I85PREP
⌘ K
Certified CSA STAR Auditor study materials
Certified CSA STAR Auditor study resources

Certified CSA STAR Auditor practice questions

One question at a time. Build your Certified CSA STAR Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Under the CSA STAR program, which assurance level relies on a self-assessment submitted by the cloud provider without an independent third-party audit?

  1. STAR Level 2
  2. STAR Level 3
  3. STAR Level 1 Correct answer.
  4. STAR Continuous Monitoring

Explanation

STAR Level 1 is a self-assessment in which the provider completes the CAIQ or Consensus Assessments Initiative Questionnaire and publishes it on the STAR registry without independent verification. Level 2 requires an independent third-party audit against a recognized standard.

Question 2STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A cloud provider wants to publish a STAR Level 1 entry. Which artifact must it complete and submit?

  1. A Cloud Controls Matrix (CCM) audit opinion
  2. An ISO/IEC 27001 certificate
  3. A SOC 2 Type II report
  4. A Consensus Assessments Initiative Questionnaire (CAIQ) Correct answer.

Explanation

STAR Level 1 submissions are built on the CAIQ, which maps the provider's controls to the Cloud Controls Matrix. The completed questionnaire is published to the STAR registry as the self-assessment.

Question 3STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which statement best describes the relationship between the Cloud Controls Matrix (CCM) and STAR Level 1?

  1. The CCM replaces the CAIQ at Level 1
  2. The CCM is a certification body that issues Level 1 certificates
  3. The CCM is only used at Level 2 and has no role at Level 1
  4. The CAIQ answers are structured around CCM control domains Correct answer.

Explanation

The CAIQ organizes self-assessment responses according to CCM control domains, so the CCM provides the control structure behind Level 1 disclosures. The CCM itself is a framework, not a certifying body.

Question 4STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

STAR Level 2 differs from STAR Level 1 primarily because Level 2 requires:

  1. Only a signed self-declaration by the CEO
  2. A public bug bounty program
  3. A minimum of five years of operating history
  4. An independent third-party assessment against a recognized framework Correct answer.

Explanation

Level 2 introduces independent third-party auditing or certification against recognized standards such as ISO/IEC 27001, SOC 2, or the CCM-based STAR attestation. This independent verification distinguishes it from the Level 1 self-assessment.

Question 5STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider publishes a STAR Level 2 entry based on an ISO/IEC 27001 certificate. What does this entry primarily convey to consumers?

  1. That the provider has no remaining security gaps
  2. That the provider has achieved STAR Level 3 continuous monitoring
  3. That an independent party has certified the provider's management system Correct answer.
  4. That the provider has completed a self-assessment

Explanation

A Level 2 entry backed by ISO/IEC 27001 conveys that an accredited certification body has independently certified the provider's information security management system. It signals independent verification, not a self-declaration.

Question 6STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which body administers the STAR registry where Level 1 and Level 2 entries are published?

  1. The Open Web Application Security Project
  2. The Cloud Security Alliance Correct answer.
  3. The International Organization for Standardization
  4. The American Institute of Certified Public Accountants

Explanation

The Cloud Security Alliance (CSA) operates the STAR program and its public registry. ISO, AICPA, and OWASP publish standards or guidance but do not run the STAR registry.

Question 7STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A consumer is reviewing a STAR registry entry and sees only a CAIQ with no auditor opinion attached. Which assurance level is this entry?

  1. STAR Level 4
  2. STAR Level 2
  3. STAR Level 1 Correct answer.
  4. STAR Level 3

Explanation

An entry consisting of a completed CAIQ without an independent audit opinion is a Level 1 self-assessment. Level 2 entries include third-party attestation or certification evidence.

Question 8STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which of the following is a recognized basis for a STAR Level 2 entry?

  1. A press release announcing a security program
  2. A vendor security questionnaire filled out by sales
  3. A completed CAIQ with no external review
  4. A SOC 2 Type II report issued by an independent auditor Correct answer.

Explanation

SOC 2 Type II is one of the recognized independent third-party assessments accepted as a basis for Level 2. The report reflects an auditor's examination of controls over a period.

Question 9STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider submits a CAIQ but marks several control answers as 'not applicable' without justification. How does this affect a STAR Level 1 review by a consumer?

  1. The consumer cannot rely on those answers as evidence of control implementation Correct answer.
  2. The omissions convert the entry into Level 2
  3. The omissions are irrelevant because Level 1 is unverified
  4. The entry is automatically rejected by CSA

Explanation

Level 1 answers are self-declared, so unjustified 'not applicable' responses give the consumer no evidence that the control is implemented. The consumer should treat such answers cautiously and seek clarification.

Question 10STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A cloud customer needs independent assurance that a provider's controls operated effectively over a defined period. Which STAR entry type best meets this need?

  1. STAR Level 2 with a SOC 2 Type II report Correct answer.
  2. A CCM spreadsheet completed internally
  3. An unverified CAIQ posted on a marketing site
  4. STAR Level 1 self-assessment

Explanation

A SOC 2 Type II report covers control operation over a period and is issued by an independent auditor, making it suitable for STAR Level 2. This provides the period-based independent assurance the customer requires.

Question 11STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which statement accurately reflects how STAR Level 2 and Level 3 relate?

  1. Level 3 requires only a signed attestation letter
  2. Level 3 builds on Level 2 by adding continuous monitoring and automation of assurance Correct answer.
  3. Level 3 replaces Level 2 and removes the need for third-party audits
  4. Level 3 is a self-assessment tier below Level 1

Explanation

STAR Level 3 extends the Level 2 third-party model with continuous monitoring and automated evidence, rather than replacing independent audit. It represents the most mature assurance tier in the program.

Question 12STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider wants a STAR Level 2 entry but has no ISO certificate or SOC report. Which option is consistent with the STAR program?

  1. Ask a customer to audit the provider and publish the result
  2. Self-certify against the CCM without external review
  3. Complete a CCM-based STAR attestation audited by a qualified third party Correct answer.
  4. Publish the CAIQ and label it Level 2

Explanation

The STAR attestation is a CCM-based independent assessment performed by a qualified third-party auditor, and it serves as a valid Level 2 basis. Self-certification or customer audits do not meet the independent third-party requirement.

Question 13STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

When comparing a Level 1 and a Level 2 entry for the same provider, what is the most accurate characterization of the assurance difference?

  1. Level 2 provides independent verification, reducing the risk of overstated controls Correct answer.
  2. Level 2 is less reliable because auditors rely on provider-supplied data
  3. Level 1 is more reliable because the provider knows its own controls best
  4. Level 1 and Level 2 provide identical assurance because both use the CCM

Explanation

Level 2 adds independent verification by a third party, which reduces the risk that self-declared controls overstate actual practice. Level 1 relies on the provider's own statements, so its assurance is inherently lower.

Question 14STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A consumer sees a STAR entry listing an ISO/IEC 27001 certificate with a scope statement that excludes the specific cloud service in use. How should the consumer interpret this?

  1. The scope statement is irrelevant to STAR Level 2
  2. The certificate fully covers the service because ISO certification is organization-wide
  3. The certificate may not provide assurance for the service outside its stated scope Correct answer.
  4. The entry should be treated as Level 1

Explanation

An ISO certificate provides assurance only for the scope defined in the certification. If the in-use service falls outside that scope, the consumer cannot rely on the certificate as evidence for that service.

Question 15STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which activity is most characteristic of STAR Level 1 rather than Level 2?

  1. The provider maps its controls to CCM and answers CAIQ questions Correct answer.
  2. A continuous monitoring feed pushes control metrics to consumers
  3. A certification body issues a management system certificate
  4. An auditor samples control evidence over a review period

Explanation

Level 1 centers on the provider mapping controls to the CCM and answering the CAIQ as a self-assessment. Auditing, certification, and continuous monitoring belong to higher assurance levels.

Question 16STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider claims 'STAR Level 2 certified' based on a completed CAIQ reviewed internally by its own security team. What is the primary problem with this claim?

  1. The CAIQ is the wrong questionnaire for STAR
  2. The CCM cannot be used for Level 2
  3. Level 2 requires continuous monitoring feeds
  4. Internal review is not an independent third-party assessment Correct answer.

Explanation

Level 2 requires independent third-party assessment; an internal review does not satisfy that independence requirement. The claim therefore misrepresents the assurance level achieved.

Question 17STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which pair correctly matches a STAR assurance level with its verification model?

  1. Level 1: independent audit; Level 2: self-assessment
  2. Level 1: self-assessment; Level 2: independent third-party assessment Correct answer.
  3. Level 1: continuous monitoring; Level 2: self-assessment
  4. Level 1: certification; Level 2: continuous monitoring

Explanation

Level 1 is a provider self-assessment, while Level 2 requires independent third-party assessment against a recognized framework. This pairing reflects the program's core distinction between the two levels.

Question 18STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A customer requires evidence that a provider's controls are monitored continuously with automated data feeds. Which STAR level is designed to address this requirement?

  1. STAR Level 1
  2. STAR Level 3 Correct answer.
  3. STAR Level 2
  4. STAR Level 0

Explanation

STAR Level 3 is designed around continuous monitoring and automated assurance, going beyond point-in-time third-party assessment. It is the tier that addresses ongoing, machine-readable assurance needs.

Question 19STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which statement best explains why a consumer might accept a Level 1 entry for a low-risk, non-sensitive workload?

  1. Level 1 guarantees the absence of security incidents
  2. The self-declared CAIQ provides useful transparency at lower assurance cost for lower-risk use Correct answer.
  3. Level 1 entries are legally binding certifications
  4. Level 1 entries are independently audited and therefore stronger than Level 2

Explanation

For lower-risk workloads, the transparency of a self-declared CAIQ may be proportionate to the risk, avoiding the cost of a full third-party audit. The consumer accepts lower assurance in exchange for lower burden.

Question 20STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider's STAR Level 2 entry references a SOC 2 report whose period ended 30 months ago. What is the most appropriate consumer response?

  1. Ignore the report entirely and rely on the CAIQ
  2. Accept it because Level 2 status never expires
  3. Request a more current report to confirm controls still operate effectively Correct answer.
  4. Treat the entry as Level 3 because of the elapsed time

Explanation

Third-party reports cover a defined period, and stale reports provide limited assurance about current control operation. The consumer should request a more recent report or bridge evidence covering the gap.

Question 21STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which element distinguishes a STAR Level 2 CCM-based attestation from a Level 1 CAIQ submission?

  1. The publication of the entry on the STAR registry
  2. The use of CCM control domains
  3. The use of cloud-specific terminology
  4. The involvement of a qualified independent third-party auditor Correct answer.

Explanation

Both levels use CCM control domains and registry publication, but only the Level 2 attestation involves a qualified independent third-party auditor. That independent examination is the defining differentiator.

Question 22STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider holds a valid ISO/IEC 27001 certificate but wants to strengthen its STAR entry with cloud-specific control detail. Which approach aligns with STAR Level 2 expectations?

  1. Claim Level 3 based on the certificate
  2. Replace the certificate with an internal memo
  3. Publish the ISO certificate alone and omit cloud-specific mappings
  4. Supplement the certificate with a CCM-mapped STAR attestation or CAIQ detail Correct answer.

Explanation

Combining the ISO certificate with CCM-mapped detail gives consumers cloud-specific control information while retaining independent certification. This aligns with how STAR entries can present supplementary evidence alongside a recognized certification.

Question 23STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

An organization is deciding between pursuing STAR Level 1 and Level 2 for a newly launched SaaS product. Which consideration most directly favors starting with Level 1?

  1. Level 1 automatically satisfies Level 2 requirements
  2. Level 1 includes continuous monitoring that Level 2 lacks
  3. Level 1 can be published quickly using internal CAIQ responses while Level 2 requires scheduling an independent audit Correct answer.
  4. Level 1 provides independent verification that customers demand

Explanation

Level 1 relies on internal completion of the CAIQ, which can be published faster than arranging an independent third-party audit for Level 2. This speed and lower cost make it a common starting point before pursuing Level 2.

Question 24STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A consumer is comparing two providers: Provider A has a Level 1 CAIQ stating full CCM coverage, and Provider B has a Level 2 SOC 2 Type II with two qualified exceptions. Which interpretation is most defensible?

  1. Provider B should be rejected outright because exceptions exist
  2. Provider B's independent report with disclosed exceptions offers more reliable, verifiable assurance Correct answer.
  3. Both entries provide identical assurance because both address CCM controls
  4. Provider A is more trustworthy because it reports no gaps

Explanation

An independent report that transparently discloses exceptions provides verifiable evidence and lets the consumer assess the significance of those exceptions. A self-declared claim of full coverage is less reliable precisely because it is unverified.

Question 25STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which scenario best illustrates a misuse of the STAR program's assurance levels?

  1. A provider publishes a CAIQ as a Level 1 entry and labels it as self-assessed
  2. A provider publishes a SOC 2 report as a Level 2 entry
  3. A provider pursues Level 3 after completing Level 2
  4. A provider markets a CAIQ-only entry as independently audited Level 2 Correct answer.

Explanation

Labeling a self-declared CAIQ as an independently audited Level 2 entry misrepresents the verification performed. Accurate level labeling is essential to the integrity of the STAR registry.

Question 26STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Under the STAR program, what is the primary distinction between Level 1 and Level 2 entries?

  1. Level 1 covers only infrastructure controls, while Level 2 covers only application-layer controls in the CCM.
  2. Level 1 is mandatory for all providers, while Level 2 is available only to providers already holding a STAR Level 3 certification.
  3. Level 1 requires an accredited auditor to review the CAIQ, while Level 2 is a self-declared questionnaire submitted without external review.
  4. Level 1 relies on a self-assessment published by the provider, while Level 2 requires independent third-party examination of controls against the CCM. Correct answer.

Explanation

STAR Level 1 is a self-assessment in which the provider completes the CAIQ and publishes the results itself; no independent party attests to the answers. STAR Level 2 requires an independent third-party assessment, such as a CCM-based audit, to verify that the stated controls are actually implemented. The difference is therefore the presence of independent verification, not the control scope or a prerequisite chain.

Question 27STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider completes a CAIQ and publishes it to the STAR registry without engaging any external party. Which assurance level does this entry represent?

  1. STAR Level 2
  2. STAR Level 3
  3. STAR Level 1 Correct answer.
  4. STAR Level 4

Explanation

A self-published CAIQ with no external examination is the defining characteristic of STAR Level 1. The provider answers the CCM-aligned questionnaire and makes the results publicly available on its own authority. Levels 2 and 3 require independent or continuous verification respectively, and there is no Level 4 in the program.

Question 28STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

In the STAR program, which party performs the assessment that supports a Level 2 entry?

  1. The provider's largest enterprise customer
  2. An independent third-party assessor or auditor Correct answer.
  3. The Cloud Security Alliance itself
  4. The provider's own internal audit function

Explanation

Level 2 entries rest on independent examination of the provider's controls against the CCM, carried out by a qualified third party rather than by the provider. This independence is what separates Level 2 from the self-declared Level 1. CSA administers the registry but does not itself perform the assessments.

Question 29STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which artifact is the standard questionnaire that a provider completes as the basis of a STAR Level 1 self-assessment?

  1. A SOC 2 Type II report
  2. An ISO/IEC 27017 statement of applicability
  3. The Consensus Assessments Initiative Questionnaire (CAIQ) Correct answer.
  4. The Cloud Controls Matrix (CCM) itself

Explanation

The CAIQ is the questionnaire through which providers document their control posture against the CCM for STAR self-assessment. The CCM is the control framework that the CAIQ maps to, not the questionnaire. SOC 2 reports and ISO statements of applicability are separate artifacts that may support other assurance routes.

Question 30STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider wants a Level 2 entry but has neither an ISO/IEC 27001 certificate nor a SOC 2 report. Which path remains available under the STAR program?

  1. Submitting the CAIQ to a customer for signature as evidence of independent review
  2. Publishing a CAIQ with a self-declared statement that all CCM controls are implemented
  3. Waiting for CSA to issue a certificate after reviewing the provider's internal wiki
  4. Engaging an independent assessor to perform a CCM-based third-party assessment of the provider's controls Correct answer.

Explanation

Level 2 accepts several bases, and a CCM-based third-party assessment performed by an independent assessor is one of them. This allows providers without an ISO certificate or SOC report to obtain independent verification against the CCM. Self-declaration and customer sign-off do not supply the required independence.

Question 31STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

An auditor is engaged to support a STAR Level 2 entry. Which approach best reflects the CCM-based third-party assessment model?

  1. Reviewing only the provider's marketing claims about security features
  2. Relying on the provider's prior self-assessment results without additional evidence gathering
  3. Confirming that the provider's CAIQ answers match the provider's own policy documents
  4. Evaluating whether the provider's implemented controls satisfy the CCM control objectives and reporting the results independently Correct answer.

Explanation

A CCM-based third-party assessment tests whether implemented controls meet the CCM objectives and results in an independent report on that evaluation. Merely matching questionnaire answers to internal policies does not test implementation. The assessor must gather its own evidence rather than accept prior self-assessment at face value.

Question 32STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which statement correctly describes the relationship between the CCM and a STAR Level 1 entry?

  1. The CCM is optional for Level 1 and is used only when the provider chooses to pursue Level 2.
  2. The CCM applies only to Infrastructure as a Service providers, so SaaS providers cannot reference it in Level 1.
  3. The CCM replaces the CAIQ entirely, so a Level 1 entry consists of the CCM spreadsheet with no questionnaire.
  4. The CAIQ answers in a Level 1 entry are structured around CCM control objectives, so the CCM provides the reference framework for the self-assessment. Correct answer.

Explanation

The CCM supplies the control objectives that the CAIQ questions map to, so a Level 1 self-assessment is anchored to the CCM framework. The provider answers the questionnaire, not the raw matrix. The CCM is not restricted to a single service model and is not deferred to Level 2.

Question 33STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider publishes a Level 1 entry and later undergoes an independent CCM-based assessment. How should the provider present these results in the STAR registry?

  1. Replace the Level 1 entry entirely, because a provider may hold only one STAR entry at a time.
  2. Maintain the Level 1 self-assessment and add a Level 2 entry reflecting the independent assessment, distinguishing the two assurance levels. Correct answer.
  3. Label the Level 1 entry as Level 2 without adding any assessment documentation.
  4. Merge both into a single entry labeled Level 3.

Explanation

Level 1 and Level 2 entries describe different assurance activities and can coexist, with each entry accurately reflecting the basis on which it was produced. Relabeling a self-assessment as Level 2 misrepresents the assurance obtained. Level 3 is a distinct continuous-monitoring option and is not created by merging entries.

Question 34STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A procurement team is evaluating a low-sensitivity internal tool and wants a quick, low-cost disclosure of a provider's CCM posture. Which STAR option fits that need best?

  1. STAR Level 1 self-assessment Correct answer.
  2. STAR Level 2 third-party audit
  3. STAR Level 3 continuous monitoring
  4. A bespoke on-site audit commissioned by the customer

Explanation

Level 1 provides a structured, publicly available disclosure of the provider's CCM-aligned posture at relatively low cost and effort, which suits low-sensitivity workloads. Level 2 and Level 3 add independent verification and continuous monitoring at higher cost and are justified when risk is greater. A bespoke customer audit is heavier than the situation requires.

Question 35STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider's Level 2 entry is supported by a CCM-based third-party assessment. What does this entry most directly tell a consumer?

  1. That the provider has been certified by CSA as compliant with all applicable laws.
  2. That the provider's customers have accepted the residual risk of the assessed controls.
  3. That an independent assessor examined the provider's controls against the CCM and reported on their implementation at the time of assessment. Correct answer.
  4. That the provider's controls have been continuously monitored in real time since the assessment.

Explanation

A Level 2 entry communicates that an independent party assessed the provider's controls against the CCM and documented the findings. It is a point-in-time or period-based examination, not continuous real-time monitoring, which is the Level 3 model. It does not constitute legal certification or customer risk acceptance.

Question 36STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A consumer needs assurance that a provider's controls were examined by an independent party against a recognized cloud control framework, but does not require continuous automated feeds. Which STAR level satisfies this requirement?

  1. STAR Level 1
  2. STAR Level 2 Correct answer.
  3. None of the STAR levels, because independence is never part of STAR
  4. STAR Level 3

Explanation

Level 2 delivers independent third-party examination of controls against the CCM, which matches the stated need for independent, framework-based assurance. Level 1 lacks independence, and Level 3 adds continuous monitoring beyond what is required. Independence is central to Level 2, so the claim that STAR never includes it is incorrect.

Question 37STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

Which situation would most clearly undermine the credibility of a provider's claimed STAR Level 2 entry?

  1. The assessment report identifies control gaps that the provider discloses alongside the entry.
  2. The assessment was scoped to the specific cloud service offered to customers.
  3. The independent assessment was performed by an assessor with no relationship to the provider's management.
  4. The entry cites a self-produced questionnaire as the sole basis for the Level 2 claim. Correct answer.

Explanation

Level 2 requires independent third-party assessment, so a self-produced questionnaire cannot substantiate the claim regardless of how it is labeled. Independence, disclosed gaps, and a service-specific scope are all consistent with a credible entry. The defect lies in the absence of independent examination.

Question 38STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

An organization must choose between Level 1 and Level 2 for a newly launched SaaS offering that handles regulated customer data. Which consideration most strongly favors Level 2?

  1. Level 2 is the only level that allows the provider to publish anything to the registry.
  2. Level 2 provides independent verification of controls, which regulated customers typically demand as evidence. Correct answer.
  3. Level 2 requires less documentation than Level 1 and can be completed faster.
  4. Level 2 removes the need to complete any CAIQ or reference the CCM.

Explanation

Regulated customers generally require evidence that controls have been independently examined, which is exactly what Level 2 supplies. Level 1 remains a self-declaration and may not satisfy such customers. Level 2 does not eliminate CCM alignment, and both levels permit registry publication.

Question 39STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

In the STAR program, which pairing of assurance level and verification mechanism is correct?

  1. Level 1 - government certification; Level 2 - self-assessment
  2. Level 1 - independent third-party assessment; Level 2 - continuous automated monitoring
  3. Level 1 - self-assessment; Level 2 - independent third-party assessment Correct answer.
  4. Level 1 - continuous automated monitoring; Level 2 - self-assessment

Explanation

The STAR levels are defined by increasing verification: Level 1 is a provider self-assessment, Level 2 adds independent third-party assessment, and Level 3 adds continuous monitoring. Any pairing that assigns self-assessment to Level 2 or third-party assessment to Level 1 misstates the model. Government certification is not a STAR mechanism.

Question 40STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)

A provider advertises 'STAR Level 2 compliant' but its registry entry links only to a CAIQ that the provider completed and posted itself. What is the most accurate assessment of this claim?

  1. The claim is unsupported because a self-posted CAIQ reflects Level 1 self-assessment, not independent third-party verification. Correct answer.
  2. The claim is valid because Level 2 does not require any external party.
  3. The claim is valid because CSA reviews every posted CAIQ before publication.
  4. The claim is valid because the CAIQ is mapped to the CCM.

Explanation

Level 2 depends on independent third-party assessment, and a self-completed, self-posted CAIQ supplies none. CCM mapping does not by itself create independent assurance, and CSA does not validate each posted questionnaire as an audit. The advertisement therefore overstates the assurance actually obtained.

Question 41Cloud Controls Matrix (CCM) framework

Under the CSA Cloud Controls Matrix, which statement best describes the relationship between the CCM and the Consensus Assessments Initiative Questionnaire (CAIQ)?

  1. The CAIQ replaces the CCM whenever a cloud provider is assessed against ISO/IEC 27001.
  2. The CAIQ defines control objectives while the CCM lists the audit evidence that satisfies each one.
  3. The CCM defines control objectives while the CAIQ provides corresponding yes/no and free-text questions used to evidence them. Correct answer.
  4. The CCM and CAIQ are identical documents published in different file formats for different audiences.

Explanation

The CCM is the control framework itself, organized by control domains and control specifications. The CAIQ operationalizes the CCM by turning each control into a set of assessment questions a provider answers, producing comparable disclosure. The two are complementary artifacts, not substitutes for one another.

Question 42Cloud Controls Matrix (CCM) framework

A cloud customer wants to understand how the CCM organizes its controls. Which structure does the CCM use at its top level?

  1. Control domains, each containing control specifications grouped by control area Correct answer.
  2. Service categories, each containing clauses grouped by audit phase
  3. Maturity levels, each containing process areas grouped by capability
  4. Risk registers, each containing threats grouped by likelihood band

Explanation

The CCM is organized into control domains (for example, governance, human resources, and data security), and each domain contains control areas and control specifications with defined control IDs. This domain-based layout lets auditors scope reviews by control family. Maturity levels and risk registers belong to other frameworks or methods, not to the CCM's structure.

Question 43Cloud Controls Matrix (CCM) framework

An auditor is reviewing a provider's CAIQ response and finds a control marked as not applicable. What is the most appropriate auditor action under STAR assessment practice?

  1. Reclassify the control as failed because an unanswered control cannot be audited.
  2. Remove the control from the assessment scope and note the removal in the final report only.
  3. Request the provider's documented justification for the exclusion and evaluate whether it is defensible. Correct answer.
  4. Accept the not-applicable marking without further inquiry because the provider chose it.

Explanation

A not-applicable determination is a provider assertion that must be supported by a documented rationale tied to the provider's actual service scope. The auditor evaluates whether that rationale holds, since unsupported exclusions can hide gaps. Simply accepting or silently dropping the control undermines the assessment.

Question 44Cloud Controls Matrix (CCM) framework

Which characteristic distinguishes the CCM from a generic IT security control catalog such as ISO/IEC 27002?

  1. The CCM controls are written specifically around cloud service provider and cloud customer responsibilities. Correct answer.
  2. The CCM controls are limited to physical data center security and exclude logical controls.
  3. The CCM controls apply only to software-as-a-service offerings and exclude infrastructure models.
  4. The CCM controls are mandatory only for government agencies in a single jurisdiction.

Explanation

The CCM was purpose-built for cloud computing, explicitly addressing the shared responsibilities between cloud providers and cloud customers. Generic catalogs cover broader IT environments without that cloud-specific split. The CCM spans all cloud service and deployment models rather than a single jurisdiction or delivery model.

Question 45Cloud Controls Matrix (CCM) framework

A provider maps its CCM controls to ISO/IEC 27001 during a STAR assessment. What is the primary purpose of such a mapping?

  1. To replace the auditor's testing with a simple cross-reference table.
  2. To allow the provider to drop any CCM control that has an ISO/IEC 27001 equivalent.
  3. To convert the STAR certification into an ISO/IEC 27001 certificate automatically.
  4. To demonstrate how existing certifications and controls satisfy CCM requirements and reduce duplicate evidence. Correct answer.

Explanation

Control mappings show how a provider's existing compliance work aligns with CCM objectives, which supports reuse of evidence and clarifies coverage. Mappings are aids to assessment, not a mechanism for deleting controls or substituting for testing. They also do not confer certification in another scheme.

Question 46Cloud Controls Matrix (CCM) framework

In the CCM, what does a control specification typically include?

  1. A vendor price list and a service-level credit schedule
  2. A list of named auditors authorized to test the control
  3. A marketing summary of the provider's product roadmap
  4. A control ID, the control specification text, and a defined control objective or requirement statement Correct answer.

Explanation

Each CCM control specification carries a unique control ID and a requirement statement describing what must be achieved. This structure allows consistent referencing in CAIQ responses, audit workpapers, and remediation tracking. Pricing, auditor rosters, and product roadmaps are not part of the control definition.

Question 47Cloud Controls Matrix (CCM) framework

An auditor is planning a STAR Level 2 assessment. Which evidence set is most consistent with the CCM requirements for that assessment?

  1. A self-completed CAIQ with no supporting documentation
  2. A marketing whitepaper describing the provider's security culture
  3. A completed CAIQ plus independent third-party audit evidence covering the in-scope CCM controls Correct answer.
  4. A penetration test report covering a single application endpoint

Explanation

STAR Level 2 requires independent third-party assessment of the CCM controls, supported by the CAIQ and evidence of control operation. A self-assessment alone corresponds to a lower assurance level. Whitepapers and single-scope test reports are insufficient to cover the control set.

Question 48Cloud Controls Matrix (CCM) framework

A provider claims that because it holds a STAR certification, every CCM control is fully implemented. How should an auditor interpret this claim?

  1. The claim should be tested against the certification's defined scope and any documented exclusions. Correct answer.
  2. The claim is valid because certification covers the entire CCM without exception.
  3. The claim is invalid because STAR certification never covers CCM controls.
  4. The claim is valid only if the provider also holds a SOC 2 report.

Explanation

Certification and assessment reports carry a defined scope, and exclusions or compensating controls may exist within it. The auditor verifies that the claimed coverage matches the documented scope rather than accepting a blanket statement. STAR certification is explicitly built on CCM controls, so denying any coverage is also incorrect.

Question 49Cloud Controls Matrix (CCM) framework

Which CCM control domain would most directly address the requirement to classify and handle data according to its sensitivity?

  1. Change Control and Configuration Management
  2. Data Security and Privacy Lifecycle Management Correct answer.
  3. Supply Chain Management, Transparency, and Accountability
  4. Logging and Monitoring

Explanation

Data classification, handling, and privacy lifecycle requirements sit within the data security and privacy domain of the CCM. Change control addresses modifications to systems, supply chain addresses third parties, and logging addresses event capture. None of those domains owns data classification as its primary focus.

Question 50Cloud Controls Matrix (CCM) framework

An auditor finds that a provider's CAIQ answers reference controls that are not described in any supporting policy. What is the most appropriate conclusion?

  1. The control should be marked compliant because policies are optional under the CCM.
  2. The provider should be asked to delete the CAIQ answer to avoid confusion.
  3. The control lacks sufficient evidence of design and should be flagged for follow-up testing. Correct answer.
  4. The control is implemented because the CAIQ answer asserts it.

Explanation

CAIQ responses are assertions, and assertions require corroborating evidence such as policies, procedures, and operating records. A missing policy reference indicates a possible design gap that warrants follow-up. Deleting the answer or accepting the assertion would defeat the purpose of independent assessment.