CCSP Cloud Data Security Practice Test 1 — 15 Questions

Question 1

A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?

Accepted Answer

Hold your own key (HYOK). HYOK (Hold Your Own Key) allows the customer to keep keys on-premises in their own HSM, never exposing them to the cloud provider. This provides maximum control but can introduce latency.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default encryption (SSE-S3)

Question 2

A healthcare organization is storing protected health information (PHI) in a cloud object storage service. They want to ensure that if a storage bucket is accidentally made public, the data remains unreadable. Which combination of controls best addresses this risk?

Accepted Answer

Enable server-side encryption with AES-256 and block public access. Enabling object-level encryption with customer-managed keys (CMEK) and blocking public access at the bucket level ensures that even if the bucket is misconfigured, data is encrypted and inaccessible without the key.

Answer

Apply data classification labels and enable DLP scanning

Answer

Enable bucket versioning and cross-region replication

Answer

Use pre-signed URLs and IAM policies

Question 3

A multinational corporation must comply with GDPR and local data residency laws. They are designing a cloud storage architecture that will store customer data in the EU region. However, to improve disaster recovery, they want to replicate data to a secondary region outside the EU. Which approach meets compliance requirements?

Accepted Answer

Use same-region replication within the EU and disable cross-region replication. To comply with data residency laws, data must stay within the EU. Replicating to a non-EU region violates GDPR. Instead, they should replicate to another EU region or use encryption with customer-managed keys and ensure the key is stored in the EU.

Answer

Use cross-region replication to a non-EU region but apply client-side encryption before upload

Answer

Use cross-region replication to a US region and encrypt data with SSE-S3

Answer

Use cross-region replication to a non-EU region and rely on a Data Processing Agreement (DPA)

Question 4

A cloud security engineer is configuring a Data Loss Prevention (DLP) API to scan a cloud storage bucket for personally identifiable information (PII). Which of the following is a de-identification technique that replaces sensitive values with a token that can be mapped back to the original data using a secure lookup table?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a token that can be reversed via a lookup table, preserving referential integrity while protecting the original data.

Answer

Pseudonymization

Answer

Bucketing

Answer

Masking

Question 5

Which of the following is the most granular method to grant time-limited access to a specific object in a cloud storage bucket without requiring the requester to have AWS credentials?

Accepted Answer

Pre-signed URLs. Pre-signed URLs (or signed URLs) grant time-limited access to a specific object, and the requester does not need to be authenticated with cloud credentials.

Answer

Bucket ACLs

Answer

Bucket policies with conditions

Answer

IAM policies

Question 6

An organization wants to use cloud KMS to manage encryption keys. They require automatic key rotation every 90 days and the ability to define granular access policies for who can use the keys. Which key management model should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in cloud KMS, enabling automatic rotation and fine-grained access policies.

Answer

Cloud provider default encryption

Answer

Customer-supplied encryption keys (CSEK)

Answer

Bring your own key (BYOK)

Question 7

A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?

Accepted Answer

Switch to server-side encryption with CMEK and grant the analytics service access to the KMS key. Client-side encryption typically prevents the cloud provider from accessing keys, but to allow processing, the data must be decrypted. Using customer-managed keys (CMEK) and granting the analytics service access to the keys via KMS policies enables processing while keeping key control with the customer.

Answer

Use client-side encryption but store the key in the cloud provider's key vault

Answer

Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data

Answer

Continue using client-side encryption and provide the analytics service with the encryption key

Question 8

A data classification scheme for a cloud environment defines labels such as Public, Internal, Confidential, and Restricted. Which label should be applied to data that, if disclosed, would cause severe damage to the organization and is subject to regulatory fines?

Accepted Answer

Restricted. Restricted is the highest classification level, used for data that would cause severe damage if disclosed and is subject to strict regulatory controls.

Answer

Public

Answer

Confidential

Answer

Internal

Question 9

A cloud storage bucket is configured with versioning enabled. A ransomware attack encrypts all objects in the bucket. How can the organization recover the original data?

Accepted Answer

Restore from previous versions of the objects. Versioning preserves previous versions of objects. The organization can restore previous unencrypted versions, provided they have not been deleted and the ransomware did not delete versions.

Answer

Use the cloud provider's backup service to restore the bucket

Answer

Replicate data from the cross-region replica

Answer

Use the cloud provider's ransomware recovery service

Question 10

When data is in transit between an on-premises data center and a cloud service, which of the following is the minimum encryption standard recommended by security best practices?

Accepted Answer

TLS 1.2. TLS 1.2 or higher is the minimum standard for encrypting data in transit to protect against eavesdropping and tampering.

Answer

IPsec with 3DES

Answer

TLS 1.0

Answer

SSL 3.0

Question 11

A data lifecycle policy requires that data be destroyed after a retention period. In a cloud object storage service, what is the most secure method to ensure that data is irretrievably destroyed?

Accepted Answer

Use a lifecycle policy to expire objects and delete delete markers. Object deletion with versioning disabled ensures that the data is removed and cannot be recovered. If versioning is enabled, a delete marker is added; previous versions remain. Configuring a lifecycle policy to expire objects after a retention period automates deletion.

Answer

Overwrite the objects with random data multiple times before deletion

Answer

Enable MFA delete and then delete the objects

Answer

Delete the objects and then delete the bucket

Question 12

An organization is deploying a cloud DLP solution to scan data at rest. They want to automatically classify and tag sensitive data, and then apply access controls based on the tags. Which cloud service capability is most directly used to enforce access decisions based on data classification tags?

Accepted Answer

IAM policies with tag-based conditions. Cloud services often use IAM policies that can conditionally grant access based on resource tags. For example, AWS IAM policies can use Condition blocks to allow access only if the resource has a specific tag (e.g., classification=confidential).

Answer

Bucket policies with Principal ARN

Answer

Object ACLs with canned ACLs

Answer

Pre-signed URLs with expiration time

Question 13

A cloud security architect is designing a key management strategy to meet regulatory requirements for key separation and tamper evidence. Which TWO of the following are benefits of using hardware security modules (HSMs) backing a cloud KMS? (Select TWO.)

Accepted Answer

Compliance with FIPS 140-2 Level 3 or higher. HSMs provide tamper-resistant hardware for key generation and storage, ensuring keys are protected against physical tampering. They also provide a root of trust for key management.

Answer

Eliminates the need for customer-managed keys

Answer

Reduced latency for encryption operations

Answer

Automatic key rotation without customer intervention

Question 14

A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)

Accepted Answer

Establishing a VPN for hybrid connectivity. TLS 1.2+, VPNs, and HTTPS are standard controls for encrypting data in transit. Data classification is a policy, not a technical control. Encryption at rest protects stored data, not in transit.

Answer

Setting data classification labels on the data

Answer

Encrypting data at rest using AES-256

Question 15

An organization is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. Which TWO of the following are capabilities of a cloud DLP service? (Select TWO.)

Accepted Answer

De-identification transforms such as masking and tokenization. Cloud DLP services can scan data for sensitive patterns (like credit card numbers) and apply de-identification transforms to redact or mask data. They do not manage encryption keys or automate backup.

Answer

Automatic encryption key rotation

Answer

Enforcing multi-factor authentication

Answer

Automated backup of sensitive data