ALIBABA-CSA Practice Test

ALIBABA-CSA practice test: what's covered

• RAM
• Security Center
• Cloud Firewall
• Anti-DDoS
• WAF
• ActionTrail
• Bastionhost
• KMS

Free ALIBABA-CSA sample questions

1. A startup wants developers to manage ECS instances but not change billing or RAM users. Which response is the BEST fit?

   • A. Create a RAM policy granting only required ECS actions and attach it to a developer group
   • B. Share the root account access key with developers
   • C. Grant AdministratorAccess to everyone until audit time
   • D. Use security groups as the only identity control
   Show answer

   Correct: A. Create a RAM policy granting only required ECS actions and attach it to a developer group is the best answer because RAM policies provide least-privilege identity authorization for Alibaba Cloud resources. The other choices do not fit the scenario: Share the root account access key with developers addresses the wrong layer or timing, Grant AdministratorAccess to everyone until audit time skips a required control, and Use security groups as the only identity control would create avoidable operational or security risk.

2. A production automation job needs API access to create snapshots. Which response is the BEST fit?

   • A. Use a RAM role or user with scoped permissions and protected access keys, rotating credentials as required
   • B. Embed the root account key in the script
   • C. Use a personal employee password in cron
   • D. Disable snapshot permissions and rely on manual backups
   Show answer

   Correct: A. Use a RAM role or user with scoped permissions and protected access keys, rotating credentials as required is the best answer because automation credentials should be scoped and protected, never root credentials. The other choices do not fit the scenario: Embed the root account key in the script addresses the wrong layer or timing, Use a personal employee password in cron skips a required control, and Disable snapshot permissions and rely on manual backups would create avoidable operational or security risk.

3. An external partner needs temporary access to one OSS bucket. Which response is the BEST fit?

   • A. Use a RAM role, STS temporary credentials, or tightly scoped bucket policy for the partner use case
   • B. Create a permanent root access key for the partner
   • C. Make every bucket public-read-write
   • D. Email the console password to the partner team
   Show answer

   Correct: A. Use a RAM role, STS temporary credentials, or tightly scoped bucket policy for the partner use case is the best answer because temporary and scoped access reduces third-party risk. The other choices do not fit the scenario: Create a permanent root access key for the partner addresses the wrong layer or timing, Make every bucket public-read-write skips a required control, and Email the console password to the partner team would create avoidable operational or security risk.

4. A security baseline is being created for Alibaba Cloud accounts. Which TWO choices should the engineer select? (Choose TWO)

   • A. Enable MFA for privileged users and protect root account usage
   • B. Use least-privilege RAM groups and roles for daily administration
   • C. Use one shared administrator for all engineers
   • D. Store access keys in public code repositories
   Show answer

   Correct: A and B. Enable MFA for privileged users and protect root account usage and Use least-privilege RAM groups and roles for daily administration are correct because identity security starts with MFA, root protection, least privilege, and secret hygiene. The distractors do not satisfy the requirement: Use one shared administrator for all engineers is incomplete for this case, and Store access keys in public code repositories solves a different problem or weakens the design.

5. A user can delete logs even though they should only read them. Which response is the BEST fit?

   • A. Review attached RAM policies and remove write or delete actions from the user or group
   • B. Change the VPC CIDR because CIDR controls log deletion
   • C. Move logs to a different browser bookmark
   • D. Grant more permissions to make behavior consistent
   Show answer

   Correct: A. Review attached RAM policies and remove write or delete actions from the user or group is the best answer because authorization errors should be fixed in RAM policy permissions. The other choices do not fit the scenario: Change the VPC CIDR because CIDR controls log deletion addresses the wrong layer or timing, Move logs to a different browser bookmark skips a required control, and Grant more permissions to make behavior consistent would create avoidable operational or security risk.

Last updated: 2026-10-19

ALIBABA-CSA practice test FAQ