CCSP Cloud Data Security — 15 Questions

Question 1

A healthcare organization is storing protected health information (PHI) in a cloud object storage service. They want to ensure that if a storage bucket is accidentally made public, the data remains unreadable. Which combination of controls best addresses this risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable server-side encryption with AES-256 and block public access. The risk is that a bucket becomes public and PHI is exposed. Server-side encryption with AES-256 ensures data at rest is encrypted, so even if the bucket is made public, the objects are unreadable without the key. Blocking public access at the account/bucket level prevents the misconfiguration from ever exposing the data in the first place. Together, these two controls provide defense in depth: prevention (block public access) and mitigation (encryption).

Answer

Apply data classification labels and enable DLP scanning

Answer

Enable bucket versioning and cross-region replication

Answer

Use pre-signed URLs and IAM policies

Question 2

A cloud security engineer is configuring a Data Loss Prevention (DLP) API to scan a cloud storage bucket for personally identifiable information (PII). Which of the following is a de-identification technique that replaces sensitive values with a token that can be mapped back to the original data using a secure lookup table?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a non-sensitive token that has no intrinsic meaning, and the mapping between token and original value is stored in a secure lookup table (token vault). This allows authorized systems to detokenize and recover the original data, which matches the scenario described.

Answer

Pseudonymization

Answer

Bucketing

Answer

Masking

Question 3

An organization wants to use cloud KMS to manage encryption keys. They require automatic key rotation every 90 days and the ability to define granular access policies for who can use the keys. Which key management model should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) in a cloud KMS allow the organization to control key rotation schedules (e.g., every 90 days) and define granular IAM policies for key usage. This meets both requirements for automatic rotation and fine-grained access control. CMEK is the standard model for organizations needing control over keys in the cloud.

Answer

Cloud provider default encryption

Answer

Customer-supplied encryption keys (CSEK)

Answer

Bring your own key (BYOK)

Question 4

A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?

Accepted Answer

Continue using client-side encryption and provide the analytics service with the encryption key. To keep the cloud provider from accessing keys while still allowing a cloud analytics service to process the data, the customer must retain control of the key and explicitly provide it to the analytics service. Continuing client-side encryption and sharing the key with the analytics service (via secure key exchange, not storage in the cloud) preserves the provider's inability to decrypt while enabling processing.

Answer

Use client-side encryption but store the key in the cloud provider's key vault

Answer

Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data

Answer

Switch to server-side encryption with customer-managed keys and grant the analytics service access to the key management service (KMS)

Question 5

A data lifecycle policy requires that data be destroyed after a retention period. In a cloud object storage service, what is the most secure method to ensure that data is irretrievably destroyed?

Accepted Answer

Use a lifecycle policy to expire objects and delete delete markers. In S3-compatible object storage, versioning means a simple DELETE only inserts a delete marker rather than removing the object's data. A lifecycle policy configured to expire both current versions and noncurrent versions (and to remove expired delete markers) is the only mechanism that guarantees the underlying object data and all versions are permanently purged. This is the cloud-native, provider-managed way to achieve irretrievable destruction without relying on overwrite semantics that object stores do not honor.

Answer

Overwrite the objects with random data multiple times before deletion

Answer

Enable MFA delete and then delete the objects

Answer

Delete the objects and then delete the bucket

Question 6

An organization is deploying a cloud DLP solution to scan data at rest. They want to automatically classify and tag sensitive data, and then apply access controls based on the tags. Which cloud service capability is most directly used to enforce access decisions based on data classification tags?

Accepted Answer

IAM policies with tag-based conditions. Cloud services often use IAM policies that can conditionally grant access based on resource tags. For example, an organization can define a policy that allows access only if the resource has a specific tag, such as classification=confidential.

Answer

Cloud storage bucket policies with principal identification

Answer

Object storage ACLs with predefined permissions

Answer

Time-limited access URLs with expiration time

Question 7

A healthcare organization is migrating electronic health records to the cloud and must comply with data residency requirements that mandate all patient data remain within the European Union. The cloud provider offers multiple regions globally. Which of the following is the most appropriate action to ensure compliance?

Accepted Answer

Select a cloud region located in the European Union for data storage.. Selecting a cloud region located within the EU (e.g., Frankfurt or London) physically stores data in that geography, satisfying data residency requirements. Object-level access controls manage permissions but do not affect data location. Data classification is a governance step but does not ensure residency. Cross-region replication to a secondary EU region would keep data within the EU, but it is not the most appropriate action because the requirement is met by simply storing in a single EU region; replication adds unnecessary complexity and potential compliance risks if not managed properly.

Answer

Enable cross-region replication to a secondary EU region.

Answer

Configure object-level access controls to restrict access to EU-based users only.

Answer

Apply data classification labels to all objects to indicate EU data.

Question 8

A company is implementing a data loss prevention (DLP) strategy for cloud storage. They need to detect and mask credit card numbers in documents stored in a cloud storage bucket. The DLP service provides de-identification transforms including masking, tokenization, and pseudonymization. Which transform should the company use to irreversibly replace the credit card numbers with a placeholder while maintaining the original format for analytics?

Accepted Answer

Masking. Masking is the de-identification transform that irreversibly replaces sensitive data (like credit card numbers) with a placeholder while maintaining the original format. For example, replacing all but the last four digits with asterisks or a fixed character. This allows analytics on the masked data without exposing the original values, and it is irreversible, meaning the original data cannot be recovered from the masked output.

Answer

Pseudonymisation

Answer

Bucketing

Answer

Tokenization

Question 9

A cloud security architect is designing access controls for a cloud storage bucket that contains sensitive customer data. The architect needs to implement a solution that provides granular, time-limited access to specific objects for external auditors. Which TWO methods should the architect consider? (Select TWO.)

Accepted Answer

Signed URLs. Signed URLs (B) and pre-signed URLs (E) are the correct choices because both provide granular, time-limited access to specific objects in a cloud storage bucket without requiring the external auditors to have credentials or IAM permissions. A signed URL embeds a cryptographic signature and expiration time, granting temporary access to a single object for anyone possessing the URL, which is ideal for external parties like auditors. A pre-signed URL works on the same principle (the terms are often used interchangeably across providers such as AWS S3, GCP, and Azure Blob), allowing the architect to scope access to a specific object and set a short expiry. Bucket policies (A) are persistent resource-based policies that grant broader, non-time-limited access and are not suited for temporary auditor access to individual objects. IAM roles (C) require the external auditors to assume a role within the account, which is impractical for external parties and does not by itself provide per-object, time-limited URLs. Access keys (D) are long-lived credentials that grant broad programmatic access and violate the principle of least privilege for temporary external auditing.

Answer

Bucket policies

Answer

IAM roles

Answer

Access keys

Question 10

A company is implementing a DLP strategy to protect PII in cloud storage. They need to discover sensitive data and then apply de-identification transforms. Which THREE de-identification transforms are appropriate for anonymizing PII while maintaining data utility for analytics? (Select THREE.)

Accepted Answer

Pseudonymisation. Pseudonymisation (C) is correct because it replaces direct identifiers with consistent artificial identifiers (e.g., a keyed hash), so records remain linkable across datasets for analytics while the original PII is no longer directly exposed. Tokenization (D) is correct because it substitutes sensitive values with non-sensitive tokens mapped in a secure token vault, preserving referential integrity and format for joins and aggregation without exposing the underlying PII. Masking (E) is correct because it obscures portions of a value (e.g., showing only the last four digits) while retaining enough structure for analytics and reporting use cases. Encryption (A) is not a de-identification transform in this context—it protects data in place but the plaintext PII is recoverable with the key, so it does not anonymize for analytics. Bucketing (B) generalizes values into ranges and is a data-reduction technique, but it is not one of the three de-identification transforms selected here for anonymizing PII while preserving utility.

Answer

Encryption

Answer

Bucketing

Question 11

A healthcare organization is migrating electronic health records (EHR) to the cloud and must comply with HIPAA. They want to use cloud-native encryption but retain the ability to immediately revoke access to all encrypted data. Which key management strategy best meets this requirement?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) in a cloud KMS allow the organization to retain control over the key lifecycle, including the ability to disable or schedule deletion of the key, which immediately renders all data encrypted with that key inaccessible. This satisfies HIPAA's access control requirements while leveraging cloud-native encryption. CMEK also supports granular IAM policies and audit logging of key usage, which are essential for compliance.

Answer

Hold your own key (HYOK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption

Question 12

A company needs to encrypt data in transit between its on-premises data center and a cloud virtual private cloud (VPC). They require a dedicated, encrypted tunnel with consistent throughput. Which solution should be used?

Accepted Answer

Cloud VPN (IPsec) connection. A Cloud VPN (IPsec) connection provides a dedicated, encrypted tunnel between the on-premises data center and the cloud VPC using IPsec protocols, ensuring confidentiality and integrity of data in transit with consistent throughput over the internet or dedicated interconnect. It is the standard solution for site-to-site encrypted connectivity to a VPC. The other options address encryption at different layers or for different purposes and do not create a dedicated tunnel between the two sites.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for all API communication

Answer

Cloud KMS key for envelope encryption

Question 13

A cloud architect is designing key management for a multi-tenant SaaS application. The architect must ensure that each customer's encryption keys are isolated and that the cloud provider cannot access the keys. Which TWO key management strategies meet these requirements? (Select TWO.)

Accepted Answer

Client-side encryption. Client-side encryption (A) is correct because the customer encrypts data before it ever reaches the cloud provider, so the keys never leave the customer's control and the provider cannot access either the plaintext or the keys, satisfying both isolation and provider-inaccessibility requirements. Hold your own key (HYOK) (C) is correct because keys are generated and retained entirely in the customer's external key management system (e.g., on-premises HSM), and the provider only receives wrapped or transient key material, so it cannot access the keys and each tenant's keys remain isolated. Customer-managed encryption keys (CMEK) (B) and Bring your own key (BYOK) (D) do not fully meet the requirement because in both models the key material is imported into or managed within the provider's KMS, where the provider can technically access or use the keys, so provider inaccessibility is not guaranteed. Cloud provider default server-side encryption (E) is incorrect because the provider generates and fully controls the keys, offering neither customer key isolation nor provider inaccessibility.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption

Question 14

A financial institution is migrating to the cloud and must comply with regulations requiring that sensitive data be stored only in specific geographic regions and that access to data is logged and monitored. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Enable server access logs for the storage bucket. Option A is correct because enabling server access logs for the storage bucket records every request made to the bucket, including the requester identity, IP, timestamp, and operation, which directly satisfies the requirement that access to data is logged and monitored. Option D is correct because bucket policies can include conditions such as aws:RequestedRegion or equivalent region-based constraints that explicitly deny requests originating outside the approved geographic regions, enforcing the data-residency requirement at the resource level. Option E is correct because VPC Service Controls create a service perimeter that prevents data exfiltration and restricts access to managed services from unauthorized networks or projects, adding a strong regional and organizational boundary around sensitive data. Option B does not belong because default server-side encryption with cloud-managed keys protects data at rest but does not enforce geographic residency or provide access logging. Option C does not belong because cross-region replication copies data to other regions, which would violate the requirement that sensitive data be stored only in specific geographic regions.

Answer

Use default server-side encryption with cloud-managed keys

Answer

Enable cross-region replication for disaster recovery

Question 15

A security analyst is reviewing a cloud storage bucket that contains archived customer records. The analyst wants to ensure that no object in the bucket can be modified or deleted for 7 years to meet regulatory retention requirements. Which TWO features should be enabled? (Select TWO.)

Accepted Answer

Bucket versioning. Bucket versioning (A) is correct because it preserves every version of an object, so even if a current object is overwritten or deleted, the prior versions remain recoverable, which supports immutability and retention goals. Object lock with a retention period (D) is correct because it enforces a WORM (write once, read many) model that prevents objects from being overwritten or deleted until the specified retention date, directly satisfying the 7-year regulatory requirement. Bucket ACL restricting write access (B) is not sufficient because ACLs can be changed by an authorized administrator and do not provide immutable, time-based protection. A lifecycle policy to transition to archival storage (C) only changes the storage class to reduce cost and does not prevent modification or deletion. Cross-region replication (E) improves durability and availability by copying data to another region but does not enforce immutability or retention.

Answer

Bucket ACL restricting write access

Answer

Lifecycle policy to transition to archival storage

Answer

Cross-region replication