I85PREP
⌘ K
CrowdStrike CCSA study materials
CrowdStrike CCSA study resources

CrowdStrike CCSA: Cloud Platform and Architecture Fundamentals

CrowdStrike CCSA · Work through your exam, one topic at a time.

All guide sections

Cloud Platform and Architecture Fundamentals

Domain 1: Cloud Platform and Architecture Fundamentals

This domain tests whether you can read a cloud environment before you assess or protect it. CCSA questions expect you to distinguish service and deployment models, map provider building blocks, and explain how architecture changes visibility and control.

Core rules

  • IaaS gives the customer guest OS control; PaaS hides OS/runtime; SaaS leaves configuration and identity as the main customer levers. Responsibility shifts with the model, but data, identities, and access decisions remain customer concerns.
  • Map AWS Regions and Availability Zones, VPCs, subnets, route tables, security groups, and network ACLs. Azure uses subscriptions, resource groups, virtual networks, and network security groups. GCP uses organizations, folders, projects, VPC networks, and firewall rules.
  • Separate the control plane (APIs, IAM, logs) from the data plane (packets, storage reads). Most cloud attacks use the control plane, so API audit logs matter.
  • Classify workloads: virtual machines, containers, Kubernetes pods, serverless functions, and managed services. Each has different telemetry and patching boundaries.
  • Treat tags and metadata as inventory aids, not security boundaries. Enforcement comes from IAM, network policy, and admission control.

Worked example

A web app runs on EC2 behind an Application Load Balancer across two AZs; the database is RDS in private subnets. The ALB security group allows 443 from the internet. The EC2 security group allows 443 only from the ALB security group. The RDS security group allows 3306 only from the EC2 group. EC2 uses an IAM role, not stored keys. Reasoning: public exposure is intentional at the ALB; EC2 and RDS are not internet-facing; identity is role-based; multi-AZ improves resilience. A scanner finding “EC2 has a public IP” is not automatically a breach, but it becomes higher risk if the security group or route table permits inbound access.

Traps

  • Equating a Region with an Availability Zone.
  • Assuming a private subnet has no outbound path; NAT gateways change that.
  • Calling security groups stateless; they are stateful, while network ACLs are stateless.
  • Assuming managed services expose the same host telemetry as IaaS VMs.
  • Ignoring control-plane logs because packet capture looks familiar.