CrowdStrike CCSA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

Division of security duties between cloud provider and customer. Provider secures facilities, hardware, and managed-service internals; customer secures identity, configuration, data, and workload contents.

AWS account boundary

The primary isolation, quota, and billing unit in AWS. Resources in separate accounts are isolated by default, and cross-account access requires explicit trust such as role assumption.

Availability Zone

An isolated datacenter group within a region with independent power and networking. Subnets are bound to one zone, so multi-zone design is required for resilience.

Azure resource hierarchy

Tenant, management group, subscription, resource group, resource. RBAC assignments and Azure Policy inherit downward, so scope choice determines blast radius of a policy or permission.

GCP project hierarchy

Organization, folder, project, resource. IAM policies inherit down this tree, and a grant at organization level applies to every project beneath it.

Service control policy

AWS Organizations guardrail that sets the maximum available permissions for member accounts. It does not grant permissions; it filters what identity policies can allow.

Immutable infrastructure

Pattern where servers are replaced rather than patched in place. It makes instance identity ephemeral, so durable asset tracking must key on resource IDs, not hostnames or IPs.

Cloud control plane logs

Provider audit records of API activity: AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs. They show who called which API, from where, and with what result.

CSPM

Cloud security posture management. Continuously evaluates deployed cloud configuration against benchmarks and policy, producing misconfiguration findings with severity and resource context.

CIEM

Cloud infrastructure entitlement management. Analyzes effective permissions and usage to identify over-privileged identities, unused entitlements, and risky cross-account trust relationships.

CWPP

Cloud workload protection platform. Secures running compute such as virtual machines, containers, and serverless by inspecting runtime behavior and enabling prevention and response actions.

Effective permissions

The net result of identity policy, resource policy, permission boundaries, and organization guardrails. Any applicable explicit deny overrides every allow in the evaluation.

Least privilege

Granting only the permissions required for a task, for the shortest feasible duration. In cloud this usually means scoped roles and short-lived credentials instead of long-lived access keys.

Customer-managed key

Encryption key created and controlled by the customer in a key management service. It enables revocation, rotation control, and separation of duties beyond provider-managed keys.

Defense in depth

Layering independent controls so one failure does not expose the asset. Cloud layers include identity, network, workload runtime, data encryption, and monitoring.

Compliance control mapping

Linking each technical finding or safeguard to framework requirements such as SOC 2 or PCI DSS. One finding can satisfy or violate multiple controls simultaneously.

Public storage exposure

A storage bucket or container readable by anonymous principals. Severity depends on data sensitivity and policy; sensitive data plus public read is a critical condition.

Agentless cloud assessment

Snapshot-based evaluation of cloud APIs and disk images on a schedule. It delivers posture and vulnerability context without installing software, but cannot block runtime activity.

Falcon sensor visibility

Continuous host-level telemetry covering process, file, and network events. It enables real-time detection and prevention, which agentless periodic scanning cannot provide.

Cloud account registration

Onboarding a cloud account or subscription using read-only roles or service principals. The configured scope determines which regions and resource types are assessed.

Unified asset inventory

Normalized record of resources across AWS, Azure, and GCP so consistent policy and misconfiguration rules apply regardless of provider-specific naming.

IaC scanning

Static analysis of infrastructure-as-code templates before deployment. It catches misconfiguration pre-provisioning but does not detect drift in already-deployed resources.

Configuration drift

Divergence between intended and deployed resource state. Detecting it requires repeated assessment over time; a single scan only proves point-in-time state.

Exploitability prioritization

Ranking findings by real-world risk signals such as internet exposure, sensitive data, and known-exploited vulnerability status, rather than raw severity score alone.

Orphaned resource finding

A misconfiguration on an unused or decommissioned resource. It remains a hygiene issue but typically ranks below the same finding on an active, internet-facing asset.

Cloud incident containment

Isolating a compromised workload by network controls such as quarantine security groups before remediation. Isolation limits spread while preserving the host for investigation.

Evidence preservation order

Snapshot disk and capture memory before terminating or rebuilding a workload. Termination destroys volatile evidence and prevents root-cause analysis.

Credential revocation scope

Rotating access keys, revoking active sessions, removing added trust policies, and checking for new identities. Password reset alone leaves cloud persistence intact.

Real-time response actions

Host-level actions executed through the sensor, including network containment, process termination, file quarantine, and memory capture, applied to a live workload.

Identity correlation

Linking runtime events to the IAM principal that launched or accessed the workload. It separates legitimate administrative action from attacker-driven activity during triage.

Log retention window

The period provider audit and flow logs remain queryable. Short retention directly caps how far back an investigation can reconstruct attacker activity.

Post-incident hardening

Closing the initial access vector, such as an exposed key or over-privileged role, before returning the workload to production. It prevents immediate recompromise by the same path.