings, and treatment status Correct answer.
  2. To document the organization's network addressing scheme
  3. To list every software asset and its license expiry
  4. To store cryptographic keys used for production encryption

Explanation

A risk register is the governance record that tracks identified risks, their owners, assessed likelihood and impact, and the status of treatment decisions. Key stores, asset inventories, and addressing plans serve different purposes.

Question 8Security Architecture Foundations and Governance

Which statement accurately reflects the concept of a trust boundary in security architecture?

  1. It is the encryption strength required for stored backups
  2. It marks where the level of trust changes and controls must enforce the transition Correct answer.
  3. It defines the physical perimeter of a data center building
  4. It is the maximum number of users a system can authenticate

Explanation

A trust boundary is a logical or physical line where data or requests move between zones of differing trust, requiring controls to mediate the crossing. It is not a building perimeter, a capacity limit, or an encryption parameter.

Question 9Security Architecture Foundations and Governance

An organization wants to ensure that a compromised application server cannot reach the internal database subnet directly. Which architectural control best enforces this?

  1. Enabling verbose logging on the database server
  2. Encrypting the application server's local disk
  3. Network segmentation with deny-by-default rules between tiers Correct answer.
  4. A longer password policy for database accounts

Explanation

Segmentation with deny-by-default inter-tier rules constrains lateral movement so a compromised host cannot initiate unauthorized connections. Password policy, disk encryption, and logging are useful but do not prevent the network path from being used.

Question 10Security Architecture Foundations and Governance

A design review finds that a single authentication service is a dependency for every application. Which architectural concern does this most directly raise?

  1. Overly granular role definitions
  2. Excessive data retention
  3. Insufficient encryption key length
  4. Concentration of risk at a single point of failure Correct answer.

Explanation

Centralizing authentication creates a single point of failure whose outage or compromise affects all dependent applications, a concentration-of-risk concern. The other options relate to retention, cryptography, and role design rather than availability concentration.

Question 11Security Architecture Foundations and Governance

Which approach best applies the defense-in-depth principle to protecting a public web application?

  1. Removing input validation because the WAF filters requests
  2. Relying solely on a web application firewall as the only control
  3. Granting the application database administrator rights to simplify queries
  4. Layering independent controls such as WAF, input validation, and least-privilege service accounts Correct answer.

Explanation

Defense in depth combines independent, overlapping controls so that failure of one does not leave the asset unprotected. Relying on a single control, removing validation, or over-privileging the application defeats the layered approach.

Question 12Security Architecture Foundations and Governance

A governance board is deciding whether to accept, mitigate, transfer, or avoid a newly identified risk. What is this decision process called?

  1. Threat hunting
  2. Risk appetite setting
  3. Risk treatment Correct answer.
  4. Control testing

Explanation

Risk treatment is the selection and application of options to address an assessed risk, including acceptance, mitigation, transfer, and avoidance. Risk appetite is the tolerance threshold, while control testing and threat hunting are assurance and detection activities.

Question 13Security Architecture Foundations and Governance

Which design choice best supports the principle of fail-safe defaults for an access control system?

  1. Granting access when the authorization service is unavailable
  2. Logging the outage and continuing with cached full permissions
  3. Disabling authentication to maintain availability
  4. Denying access when the authorization service is unavailable Correct answer.

Explanation

Fail-safe defaults require that a system deny access when it cannot make a reliable authorization decision, preserving security over convenience. Granting access, using cached full permissions, or disabling authentication all fail open and expose resources.

Question 14Security Architecture Foundations and Governance

An organization adopts a zero trust architecture. Which assumption is most consistent with this model?

  1. Devices inside the corporate network are trusted by default
  2. No network location is inherently trusted; every request must be authenticated and authorized Correct answer.
  3. Users are trusted once they authenticate at the start of a session
  4. Perimeter firewalls alone are sufficient to protect internal resources

Explanation

Zero trust removes implicit trust based on network location and requires continuous verification of every request using identity, device posture, and policy. Trusting internal networks, relying only on perimeter defenses, or granting session-long trust contradicts the model.

Question 15Security Architecture Foundations and Governance

A security team maps its controls to a recognized framework to demonstrate coverage to auditors. Which benefit does this mapping primarily provide?

  1. A replacement for performing actual control testing
  2. A structured way to show how controls satisfy requirements and identify gaps Correct answer.
  3. A guarantee that the organization is compliant with every regulation
  4. A method to eliminate the need for risk assessment

Explanation

Framework mapping provides a structured view of which controls address which requirements, helping demonstrate coverage and reveal gaps. It does not by itself guarantee compliance, replace testing, or remove the need for risk assessment.

Question 16Security Architecture Foundations and Governance

Which element most distinguishes an administrative control from a technical control?

  1. Administrative controls are implemented through policies, processes, and people Correct answer.
  2. Administrative controls always involve encryption algorithms
  3. Administrative controls operate only at the network layer
  4. Administrative controls are enforced solely by hardware appliances

Explanation

Administrative controls are management-based measures such as policies, procedures, and training, while technical controls are enforced through systems. Encryption, network-layer enforcement, and hardware appliances describe technical mechanisms.

Question 17Security Architecture Foundations and Governance

A regulated workload must be isolated so that its data never shares compute with other tenants. Which architectural decision most directly satisfies this requirement?

  1. Dedicated infrastructure with enforced tenant isolation controls Correct answer.
  2. Shared compute with logical tagging of data
  3. A common identity provider for all tenants
  4. A shared database with row-level access rules

Explanation

A requirement that data never shares compute calls for dedicated infrastructure plus enforced isolation controls. Shared compute, shared databases with row-level rules, and a common identity provider do not prevent co-residency of data on shared hardware.

Question 18Security Architecture Foundations and Governance

When defining security requirements for a new system, which practice best ensures requirements are verifiable?

  1. Stating measurable criteria that can be tested during acceptance Correct answer.
  2. Copying generic requirements without tailoring to the system
  3. Deferring all security requirements to post-deployment review
  4. Describing security goals in broad aspirational language

Explanation

Verifiable requirements express measurable, testable criteria so acceptance testing can confirm the control works as intended. Aspirational language, deferral, and untailored copies cannot be objectively verified.

Question 19Security Architecture Foundations and Governance

An architect is selecting controls to protect a high-value asset. Which consideration most appropriately guides the rigor of the selected controls?

  1. The personal preference of the implementation team
  2. The asset's classification and assessed risk level Correct answer.
  3. The age of the vendor's marketing materials
  4. The number of features in the monitoring tool

Explanation

Control rigor should be proportionate to the asset's value, classification, and assessed risk, ensuring investment matches exposure. Team preference, marketing material age, and tool feature counts are not risk-based criteria.

Question 20Security Architecture Foundations and Governance

Which governance structure best ensures that security exceptions are formally reviewed and time-bound?

  1. A permanent waiver granted at project inception
  2. A policy that forbids documenting any exceptions
  3. An informal agreement among engineers to allow the exception
  4. A documented exception process with approval authority and expiration dates Correct answer.

Explanation

A formal exception process records the justification, assigns approval authority, and sets expiration so exceptions are reviewed and do not become permanent. Informal agreements, permanent waivers, and forbidding documentation all undermine oversight.

Question 21Security Architecture Foundations and Governance

An organization's risk appetite statement says it has low tolerance for data disclosure but higher tolerance for brief service interruptions. How should this most influence architecture decisions?

  1. Optimize purely for maximum uptime regardless of data exposure
  2. Treat confidentiality and availability as equally weighted in all cases
  3. Ignore the statement because architecture is purely technical
  4. Prioritize strong data protection controls while permitting designs that trade some availability for confidentiality Correct answer.

Explanation

Risk appetite should drive design trade-offs, so low tolerance for disclosure favors strong confidentiality controls even at some cost to availability. Ignoring the statement, optimizing only for uptime, or treating all objectives as equal contradicts the stated appetite.

Question 22Security Architecture Foundations and Governance

A design places a web tier, application tier, and database tier in separate segments with mediated, authenticated flows between them. Which property does this most improve?

  1. The encryption strength of data at rest
  2. The ability to contain and limit lateral movement after a compromise Correct answer.
  3. The speed of database query execution
  4. The accuracy of software license accounting

Explanation

Tiered segmentation with mediated, authenticated flows constrains how far an attacker can move from an initial foothold, improving containment. It does not inherently change encryption strength, license accounting, or query performance.

Question 23Security Architecture Foundations and Governance

A governance review finds that security metrics measure activity volume rather than control effectiveness. Which change best improves the metrics program?

  1. Define metrics tied to risk reduction and control outcomes with clear thresholds Correct answer.
  2. Remove metrics entirely to avoid misinterpretation
  3. Increase the number of dashboards reporting raw event counts
  4. Report only the total hours spent on security tasks

Explanation

Effective security metrics should reflect risk reduction and control outcomes with defined thresholds so governance can act on them. Raw event counts, hours spent, or removing metrics do not demonstrate effectiveness.

Question 24Security Architecture Foundations and Governance

An architect must justify why a control is appropriate given a specific threat. Which reasoning most strongly supports a defensible architecture decision?

  1. Selecting the control that requires the least documentation
  2. Linking the control to the identified threat, the asset at risk, and the residual risk after implementation Correct answer.
  3. Choosing the control because it is the newest product available
  4. Adopting the control because a competitor uses it

Explanation

A defensible decision traces the control to a specific threat and asset and states the residual risk, showing proportionality and rationale. Novelty, minimal documentation, or competitor imitation are not sound risk-based justifications.

Question 25Security Architecture Foundations and Governance

A policy requires that all privileged actions be attributable to an individual. Which design most directly satisfies this requirement?

  1. Unique individual credentials with audited privileged sessions rather than shared accounts Correct answer.
  2. Anonymous administrative access restricted to the internal network
  3. A single break-glass account used for daily operations
  4. A shared administrator account with a rotating password

Explanation

Attribution requires that each privileged action map to a unique identity, supported by session auditing. Shared accounts, routine use of a break-glass account, and anonymous access prevent individual accountability.

Question 26Security Architecture Foundations and Governance

A security architect is asked to formally document the acceptable level of loss from a specific business process before additional controls must be implemented. Which governance artifact records this decision?

  1. Risk appetite statement Correct answer.
  2. Control baseline
  3. Business impact analysis
  4. Threat model

Explanation

A risk appetite statement articulates the amount and type of risk an organization is willing to accept in pursuit of objectives, including acceptable loss thresholds. It guides control investment decisions by defining when residual risk must be treated rather than accepted.

Question 27Security Architecture Foundations and Governance

An architect is defining the security requirements for a new customer portal and wants each requirement to be testable during acceptance. Which formulation best satisfies this goal?

  1. The portal should be protected against common web vulnerabilities.
  2. The portal must encrypt session cookies with the HSTS header enforced on all responses. Correct answer.
  3. The portal must follow industry best practices for web security.
  4. The portal should be as secure as reasonably possible.

Explanation

A verifiable requirement states a specific, observable condition that can be tested, such as enforcing a named header on all responses. Vague aspirations like best practices or reasonable security cannot be objectively validated during acceptance testing.

Question 28Security Architecture Foundations and Governance

A design review finds that a single authentication service is a shared dependency for every application in the estate. Which architectural response most directly reduces the blast radius of a failure in that service?

  1. Require multifactor authentication for all administrators.
  2. Add a second parallel authentication service behind a load balancer.
  3. Increase the authentication service's logging verbosity.
  4. Introduce a local credential cache with defined fallback behavior per application. Correct answer.

Explanation

A controlled local fallback reduces the blast radius by allowing applications to continue authenticating during a dependency outage while limiting exposure through defined cache lifetimes. It addresses the concentration risk of a single shared service rather than merely scaling it.

Question 29Security Architecture Foundations and Governance

A regulated workload must be isolated so its data never shares compute or memory with other tenants. Which architectural decision most directly enforces this requirement?

  1. Encrypting the workload's data at rest with a customer-managed key.
  2. Deploying the workload in a dedicated account with dedicated hosts and no shared tenancy. Correct answer.
  3. Enabling detailed audit logging for all access to the workload.
  4. Applying a strict network security group to the workload's subnet.

Explanation

Dedicated tenancy and a separate account remove shared compute and memory, directly satisfying a no-shared-tenancy requirement. Network segmentation and encryption reduce risk but do not prevent co-residency on shared hardware.

Question 30Security Architecture Foundations and Governance

An architect must justify a proposed control to a governance board. Which reasoning most strongly supports the control's selection?

  1. The control is inexpensive to implement relative to the project budget.
  2. The control is mandated by the organization's preferred vendor reference architecture.
  3. The control is widely deployed by peer organizations in the same sector.
  4. The control measurably reduces a specific threat path identified in the threat model for a high-value asset. Correct answer.

Explanation

The strongest justification ties the control to a specific, modeled threat against a high-value asset and shows measurable risk reduction. This demonstrates proportionality between the control and the risk it addresses, which governance boards require.

Question 31Risk, Compliance, and Security Frameworks

Under the CSA Cloud Controls Matrix, what is the primary purpose of the control specification (the 'CCM') relative to other frameworks such as ISO/IEC 27001 or NIST SP 800-53?

  1. It defines legal data-residency obligations that override national privacy statutes
  2. It certifies an organization's compliance with those frameworks once an audit is passed
  3. It replaces those frameworks entirely for any organization operating in the cloud
  4. It provides a cloud-specific control set that maps to and complements those broader frameworks Correct answer.

Explanation

The CCM is a cloud-focused control framework whose controls are cross-referenced (mapped) to established standards such as ISO/IEC 27001, NIST SP 800-53, and PCI DSS, so it supplements rather than replaces them. It is a control catalog, not a certification scheme or a body of law.

Question 32Risk, Compliance, and Security Frameworks

An organization wants to demonstrate that its cloud service provider meets a defined baseline of security controls using a CSA-issued instrument. Which artifact is intended for that assurance purpose?

  1. The General Data Protection Regulation (GDPR) record of processing activities
  2. The Consensus Assessments Initiative Questionnaire (CAIQ)
  3. The Cloud Controls Matrix (CCM)
  4. The Security, Trust, Assurance and Risk (STAR) Level 1 self-assessment Correct answer.

Explanation

CSA STAR Level 1 is a self-assessment in which a provider documents how it meets CCM controls, giving customers a published assurance statement. The CAIQ is the question set used to gather that information, and the CCM is the underlying control catalog rather than an assurance report.

Question 33Risk, Compliance, and Security Frameworks

A cloud provider publishes a STAR Level 2 assessment. Which statement best describes what distinguishes Level 2 from Level 1?

  1. Level 2 covers only the physical security of data centers
  2. Level 2 requires a third-party audit of the provider's controls rather than a self-attestation Correct answer.
  3. Level 2 applies only to providers headquartered in the European Union
  4. Level 2 is a marketing tier that carries no independent verification

Explanation

STAR Level 2 involves independent third-party assessment or certification against the CCM, whereas Level 1 is a self-assessment. The distinction is the independence of the evaluation, not geography or a limited control scope.

Question 34Risk, Compliance, and Security Frameworks

A cloud customer is reviewing a provider's CAIQ response and finds a control marked as not applicable because the provider does not offer that capability. What is the most appropriate next step in a risk assessment?

  1. Escalate directly to a regulator as a reportable security incident
  2. Record the gap, assess its risk to the customer's workloads, and consider compensating controls Correct answer.
  3. Treat the control as satisfied because the provider answered the questionnaire
  4. Discard the entire CAIQ response as unreliable and start a new procurement

Explanation

A 'not applicable' answer reflects a capability gap relative to the customer's needs, so it should be logged and risk-assessed, with compensating controls considered where the risk is material. A questionnaire response is input to risk analysis, not proof of compliance, and a gap alone is not an incident.

Question 35Risk, Compliance, and Security Frameworks

In the CSA CCM, controls are organized into domains. Which domain would most directly address the requirement to encrypt data at rest and manage cryptographic keys?

  1. Human Resources
  2. Supply Chain Management, Transparency and Accountability
  3. Data Security and Privacy Lifecycle Management Correct answer.
  4. Business Continuity Management and Operational Resilience

Explanation

Encryption at rest and key management are cryptographic safeguards over data, which fall under the data security and privacy lifecycle domain. Human resources, supply chain, and business continuity domains address different control objectives.

Question 36Risk, Compliance, and Security Frameworks

A provider claims its control environment aligns with the CSA CCM. Which evidence most strongly supports an independent evaluation of that claim?

  1. A completed CAIQ published in the STAR registry with a third-party audit report Correct answer.
  2. A sales brochure listing the CCM domains the provider follows
  3. A blog post describing the provider's security culture
  4. An internal memo from the provider's security team

Explanation

Independent evaluation is best evidenced by a third-party assessment tied to CCM controls, such as a STAR Level 2 report, alongside the published CAIQ. Marketing materials and internal documents are self-reported and lack independent verification.

Question 37Risk, Compliance, and Security Frameworks

An organization is mapping its existing ISO/IEC 27001 controls to the CSA CCM. What is the main benefit of performing this mapping?

  1. It automatically certifies the organization against the CCM
  2. It allows reuse of existing control evidence across frameworks and highlights cloud-specific gaps Correct answer.
  3. It eliminates the need to maintain any documentation of controls
  4. It transfers legal liability for cloud incidents to the provider

Explanation

Cross-framework mapping lets an organization reuse evidence gathered for one framework and identify where cloud-specific CCM controls add requirements not covered elsewhere. Mapping does not remove documentation duties, grant certification, or shift legal liability.

Question 38Risk, Compliance, and Security Frameworks

Which CSA STAR level is most appropriate for a small SaaS startup that wants a low-cost, publicly visible statement of its security posture before it can afford a third-party audit?

  1. STAR Level 1 self-assessment Correct answer.
  2. STAR Level 3 continuous monitoring
  3. ISO/IEC 27001 certification
  4. STAR Level 2 third-party audit

Explanation

STAR Level 1 is a self-assessment published to the registry, which is inexpensive and gives visibility into the provider's posture. Level 2 and Level 3 require greater external rigor and cost, and ISO/IEC 27001 is a separate certification scheme.

Question 39Risk, Compliance, and Security Frameworks

A cloud customer's contract requires the provider to notify of security incidents within a defined window. Which CCM control area most directly governs this obligation?

  1. Interoperability and Portability
  2. Incident Management and Response Correct answer.
  3. Identity and Access Management
  4. Change Control and Configuration Management

Explanation

Incident notification timelines are part of incident management and response, which covers detection, response, and communication obligations. Change control, identity management, and portability address unrelated objectives.

Question 40Risk, Compliance, and Security Frameworks

An auditor finds that a provider's CAIQ states a control is implemented, but the provider cannot produce supporting evidence during a STAR Level 2 assessment. What is the likely consequence?

  1. The assessment is automatically passed because the CAIQ was completed
  2. The claim is downgraded or flagged as a finding because self-reported answers require evidentiary support Correct answer.
  3. The customer assumes full responsibility for the control
  4. The control is removed from the CCM for all providers

Explanation

In an independent assessment, stated controls must be supported by evidence; unsupported claims become findings or are downgraded. Completing a questionnaire does not substitute for evidence, and neither the CCM nor the customer's role changes as a result.

Question 41Risk, Compliance, and Security Frameworks

Which statement correctly describes the relationship between the CAIQ and the CCM?

  1. The CAIQ is a legal contract that supersedes the CCM
  2. The CCM is a subset of questions drawn from the CAIQ
  3. The two artifacts are unrelated and serve different industries
  4. The CAIQ poses questions whose answers are structured around CCM controls Correct answer.

Explanation

The CAIQ is a questionnaire that asks providers to describe how they address CCM controls, so the two are complementary. The CCM is the control catalog, not a subset of the questionnaire, and neither is a contract.

Question 42Risk, Compliance, and Security Frameworks

A multinational customer must ensure its cloud provider satisfies both cloud-specific controls and regional privacy law. How should the CSA CCM be used in this situation?

  1. As a substitute for a data protection impact assessment
  2. As a cloud control baseline that is combined with applicable legal and regulatory requirements Correct answer.
  3. As an optional reference that has no bearing on privacy obligations
  4. As the sole authority, because CCM controls override local privacy law

Explanation

The CCM supplies a cloud control baseline, but legal and regulatory obligations such as privacy law apply in addition and must be layered on top. The CCM neither overrides law nor replaces required privacy assessments.

Question 43Risk, Compliance, and Security Frameworks

In the shared responsibility model for IaaS, which control area typically remains the customer's responsibility even though the provider offers related tooling?

  1. Configuration of guest operating systems and customer identity and access management Correct answer.
  2. Physical security of the data center
  3. Network backbone redundancy
  4. Hypervisor patching

Explanation

In IaaS the provider secures the physical facility, hypervisor, and backbone, while the customer configures guest operating systems and manages its own identities and access. Tooling may be offered by the provider, but the configuration responsibility stays with the customer.

Question 44Risk, Compliance, and Security Frameworks

A provider wants to show continuous, automated monitoring of its CCM-aligned controls rather than a point-in-time audit. Which STAR offering aligns with that goal?

  1. STAR Level 3 continuous audit and monitoring Correct answer.
  2. A one-time CAIQ submission
  3. STAR Level 2 third-party audit
  4. STAR Level 1 self-assessment

Explanation

STAR Level 3 is designed around continuous auditing and monitoring, providing ongoing assurance rather than a snapshot. Level 1 and Level 2 are point-in-time assessments, and a single CAIQ submission is not continuous.

Question 45Risk, Compliance, and Security Frameworks

Which CCM domain would an organization review first when assessing how a provider handles deletion of customer data at contract termination?

  1. Data Security and Privacy Lifecycle Management Correct answer.
  2. Logging and Monitoring
  3. Threat and Vulnerability Management
  4. Audit Assurance and Compliance

Explanation

Data deletion at termination is a data lifecycle concern, which falls under the data security and privacy lifecycle domain. Logging, vulnerability management, and audit assurance address different objectives.

Question 46Risk, Compliance, and Security Frameworks

A customer must decide whether a provider's STAR Level 1 self-assessment is sufficient for a high-sensitivity workload. What is the most defensible reasoning?

  1. It is sufficient because STAR is a recognized CSA program
  2. It may be insufficient because self-attestation lacks independent verification for high-risk data Correct answer.
  3. It is sufficient only if the provider is large
  4. It is never useful for any workload

Explanation

Self-attestation provides transparency but no independent verification, so for high-sensitivity data a customer should weigh it against stronger evidence such as a Level 2 audit. Provider size does not change the level of assurance, and Level 1 is still useful for lower-risk contexts.

Question 47Risk, Compliance, and Security Frameworks

Which statement best describes how the CSA CCM handles the concept of control ownership between a cloud provider and a cloud customer?

  1. It assigns every control exclusively to the customer
  2. It leaves control ownership entirely to national regulators
  3. It assigns every control exclusively to the provider
  4. It identifies which party is responsible for each control in a shared cloud model Correct answer.

Explanation

The CCM is structured so that each control can be attributed to the provider, the customer, or both, reflecting the shared responsibility model. Ownership is not allocated wholesale to either party, and regulators do not assign control ownership in the CCM.

Question 48Risk, Compliance, and Security Frameworks

An organization is preparing for a STAR Level 2 assessment and wants to maximize the chance of a clean result. Which preparatory step is most aligned with assessment expectations?

  1. Relying on verbal assurances from staff instead of documented evidence
  2. Drafting a press release announcing certification before the audit
  3. Collecting and organizing evidence that maps to each applicable CCM control Correct answer.
  4. Removing controls that are difficult to evidence from the scope without justification

Explanation

Third-party assessments test documented evidence against each applicable control, so organizing that evidence in advance is the most effective preparation. Premature announcements, unjustified scope removal, and verbal assurances do not satisfy an auditor.

Question 49Risk, Compliance, and Security Frameworks

Why does the CSA publish mappings between the CCM and other frameworks such as NIST and ISO standards?

  1. To prevent providers from using multiple frameworks at once
  2. To replace those frameworks in regulated industries
  3. To make the CCM legally binding in every jurisdiction
  4. To enable organizations to reuse control evidence and reduce duplicate compliance effort Correct answer.

Explanation

Mappings let organizations translate controls and reuse evidence across frameworks, reducing the burden of redundant audits. They do not create legal force, replace other frameworks, or restrict multi-framework use.

Question 50Risk, Compliance, and Security Frameworks

A provider's CAIQ notes that a control is 'shared' with the customer. How should the customer interpret this in its own risk assessment?

  1. The provider is legally barred from assisting with the control
  2. The customer must implement its own portion of the control to achieve the intended outcome Correct answer.
  3. The customer has no action because the provider covers the control
  4. The control can be ignored because responsibility is ambiguous

Explanation

A shared control means both parties have distinct responsibilities; the customer must fulfill its side for the control to be effective. Shared status does not remove customer obligations, create ambiguity that permits ignoring the control, or prohibit provider assistance.