CCAK Reviews Questions

 Cloud service providers offer application programming interfaces (APIs) to encourage clients to extend the cloud platform. APIs are sets of rules and protocols that define how different software components or applications can communicate and interact with each other. APIs enable clients to access the cloud services and data, integrate them with their own applications or systems, and customize or enhance their functionality and performance. APIs also allow clients to leverage the cloud platform’s features and capabilities, such as scalability, reliability, security, and analytics.12

Some examples of cloud service providers that offer APIs are Google Cloud, Microsoft Azure, Amazon Web Services (AWS), IBM Cloud, and Oracle Cloud. These providers offer various types of APIs for different purposes and domains, such as compute, storage, database, networking, artificial intelligence, machine learning, big data, internet of things, and blockchain. These APIs help clients to build, deploy, manage, and optimize their cloud applications and solutions.34567

References := What is an API? - Definition from WhatIs.com1; What is a Cloud API? - Definition from Techopedia2; Cloud APIs | Google Cloud3; Cloud Services - Deploy Cloud Apps & APIs | Microsoft Azure4; AWS Application Programming Interface (API) | AWS5; IBM Cloud API Docs6; Oracle Cloud Infrastructure API Documentation

A detective control is a type of internal control that seeks to uncover problems in a company’s processes once they have occurred1. Examples of detective controls include physical inventory checks, reviews of account reports and reconciliations, as well as assessments of current controls1. Detective controls use platform telemetry to detect misconfigurations, vulnerabilities, and potentially malicious activity in the cloud environment2.

In a Software as a Service (SaaS) service provider, privileged access monitoring is a detective control that can help identify unauthorized or suspicious activities by users who have elevated permissions to access or modify cloud resources, data, or configurations. Privileged access monitoring can involve logging, auditing, alerting, and reporting on the actions performed by privileged users3. This can help detect security incidents, compliance violations, or operational errors in a timely manner and enable appropriate responses.

Data encryption, incident management, and network segmentation are examples of preventive controls, which are designed to prevent problems from occurring in the first place. Data encryption protects the confidentiality and integrity of data by transforming it into an unreadable format that can only be decrypted with a valid key1. Incident management is a process that aims to restore normal service operations as quickly as possible after a disruption or an adverse event4. Network segmentation divides a network into smaller subnetworks that have different access levels and security policies, reducing the attack surface and limiting the impact of a breach1.

References:

• Detective controls - SaaS Lens - docs.aws.amazon.com3, section on Privileged access monitoring
• Detective controls | Cloud Architecture Center | Google Cloud2, section on Detective controls
• Internal control: how do preventive and detective controls work?4, section on SaaS Solutions to Support Internal Control
• Detective Control: Definition, Examples, Vs. Preventive Control1, section on What Is a Detective Control?

 Dynamic application security testing (DAST) is a method of testing the security of an application by simulating attacks from an external source. DAST does not require access to the source code or binaries of the application, unlike static application security testing (SAST), which analyzes the code for vulnerabilities. Therefore, DAST is a black box testing technique, meaning that it does not need any knowledge of the internal structure, design, or implementation of the application. DAST is also programming language agnostic, meaning that it can test applications written in any language, framework, or platform. This makes DAST more flexible and adaptable to different types of applications and environments. However, DAST also has some limitations, such as being slower, less accurate, and more dependent on the availability and configuration of the application. References:

• SAST vs. DAST: What’s the Difference?
• SAST vs DAST: What’s the Difference?
• SAST vs. DAST: Enhancing application security

The primary purpose of the Open Certification Framework (OCF) for the CSA STAR program is to provide global, accredited, and trusted certification of the cloud service provider. According to the CSA website1, the OCF is an industry initiative to allow global, trusted independent evaluation of cloud providers. It is a program for flexible, incremental and multi-layered cloud provider certification and/or attestation according to the Cloud Security Alliance’s industry leading security guidance and control framework. The OCF aims to address the gaps within the IT ecosystem that are inhibiting market adoption of secure and reliable cloud services. The OCF also integrates with popular third-party assessment and attestation statements developed within the public accounting community to avoid duplication of effort and cost. The OCF manages the foundation that runs and monitors the CSA STAR Certification program, which is an assurance framework that enables cloud service providers to embed cloud-specific security controls. The STAR Certification program has three levels of assurance, each based on a different type of audit or assessment: Level 1: Self-Assessment, Level 2: Third-Party Audit, and Level 3: Continuous Auditing. The OCF also oversees the CSA STAR Registry, which is a publicly accessible repository that documents the security controls provided by various cloud computing offerings2. The OCF helps consumers to evaluate and compare their providers’ resilience, data protection, privacy capabilities, and service portability. It also helps providers to demonstrate their compliance with industry standards and best practices.

References:

• Open Certification Framework Working Group | CSA
• STAR | CSA