Certified Cloud Security Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Essential characteristics of cloud

NIST SP 800-145 lists on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A deployment missing measured service or pooling is not cloud under this definition.

Residual risk

The risk remaining after controls are applied. It equals inherent risk reduced by control effectiveness, and must be formally accepted by an accountable business owner with a documented review date.

Compensating control

An alternative control used when the primary control is infeasible, such as network isolation plus strict logging instead of full disk encryption on a legacy appliance. It must be documented and risk-accepted.

CSA Cloud Controls Matrix

A cloud-specific control framework with mappings to ISO 27001, NIST, PCI DSS, and HIPAA. It is used as a crosswalk and gap-analysis tool, not as a certification or attestation.

Shared responsibility boundary

The dividing line between provider-secured and customer-secured controls. It moves with the service model: IaaS leaves the OS to the customer, SaaS leaves mainly data and identity configuration.

Service control policy

An organization-level guardrail that sets the maximum permissions any principal in a member account can hold. It never grants permissions; it only filters what identity policies can allow.

Security group versus NACL

Security groups are stateful, attached to instances, and allow-only. Network ACLs are stateless, attached to subnets, and support ordered allow and deny rules evaluated by number.

Landing zone

A preconfigured, governed multi-account baseline covering identity, logging, networking, guardrails, and billing. Workloads deploy into member accounts, never into the management account.

Immutable infrastructure

A model where servers are rebuilt from a known-good image rather than patched in place. It eliminates configuration drift and shortens the persistence window of a compromised host.

Availability zone fault domain

An isolated datacenter group within a region with independent power and networking. Designing across at least two zones removes single-zone failure as a cause of outage.

Policy evaluation order

Cloud authorization evaluates explicit deny first, then explicit allow, then implicit deny. Any matching deny wins regardless of other allows, including from permission boundaries and guardrails.

Permission boundary

A policy that caps the maximum permissions an identity policy can grant to a principal. It does not grant access itself; effective permissions are the intersection of both.

Phishing-resistant MFA

Authentication bound to origin, such as FIDO2 security keys or passkeys. Push notifications and SMS are bypassable by real-time relay phishing and are not considered phishing-resistant.

Envelope encryption

A key hierarchy where a root key protects data keys, and data keys encrypt the data. The root key never leaves the key service, so rotation and access control are centralized.

Privilege escalation via PassRole

A principal allowed to pass a role to a compute service can inherit that role's permissions. Restrict which roles can be passed and to which services.

ABAC versus RBAC

RBAC grants by role membership; ABAC grants by attributes such as resource tags, department, or environment. ABAC scales better in large estates but depends on accurate tagging.

BOLA

Broken object-level authorization: an API returns another user's object because the identifier is trusted without an ownership check. It is the most common cloud API vulnerability class.

IaC scanning

Static analysis of infrastructure-as-code templates that flags misconfiguration such as public buckets or open security groups before deployment. It complements, not replaces, runtime drift detection.

Software bill of materials

A machine-readable inventory of components and versions in an artifact. It lets teams answer within hours whether a newly disclosed CVE affects deployed software.

Container admission control

A policy gate at deploy time that rejects images failing signature, vulnerability, or configuration checks. It enforces supply-chain rules that scanning alone only reports.

Serverless execution role

The identity a function assumes at runtime. Over-broad roles turn an injection flaw into full account compromise, so each function should have its own least-privilege role.

Control-plane audit log

A record of management API calls showing who changed what, from where, and when. It is the primary timeline source for cloud incident investigations and must be centralized.

Cloud containment order

Revoke or rotate credentials, isolate the instance with a restrictive security group, snapshot volumes and export logs, then remediate. Snapshot before termination to preserve evidence.

Break-glass account

A sealed emergency identity with strong MFA, restricted use, and alerting on every login. It exists for loss of the primary identity path and is reviewed after each use.

Impossible travel alert

A detection that flags one identity authenticating from geographically distant locations within a physically impossible interval. It indicates credential compromise or token replay.

VPC flow logs

Records of accepted and rejected IP traffic to and from network interfaces. They show connection metadata, not payload, and are essential for scoping lateral movement during response.

Log retention setting

The configured period before logs are deleted. Cloud default retention is often short or unset, so logs can vanish before an investigation begins unless retention is explicitly configured.

SOC 2 Type II

An attestation covering a period that tests whether controls operated effectively, unlike Type I which assesses design at a single point in time. Type II is stronger vendor evidence.

Subservice organization carve-out

A vendor's attestation may exclude controls it delegates to subcontractors. Carve-out means the customer must assess those subservice organizations separately; inclusive means they are covered.

Data residency versus sovereignty

Residency is where data is physically stored; sovereignty is which legal jurisdiction can compel access. Storing data locally with a foreign-held key may not satisfy sovereignty.

Policy as code

Compliance rules expressed as machine-evaluated code against live resource state. It provides continuous evidence instead of point-in-time audit snapshots that go stale quickly.

Vendor exit strategy

A documented plan covering data export formats, egress cost, key custody, and certified deletion. Without it, lock-in becomes a compliance risk when deletion cannot be proven.