Free Cloud Security Alliance CCSK Practice Exam with Questions & Answers | Set: 2

Federated Identity Management (FIM) is designed to allow users to access multiple, separate systems using a single set of credentials, usually managed through trust relationships between Identity Providers (IdPs) and Service Providers (SPs). This process enables Single Sign-On (SSO) across cloud and on-premise services, reducing password fatigue and improving administrative efficiency.

Key federation protocols such as SAML, OAuth, and OpenID Connect are standard in establishing secure identity federation. FIM is especially beneficial in hybrid and multi-cloud environments where users must access numerous services seamlessly.

This is emphasized in Domain 12: Identity, Entitlement, and Access Management of the CCSK guidance, which highlights how identity federation enhances user experience, improves security, and enables scalability.

Serverless computing (Function as a Service - FaaS) is designed for auto-scaling, high availability, and reduced management overhead. It enables developers to focus on writing code without managing the underlying infrastructure. This makes it an ideal solution for new or unpredictable workloads.

As explained in CSA Security Guidance v4.0 – Domain 1: Cloud Computing Concepts and Architectures:

“Serverless computing abstracts infrastructure management and allows automatic scaling of application functions in response to demand. This reduces operational overhead and enables teams to deploy scalable solutions rapidly.”

(CSA Security Guidance v4.0, Domain 1: Cloud Computing Concepts and Architectures)

Why not the others?

A. While cost benefits exist, it's not the core benefit of serverless.

C. Configuration may be minimal, but not exclusive to serverless.

D. Serverless removes control over the underlying server environment.

The Continuous Delivery and Deployment phase emphasizes deploying applications securely, ensuring infrastructure security is prioritized during deployment. Reference: [CCSK v5 Curriculum, Domain 10 - Secure Development Lifecycle]

Documenting lessons learned is essential in the post-incident phase, as it helps improve future incident response processes. Reference: [Security Guidance v5, Domain 11 - Incident Response]

Cloud telemetry provides detailed insights and visibility into security events and system behaviors in cloud environments, which helps detect and respond to threats. Reference: [Security Guidance v5, Domain 6 - Security Monitoring]

Cloud computing uses abstraction and automation to pool and distribute resources efficiently among multiple tenants. This allows dynamic allocation based on demand. Reference: [CCSK v5 Curriculum, Domain 1 - Cloud Computing Models]