CCSP Cloud Data Security Practice Test 2 — 15 Questions

Question 1

A financial services company stores customer transaction data in a cloud object storage bucket. The company requires that all data be encrypted at rest using keys that it generates and manages on-premises, with the cloud provider having no access to the keys. Which encryption approach should the company use?

Accepted Answer

Customer-supplied encryption keys (CSEK). CSEK (customer-supplied encryption keys) allows the customer to provide their own keys for encrypting cloud storage objects, and the cloud provider does not retain access to the keys. BYOK involves importing keys into the cloud KMS, which the provider can manage. CMEK uses keys created in the cloud KMS. Server-side encryption uses provider-managed keys.

Answer

Server-side encryption with AES-256

Answer

Bring your own key (BYOK)

Answer

Customer-managed encryption keys (CMEK)

Question 2

A healthcare organization is migrating electronic health records to the cloud and must comply with data residency requirements that mandate all patient data remain within the European Union. The cloud provider offers multiple regions globally. Which of the following is the most appropriate action to ensure compliance?

Accepted Answer

Select a cloud region located in the European Union for data storage.. Selecting a cloud region located within the EU (e.g., Frankfurt or London) physically stores data in that geography, satisfying data residency requirements. Object-level access controls manage permissions but do not affect data location. Data classification is a governance step but does not ensure residency. Cross-region replication would copy data outside the EU, violating compliance.

Answer

Enable cross-region replication to a secondary EU region.

Answer

Configure object-level access controls to restrict access to EU-based users only.

Answer

Apply data classification labels to all objects to indicate EU data.

Question 3

A company uses a cloud KMS to manage encryption keys for its cloud storage buckets. The security team wants to ensure that keys are rotated automatically every 90 days and that access to keys is restricted based on user roles. Which key management feature should they configure?

Accepted Answer

Key rotation policy and IAM-based key policies. Key rotation policies allow automatic generation of new key material on a schedule, and IAM-based key policies restrict access to keys based on roles. Key versions manage the history of rotated keys. Key deletion is a separate operation. Key import is for BYOK scenarios.

Answer

Key versioning and deletion policies

Answer

Key import and export policies

Answer

Key expiration and renewal policies

Question 4

A multinational corporation uses a cloud DLP service to scan data stored in cloud storage and BigQuery for personally identifiable information (PII). The DLP scan identifies credit card numbers in a dataset. According to the cloud data lifecycle, at which stage should the DLP scan ideally be performed to minimize exposure?

Accepted Answer

Create. DLP scanning should ideally occur during the Create stage, as data is being created or ingested, to prevent sensitive data from being stored without proper protections. Scanning at Store stage may allow data to persist. Scanning at Use or Share stages is reactive and may already have exposed data.

Answer

Store

Answer

Use

Answer

Share

Question 5

A security engineer needs to provide temporary access to a specific object in a cloud storage bucket for a third-party auditor, without granting them any other permissions. The access should expire automatically after 24 hours. Which method should the engineer use?

Accepted Answer

Create a pre-signed URL for the object with a 24-hour expiration.. Pre-signed URLs (signed URLs) grant time-limited access to a specific object without requiring the auditor to have AWS credentials. IAM roles would grant broader permissions. Bucket policies provide blanket access. Access keys would be long-lived and insecure.

Answer

Configure a bucket policy that allows access from the auditor's IP address.

Answer

Assign the auditor an IAM role with read-only access to the bucket.

Answer

Generate an access key pair for the auditor and attach a user policy.

Question 6

An organization wants to protect its cloud storage data from ransomware attacks that might encrypt or delete objects. The security team decides to enable a feature that maintains previous versions of objects when changes are made. Which feature is being described?

Accepted Answer

Object versioning. Object versioning keeps multiple variants of an object, allowing restoration to a previous state if data is encrypted or deleted. Cross-region replication is for disaster recovery. Bucket locking prevents deletion but does not maintain versions. Access controls prevent unauthorized access but do not protect against authorized actions.

Answer

Access control lists

Answer

Cross-region replication

Answer

Bucket locking

Question 7

A cloud architect is designing a data classification scheme for a SaaS provider. The provider handles customer data that includes public marketing materials, internal policies, and sensitive customer financial records. Which classification level should be assigned to customer financial records to enforce the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification level, typically used for data that requires the most stringent controls, such as financial records or PII. Public is least sensitive, internal is for company-internal data, confidential is for sensitive but not critical data.

Answer

Internal

Answer

Public

Answer

Confidential

Question 8

A company is implementing a data loss prevention (DLP) strategy for cloud storage. They need to detect and mask credit card numbers in documents stored in a cloud storage bucket. The DLP service provides de-identification transforms including masking, tokenization, and pseudonymization. Which transform should the company use to irreversibly replace the credit card numbers with a placeholder while maintaining the original format for analytics?

Accepted Answer

Masking. Masking replaces sensitive data with a masked version, such as showing only the last four digits, preserving format for analytics. Tokenization substitutes with a token that requires a mapping table. Pseudonymization replaces with a consistent pseudonym that can be reversed. Bucketing groups values into ranges.

Answer

Pseudonymisation

Answer

Bucketing

Answer

Tokenization

Question 9

A small business uses a cloud provider's default server-side encryption (SSE) to encrypt data at rest in their cloud storage. They are concerned about key management overhead. Which statement best describes the key management responsibility for SSE?

Accepted Answer

The cloud provider manages the keys entirely.. With default SSE (e.g., SSE-S3 in AWS), the cloud provider manages the encryption keys entirely. The customer is not involved in key generation, rotation, or storage. CMEK and CSEK require customer involvement. BYOK involves importing customer keys.

Answer

The customer and provider share key management responsibilities.

Answer

Keys are not used; encryption is transparent.

Answer

The customer generates and manages the keys.

Question 10

A company is required by a data sovereignty law to ensure that all data generated by its EU customers is stored and processed within the EU. The company uses a cloud provider with data centers in multiple regions. Which cloud storage configuration should they implement?

Accepted Answer

Select a cloud region located in the EU and disable cross-region replication.. Data residency is achieved by choosing a specific geographic region (e.g., EU) for storage and processing. Cross-region replication would copy data to other regions, potentially violating sovereignty. Data classification and encryption help protect data but do not restrict location.

Answer

Enable cross-region replication to a region in the same country.

Answer

Use client-side encryption for all EU data.

Answer

Apply data classification labels to all EU data.

Question 11

A DevOps team is deploying an application that will store encryption keys in a cloud KMS. The security policy requires that keys be stored in a hardware security module (HSM) and that key material never leaves the HSM boundary. Which key management option should they choose?

Accepted Answer

Cloud KMS with HSM-backed key storage. Cloud KMS with HSM-backed key storage ensures keys are generated and stored in an HSM. CMEK and BYOK typically use software-backed keys unless HSM is specified. HYOK keeps keys on-premises, not in cloud HSM.

Answer

Customer-managed encryption keys (CMEK) with software-backed storage

Answer

Hold your own key (HYOK) with on-premises HSM

Answer

Bring your own key (BYOK) with key import to cloud KMS

Question 12

A company uses cloud KMS with customer-managed keys (CMEK) to encrypt data in a cloud storage bucket. The security team wants to ensure that if a key is compromised, they can revoke the cloud service's ability to decrypt the data immediately. What should they do?

Accepted Answer

Disable the key in the cloud KMS or revoke the key's IAM permissions for the cloud service.. With CMEK, the customer controls the key and can revoke the cloud service's access by disabling the key or removing the IAM permission that allows the service to use the key. Deleting the key would also work but is irreversible. Disabling the key is reversible and immediate.

Answer

Rotate the key to a new version.

Answer

Delete the key permanently from the cloud KMS.

Answer

Regenerate the key material by importing a new key.

Question 13

A cloud security architect is designing access controls for a cloud storage bucket that contains sensitive customer data. The architect needs to implement a solution that provides granular, time-limited access to specific objects for external auditors. Which TWO methods should the architect consider? (Select TWO.)

Accepted Answer

Signed URLs. Pre-signed URLs and signed URLs are both used to grant time-limited access to specific objects without requiring the user to have cloud credentials. IAM roles provide broader access. Bucket policies provide blanket access. Access keys are long-lived.

Answer

Bucket policies

Answer

IAM roles

Answer

Access keys

Question 14

A company is implementing a DLP strategy to protect PII in cloud storage. They need to discover sensitive data and then apply de-identification transforms. Which THREE de-identification transforms are appropriate for anonymizing PII while maintaining data utility for analytics? (Select THREE.)

Accepted Answer

Pseudonymisation. Masking, tokenization, and pseudonymisation are de-identification transforms that protect PII while preserving some utility. Masking obscures parts of data (e.g., showing only last four digits). Tokenization replaces with tokens that can be mapped back. Pseudonymisation replaces with consistent pseudonyms that are reversible with additional data. Bucketing groups values into ranges, which can be useful but may reduce utility. Encryption is not considered a de-identification transform in DLP context.

Answer

Encryption

Answer

Bucketing

Question 15

A company is planning to implement data classification for its cloud environment. Which TWO components are essential for an effective data classification scheme? (Select TWO.)

Accepted Answer

A process to tag resources with the appropriate classification labels. A classification scheme with defined labels (e.g., public, internal, confidential, restricted) and a process for tagging resources with those labels are essential. Automated DLP scanning can enforce classification but is not essential for the scheme itself. Encryption and access controls are separate security controls.

Answer

Encryption at rest for all classified data

Answer

Access control policies based on classification

Answer

Automated DLP scanning to enforce classification