Your FREE CCSP Flashcards 2026 – 200+ Cards

Security duties split between cloud provider and customer; the boundary shifts by service model, but data and access are always the customer's.

On-demand network access to a shared pool of configurable computing resources, rapidly provisioned and released with minimal management effort (NIST SP 800-145).

On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.

A consumer can provision computing capabilities automatically, without human interaction with the provider.

Capabilities are available over the network and accessed through standard mechanisms across diverse client devices.

Provider resources are pooled to serve multiple consumers in a multi-tenant model, dynamically assigned and reassigned.

Capabilities scale out and in quickly, appearing unlimited to the consumer and matching demand.

Resource usage is metered and reported, enabling pay-per-use billing and optimization.

Infrastructure as a Service — provider supplies compute, storage, and networking; customer manages the OS, runtime, and applications.

Platform as a Service — provider supplies a managed platform/runtime; customer manages only the deployed application and its data.

Software as a Service — provider delivers a fully managed application; customer manages only data and limited settings.

The customer secures the most in IaaS and the least in SaaS; the provider's share grows from IaaS to SaaS.

Data classification and access management (IAM) — in every service model, regardless of provider.

The physical infrastructure and the virtualization/hypervisor layer — in every service model.

Cloud infrastructure provisioned for open use by the general public.

Cloud infrastructure provisioned for the exclusive use of a single organization.

Cloud infrastructure shared by several organizations with common concerns (mission, security, compliance).

A composition of two or more distinct clouds bound by technology enabling data and application portability.

Using cloud services from more than one provider, often to avoid lock-in or improve resilience.

The entity that offers and operates cloud services.

The entity that consumes cloud services.

An intermediary that manages the use, performance, and delivery of cloud services and negotiates relationships.

A conceptual model describing cloud roles, activities, and functions (NIST SP 500-292).

Abstracting physical resources into virtual instances so one host can run many isolated workloads.

OS-level virtualization packaging an app with its dependencies; shares the host kernel — lighter than a VM.

An architecture that decomposes an application into small, independently deployable services.

An execution model where the provider fully manages infrastructure and code runs in response to events.

Fine-grained network isolation policies down to individual workloads; a building block of zero trust.

Protecting data in use by processing it inside a hardware-based trusted execution environment (TEE).

Processing data near where it is generated to reduce latency and bandwidth use.

A model granting no implicit trust by network location; every request is authenticated, authorized, and continuously validated.

Build on the data lifecycle, BCDR planning, cost-benefit analysis, functional security requirements, and zero trust.

An international standard for evaluating the security assurance of a product or system.

The current U.S. federal standard for validating cryptographic modules (succeeding FIPS 140-2).

CSA's Security, Trust, Assurance and Risk registry — provider self-assessment (CAIQ) and third-party certification.

Cloud Controls Matrix — a vendor-neutral cloud security control framework mapped to major standards.

Consensus Assessments Initiative Questionnaire — a CSP self-assessment aligned to the CSA CCM.

Verify against criteria such as ISO/IEC 27017, Common Criteria, and FIPS 140-3, plus SOC 2 and CSA STAR.

Keeping one tenant's data and workloads separated from others in a multi-tenant cloud — a core security goal.

The ability of cloud systems to work together and exchange data, reducing lock-in.

The ability to move data and applications between providers without major rework.

A customer's ability to retrieve data and terminate a service so the provider can no longer access it.

Layering multiple, overlapping controls so one failure doesn't expose the asset.

Many customers sharing the same physical resources with logical isolation between them.

More control (IaaS) means more security responsibility; more convenience (SaaS) means less.

Six phases: Create, Store, Use, Share, Archive, Destroy.

Data is generated or modified; classify and label it as early as possible.

Data committed to storage; apply encryption at rest and access controls.

Data viewed or processed; enforce least privilege and information rights management.

Data made available to others; control egress with DLP and protect transit with TLS.

Data moved to long-term retention; apply retention policy, encryption, and integrity checks.

Permanent removal; in the cloud this means crypto-shredding (destroying the keys).

Block storage attached to a VM like a virtual hard disk (IaaS).

Storage of data as objects with metadata, accessed via API (e.g., buckets).

Temporary storage tied to a running instance; lost when the instance stops.

Structured fits a defined schema (databases); unstructured does not (documents, media).

Transforming plaintext into ciphertext with an algorithm and key; reversible only with the key.

Protecting stored data so it is unreadable without the key.

Protecting data moving across networks, typically with TLS.

Protecting data while processed, via confidential computing / trusted execution environments.

A system that generates, stores, rotates, and retires cryptographic keys.

Bring Your Own Key — the customer generates or imports keys into the provider's KMS.

Hold Your Own Key — the customer keeps and controls keys entirely outside the provider's environment.

Storing a copy of keys with a trusted third party for recovery or lawful access.

Replacing sensitive data with a non-sensitive token mapped to the real value in a separate secure vault.

Tokenization swaps data for a vault-mapped token (no key on the data); encryption transforms data with a key.

Substituting or scrambling data while preserving its format, typically for test/dev use.

Irreversibly removing identifiers so data can never be re-linked to an individual.

Replacing identifiers with pseudonyms that can be re-linked only with separate, protected information.

Umbrella term for hiding sensitive data (masking, anonymization, tokenization).

Splitting data into fragments stored across locations (cloud RAID-like) for resilience.

Dividing encrypted data into segments distributed across storage so no node holds usable data.

Cryptographic erasure — making data unrecoverable by destroying its encryption keys.

Residual data that may persist on shared media you cannot physically wipe — solved by crypto-shredding.

Data Loss Prevention — discover, monitor, and block unauthorized exfiltration of sensitive data.

Discovery, monitoring, and enforcement.

Finding and locating sensitive data across structured, unstructured, and semi-structured stores.

Categorizing data by sensitivity so the right protection, retention, and destruction rules apply.

Tagging data with classification and handling metadata.

Information Rights Management — persistent access and usage controls bound to a data object wherever it travels.

Rules for how long data must be kept before deletion or archiving.

Suspending normal deletion to preserve data relevant to litigation or investigation.

Logging data events to provide traceability, accountability, and nonrepudiation.

Documented handling of evidence that preserves its integrity and legal admissibility.

Assurance that an actor cannot deny having performed an action.

A one-way function producing a fixed-length digest used to verify integrity.

The principle that data is subject to the laws of the country where it is stored.

The physical or geographic location where data is stored.

Uses one shared secret key for both encryption and decryption (e.g., AES); fast.

Uses a public/private key pair (e.g., RSA, ECC); solves key exchange and enables signatures.

Advanced Encryption Standard — the dominant symmetric block cipher used for cloud data at rest.

Transport Layer Security — the protocol that protects data in transit (HTTPS).

Documenting how data moves through systems to find where to apply controls.

Common for payment card (PAN) data because the token carries no exploitable value if stolen.

Periodically replacing keys to limit exposure if a key is compromised.

Physical environment, network and communications, compute, virtualization, storage, and the management plane.

The centralized console/API to provision and control cloud resources — the highest-value target.

Compromising it can give an attacker control of the entire cloud environment at once.

Software that creates and runs virtual machines, allocating host resources to guests.

Bare-metal — runs directly on hardware, no host OS; smaller attack surface; used in production cloud.

Hosted — runs atop a host OS; larger attack surface; used for desktop labs.

Type 1 (bare-metal), because there is no host OS to compromise.

An attack where a guest VM breaks isolation to reach the hypervisor or host, threatening other tenants.

Uncontrolled growth of virtual machines, increasing attack surface and management burden.

Containers share the host kernel, so a kernel compromise can affect all containers on the host.

Securing the processing resources (CPU/memory) allocated to workloads.

Protecting the storage layer with encryption, access control, and isolation.

Securing communications with segmentation, firewalls, and encryption in transit.

Uptime Institute Tiers I–IV rate data-center redundancy and availability (IV = highest).

Heating, ventilation, and air conditioning maintain environmental conditions for reliability.

Logical design defines structure/relationships; physical design defines actual hardware and layout.

Identify, analyze, and mitigate cloud-specific threats, vulnerabilities, and attacks.

Physical/environmental, system/communication, virtualization protection, IAM, and audit mechanisms.

Log collection, log correlation, and packet capture for monitoring and investigation.

Business Continuity and Disaster Recovery — plans to maintain and restore operations after a disruption.

Recovery Time Objective — the maximum acceptable time to restore a process after a disruption.

Recovery Point Objective — the maximum acceptable data loss measured backward in time; drives backup frequency.

Recovery Service Level — the percentage of full compute capacity a process needs during a disaster.

RTO = time to recover; RPO = how much data you can afford to lose.

Define business requirements, create the strategy, implement it, and test it.

Designing systems to remain operational despite component failures.

Linking servers so they act as one system for availability and load distribution.

Duplicating components so a failure does not cause an outage.

Automatically switching to a standby system when the primary fails.

Using public cloud capacity to handle demand spikes beyond a private cloud's capacity.

A breakdown in separation that lets one tenant access another's data or workloads.

Building security into every phase of software development rather than testing for it at the end.

Requirements/training, design, develop, test, deploy, operate/maintain.

Systematically identifying and prioritizing threats to a system during design.

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

A risk-rating model: Damage, Reproducibility, Exploitability, Affected users, Discoverability.

Process for Attack Simulation and Threat Analysis — a risk-centric threat-modeling methodology.

Static Application Security Testing — analyzing source or binary code without executing it.

Dynamic Application Security Testing — testing a running application from the outside.

Interactive AST — instrumenting a running app to combine static and dynamic analysis.

Software Composition Analysis — identifying open-source components and their known vulnerabilities.

SAST inspects code early; DAST tests the running app for runtime/config flaws.

A community list of the most critical web application security risks.

A list of the most dangerous software errors (CWE).

Checking and sanitizing all input to prevent injection and other attacks — never trust user input.

Inserting malicious SQL via unvalidated input to read or alter a database.

Application Security Verification Standard — a framework of security requirements for testing apps.

Securing third-party, open-source, and vendor components and their provenance.

Using approved, validated APIs and components from trusted sources.

Isolating execution so untrusted code cannot affect the wider system.

Running an application in an isolated environment abstracted from the OS.

Automating the deployment, scaling, and management of containers/workloads (e.g., Kubernetes).

Web Application Firewall — filters and monitors HTTP traffic to protect web applications.

A managed entry point enforcing authentication, rate limiting, and routing for APIs.

Database Activity Monitoring — real-time monitoring of database transactions.

A device/service that inspects and filters XML traffic to protect web services.

Identity and Access Management — the framework for managing digital identities and access rights.

Linking a user's identity across multiple systems or organizations.

A service that authenticates users and issues identity assertions to relying parties.

Single Sign-On — one authentication grants access to multiple systems.

Multi-Factor Authentication — verifying identity with two or more independent factors.

An XML-based standard for federated authentication and web single sign-on.

An authorization framework granting an app delegated access to resources without sharing credentials.

An authentication layer built on OAuth 2.0 that adds identity (who the user is).

SAML and OIDC handle authentication; OAuth 2.0 alone handles authorization (delegated access).

Cloud Access Security Broker — a policy enforcement point giving visibility, compliance, data security, and threat protection.

Visibility, compliance, data security, and threat protection.

Securely storing and controlling access to credentials, keys, and tokens used by applications.

Designing systems so cryptographic algorithms can be swapped without major rework.

Public Key Infrastructure — the framework of certificate authorities and certificates that manages public keys.

A hash encrypted with the signer's private key, providing integrity, authenticity, and nonrepudiation.

Granting only the minimum access needed to perform a task, and nothing more.

Splitting a sensitive task so no single person can complete it alone.

Testing how an application behaves under intentional misuse, not just normal use.

Securing firmware settings to reduce the attack surface of a host before the OS loads.

Trusted Platform Module — a hardware chip that stores keys and supports host attestation.

Verifying the integrity and trust state of a host before extending trust to it.

Configuring an OS to a secure baseline by removing unneeded services and applying secure settings.

Identifying, testing, and applying updates to fix vulnerabilities promptly.

Defining and provisioning infrastructure through machine-readable config files for consistency.

A hardened intermediary host used to access systems in a protected network.

An encrypted protocol for secure remote administration.

Remote Desktop Protocol — remote GUI access that must be secured (MFA, restricted exposure).

The ability to grow or shrink capacity to meet demand while remaining available.

A framework of IT service management best practices used to run cloud operations.

The international standard for an IT service management system.

Evaluating, approving, and documenting changes — prevents most cloud incidents.

Tracking the state and relationships of assets across the environment.

Controlling repeatable, low-risk rollouts of changes.

Identifying and eliminating the root causes of recurring incidents.

Detecting, responding to, and recovering from security/operational events.

Defining, meeting, and reporting on service-level agreements (SLAs).

Ensuring services meet agreed availability targets.

Ensuring sufficient resources to meet current and future demand.

The team and function that monitors and responds to security events.

Security Information and Event Management — aggregates and correlates logs for detection and investigation.

Collecting, retaining, and protecting logs to support detection and forensics.

Collecting and analyzing evidence in the cloud, where you don't control the physical media.

Guidelines for identification, collection, acquisition, and preservation of digital evidence.

Standard for electronic discovery (eDiscovery).

Handling evidence to preserve integrity and an unbroken chain of custody.

Scanning systems to identify and prioritize known weaknesses.

Coordinating with vendors, customers, partners, regulators, and stakeholders during operations and incidents.

Multi-tenancy, data location, and provider dependence make evidence collection complex.

A documented minimum secure configuration applied consistently across systems.

A decoy system used to detect, deflect, or study attackers.

Synchronizing clocks (e.g., NTP) so correlated logs have consistent, comparable timestamps.

Ongoing assessment of security controls and posture to detect drift and threats.

Different countries' laws can impose contradictory obligations on cloud data — a key legal risk.

The EU General Data Protection Regulation governing the processing of personal data.

Under GDPR, the entity that decides why and how personal data is processed.

Under GDPR, a party that processes personal data on the controller's instructions (often the CSP).

Personally Identifiable Information — data that can identify an individual.

Personal data protected by law (e.g., HIPAA, GDPR) with statutory penalties for breach.

Personal data protected because a contract requires it (e.g., PCI DSS), with contractual consequences.

Regulated PII is mandated by law; contractual PII is mandated by agreement.

A code of practice for protecting PII in public clouds acting as PII processors.

Generally Accepted Privacy Principles — a privacy management framework.

A structured assessment of the privacy risks of a system or process.

Identification, collection, and production of electronically stored information for legal matters.

An attestation report on controls relevant to financial reporting.

A report on controls for security, availability, processing integrity, confidentiality, and privacy.

A public, summary version of a SOC 2 report with no sensitive detail.

Type I tests control design at a point in time; Type II tests operating effectiveness over a period.

SOC 2 — customers request it to assess a provider's security and privacy controls.

Attestation standards under which SOC 1 reports are produced.

Comparing current controls against a required standard to find shortfalls.

Internal audit is performed by the organization; external audit by an independent third party.

Information Security Management System — a governed framework of policies and controls (ISO/IEC 27001).

The international standard for an Information Security Management System.

A contract clause letting the customer assess a provider's controls (often satisfied by SOC 2 / ISO certs).

Service Level Agreement — a contractual commitment on service performance and availability metrics.

Difficulty migrating away from a provider due to proprietary dependencies.

Right to audit, SLAs/metrics, data access/location, termination, litigation, insurance, and assurance.

Avoid, mitigate, transfer/share, or accept the risk.

The amount of risk an organization is willing to accept in pursuit of its objectives.

An organization's overall exposure to risk across its assets and activities.

An international standard providing principles and guidelines for risk management.

The NIST Risk Management Framework for selecting, implementing, and monitoring controls.

The European Union Agency for Cybersecurity, which publishes cloud risk guidance.

Spreading control across a provider changes accountability and complicates risk management.

Managing information security risk in supplier and outsourcing relationships.

Insurance that transfers some financial impact of a cyber incident to an insurer.

Even when a provider holds the data, the customer stays accountable for protecting it.

Evaluating a provider's controls, methodologies, policies, risk profile, and risk appetite.

A U.S. government program standardizing the security assessment and authorization of cloud services.

Contractual and legal obligations for collecting and preserving cloud evidence.

Providers often limit what a customer audit can cover, hence reliance on third-party reports.

Defines how a relationship ends and how data is returned or destroyed, reducing lock-in.

Restricting where data may be stored or accessed to meet residency/sovereignty rules.