CCSP Cloud Data Security — 25 Questions

Question 1

Which of the following is the most granular method to grant time-limited access to a specific object in a cloud storage bucket without requiring the requester to have cloud provider credentials?

Accepted Answer

Signed URLs. Signed URLs grant time-limited access to a specific object, and the requester does not need to be authenticated with cloud provider credentials.

Answer

Bucket ACLs

Answer

Bucket policies with conditions

Answer

Identity-based policies

Question 2

An organization is deploying a cloud DLP solution to scan data at rest. They want to automatically classify and tag sensitive data, and then apply access controls based on the tags. Which cloud service capability is most directly used to enforce access decisions based on data classification tags?

Accepted Answer

IAM policies with tag-based conditions [CORRECT]. Cloud services often use IAM policies that can conditionally grant access based on resource tags. For example, an organization can define a policy that allows access only if the resource has a specific tag, such as classification=confidential.

Answer

Cloud storage bucket policies with principal identification [wrong]

Answer

Object storage ACLs with predefined permissions [wrong]

Answer

Time-limited access URLs with expiration time [wrong]

Question 3

A financial services company stores customer transaction data in a cloud object storage bucket. The company requires that all data be encrypted at rest using keys that it generates and manages on-premises, with the cloud provider having no access to the keys. Which encryption approach should the company use?

Accepted Answer

Client-side encryption with customer-owned keys. Client-side encryption (or customer-supplied keys) means the customer encrypts data on their own systems before uploading to the cloud, and the cloud provider never has access to the encryption keys. This meets the requirement of generating and managing keys on-premises with no provider access. Bring your own key (BYOK) imports keys into the cloud's key management service, which may still allow the provider to manage the key lifecycle. Customer-managed keys (CMK) are generated and stored in the cloud KMS, giving the provider potential access. Server-side encryption with provider-managed keys uses keys controlled by the cloud provider.

Answer

Server-side encryption with AES-256

Answer

Server-side encryption with bring your own key (BYOK) to cloud KMS

Answer

Server-side encryption with customer-managed keys (CMK) in cloud KMS

Question 4

A healthcare organization is migrating electronic health records to the cloud and must comply with data residency requirements that mandate all patient data remain within the European Union. The cloud provider offers multiple regions globally. Which of the following is the most appropriate action to ensure compliance?

Accepted Answer

Select a cloud region located in the European Union for data storage.. Selecting a cloud region located within the EU (e.g., Frankfurt or London) physically stores data in that geography, satisfying data residency requirements. Object-level access controls manage permissions but do not affect data location. Data classification is a governance step but does not ensure residency. Cross-region replication to a secondary EU region would keep data within the EU, but it is not the most appropriate action because the requirement is met by simply storing in a single EU region; replication adds unnecessary complexity and potential compliance risks if not managed properly.

Answer

Enable cross-region replication to a secondary EU region.

Answer

Configure object-level access controls to restrict access to EU-based users only.

Answer

Apply data classification labels to all objects to indicate EU data.

Question 5

A company uses a cloud KMS to manage encryption keys for its cloud storage buckets. The security team wants to ensure that keys are rotated automatically every 90 days and that access to keys is restricted based on user roles. Which key management feature should they configure?

Accepted Answer

Key rotation policy and access control key policies. Key rotation policies allow automatic generation of new key material on a schedule, and access control key policies restrict access to keys based on roles. Key versions manage the history of rotated keys. Key deletion is a separate operation. Key import is for BYOK scenarios.

Answer

Key versioning and deletion policies

Answer

Key import and export policies

Answer

Key expiration and renewal policies

Question 6

A security engineer needs to provide temporary access to a specific object in a cloud storage bucket for a third-party auditor, without granting them any other permissions. The access should expire automatically after 24 hours. Which method should the engineer use?

Accepted Answer

Generate a time-limited signed URL for the object with a 24-hour expiration.. A time-limited signed URL grants temporary access to a specific object without requiring the auditor to have cloud credentials. Cloud roles would grant broader permissions. Bucket access policies provide blanket access. Long-term access keys would be insecure and not time-limited.

Answer

Configure a bucket access policy that allows access from the auditor's IP address.

Answer

Assign the auditor a cloud role with read-only access to the bucket.

Answer

Generate a long-term access key pair for the auditor and attach a user policy.

Question 7

An organization wants to share a large file from a cloud storage bucket with an external partner for a limited time. They need to ensure that the partner can only access the specific file and that the access expires automatically. Which method should they use?

Accepted Answer

Use a pre-signed URL. Pre-signed URLs (or signed URLs) grant time-limited access to a specific object. The URL contains authentication information and an expiration time, allowing the partner to download the object without needing permanent credentials.

Answer

Make the bucket public

Answer

Create a new cloud provider user account for the partner and attach a custom policy to the bucket

Answer

Use cross-region replication

Question 8

A cloud storage administrator wants to ensure that only authorized users can access objects in a bucket, and they need to provide time-limited access to a specific object for an external partner. Which TWO access control methods should they use? (Choose two.)

Accepted Answer

Pre-signed URLs for the object. Pre-signed URLs (Option C) are a standard method for granting time-limited access to a specific object for an external partner. They embed authentication credentials in the URL, allowing access for a configurable expiration period without the partner needing AWS credentials. Bucket policies using IAM (Option E) can also provide time-limited access when combined with IAM roles and temporary security credentials (e.g., AWS STS). The bucket policy can grant permissions to a specific IAM role, and the partner can assume that role to obtain temporary credentials with a defined lifetime. Both methods satisfy the requirement of authorizing only authorized users and providing time-limited access to a specific object.

Answer

Cross-region replication

Answer

Bucket versioning

Answer

Object ACLs with public read access

Question 9

A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?

Accepted Answer

Hold your own key (HYOK). HYOK (Hold Your Own Key) allows the customer to keep keys on-premises in their own HSM, never exposing them to the cloud provider. This provides maximum control but can introduce latency.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default encryption (SSE-S3)

Question 10

A healthcare organization is storing protected health information (PHI) in a cloud object storage service. They want to ensure that if a storage bucket is accidentally made public, the data remains unreadable. Which combination of controls best addresses this risk?

Accepted Answer

Enable server-side encryption with AES-256 and block public access. Enabling object-level encryption with customer-managed keys (CMEK) and blocking public access at the bucket level ensures that even if the bucket is misconfigured, data is encrypted and inaccessible without the key.

Answer

Apply data classification labels and enable DLP scanning

Answer

Enable bucket versioning and cross-region replication

Answer

Use pre-signed URLs and IAM policies

Question 11

A multinational corporation must comply with GDPR and local data residency laws. They are designing a cloud storage architecture that will store customer data in the EU region. However, to improve disaster recovery, they want to replicate data to a secondary region outside the EU. Which approach meets compliance requirements?

Accepted Answer

Use same-region replication within the EU and disable cross-region replication. To comply with data residency laws, data must stay within the EU. Replicating to a non-EU region violates GDPR. Instead, they should replicate to another EU region or use encryption with customer-managed keys and ensure the key is stored in the EU.

Answer

Use cross-region replication to a non-EU region but apply client-side encryption before upload

Answer

Use cross-region replication to a US region and encrypt data with SSE-S3

Answer

Use cross-region replication to a non-EU region and rely on a Data Processing Agreement (DPA)

Question 12

A cloud security engineer is configuring a Data Loss Prevention (DLP) API to scan a cloud storage bucket for personally identifiable information (PII). Which of the following is a de-identification technique that replaces sensitive values with a token that can be mapped back to the original data using a secure lookup table?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a token that can be reversed via a lookup table, preserving referential integrity while protecting the original data.

Answer

Pseudonymization

Answer

Bucketing

Answer

Masking

Question 13

An organization wants to use cloud KMS to manage encryption keys. They require automatic key rotation every 90 days and the ability to define granular access policies for who can use the keys. Which key management model should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in cloud KMS, enabling automatic rotation and fine-grained access policies.

Answer

Cloud provider default encryption

Answer

Customer-supplied encryption keys (CSEK)

Answer

Bring your own key (BYOK)

Question 14

A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?

Accepted Answer

Continue using client-side encryption and provide the analytics service with the encryption key. Client-side encryption ensures the cloud provider does not have access to the encryption keys because the keys are never stored in or managed by the provider. To allow a cloud-based analytics service to process the data, the customer can securely provide the encryption key directly to the analytics service. This approach maintains key control while enabling processing. Note: This assumes the analytics service is trusted and the key is transmitted securely.

Answer

Use client-side encryption but store the key in the cloud provider's key vault

Answer

Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data

Answer

Switch to server-side encryption with customer-managed keys and grant the analytics service access to the key management service (KMS)

Question 15

A data classification scheme for a cloud environment defines labels such as Public, Internal, Confidential, and Restricted. Which label should be applied to data that, if disclosed, would cause severe damage to the organization and is subject to regulatory fines?

Accepted Answer

Restricted. Restricted is the highest classification level, used for data that would cause severe damage if disclosed and is subject to strict regulatory controls.

Answer

Public

Answer

Confidential

Answer

Internal

Question 16

A cloud storage bucket is configured with versioning enabled. A ransomware attack encrypts all objects in the bucket. How can the organization recover the original data?

Accepted Answer

Restore from previous versions of the objects. Versioning preserves previous versions of objects. The organization can restore previous unencrypted versions, provided they have not been deleted and the ransomware did not delete versions.

Answer

Use the cloud provider's backup service to restore the bucket

Answer

Replicate data from the cross-region replica

Answer

Use the cloud provider's ransomware recovery service

Question 17

When data is in transit between an on-premises data center and a cloud service, which of the following is the minimum encryption standard recommended by security best practices?

Accepted Answer

TLS 1.2. TLS 1.2 or higher is the minimum standard for encrypting data in transit to protect against eavesdropping and tampering.

Answer

IPsec with 3DES

Answer

TLS 1.0

Answer

SSL 3.0

Question 18

A data lifecycle policy requires that data be destroyed after a retention period. In a cloud object storage service, what is the most secure method to ensure that data is irretrievably destroyed?

Accepted Answer

Use a lifecycle policy to expire objects and delete delete markers. Object deletion with versioning disabled ensures that the data is removed and cannot be recovered. If versioning is enabled, a delete marker is added; previous versions remain. Configuring a lifecycle policy to expire objects after a retention period automates deletion.

Answer

Overwrite the objects with random data multiple times before deletion

Answer

Enable MFA delete and then delete the objects

Answer

Delete the objects and then delete the bucket

Question 19

A cloud security architect is designing a key management strategy to meet regulatory requirements for key separation and tamper evidence. Which TWO of the following are benefits of using hardware security modules (HSMs) backing a cloud KMS? (Select TWO.)

Accepted Answer

Compliance with FIPS 140-2 Level 3 or higher. HSMs provide tamper-resistant hardware for key generation and storage, ensuring keys are protected against physical tampering. They also provide a root of trust for key management.

Answer

Eliminates the need for customer-managed keys

Answer

Reduced latency for encryption operations

Answer

Automatic key rotation without customer intervention

Question 20

A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)

Accepted Answer

Establishing a VPN for hybrid connectivity. TLS 1.2+, VPNs, and HTTPS are standard controls for encrypting data in transit. Data classification is a policy, not a technical control. Encryption at rest protects stored data, not in transit.

Answer

Setting data classification labels on the data

Answer

Encrypting data at rest using AES-256