CCSP Cloud Data Security Practice Test 2 — 15 Questions

Question 1

A cloud storage bucket is configured with versioning enabled. A ransomware attack encrypts all objects in the bucket. How can the organization recover the original data?

Accepted Answer

Restore from previous versions of the objects. Versioning preserves previous versions of objects. The organization can restore previous unencrypted versions, provided they have not been deleted and the ransomware did not delete versions.

Answer

Use the cloud provider's backup service to restore the bucket

Answer

Replicate data from the cross-region replica

Answer

Use the cloud provider's ransomware recovery service

Question 2

When data is in transit between an on-premises data center and a cloud service, which of the following is the minimum encryption standard recommended by security best practices?

Accepted Answer

TLS 1.2. TLS 1.2 or higher is the minimum standard for encrypting data in transit to protect against eavesdropping and tampering.

Answer

IPsec with 3DES

Answer

TLS 1.0

Answer

SSL 3.0

Question 3

A data lifecycle policy requires that data be destroyed after a retention period. In a cloud object storage service, what is the most secure method to ensure that data is irretrievably destroyed?

Accepted Answer

Use a lifecycle policy to expire objects and delete delete markers. Object deletion with versioning disabled ensures that the data is removed and cannot be recovered. If versioning is enabled, a delete marker is added; previous versions remain. Configuring a lifecycle policy to expire objects after a retention period automates deletion.

Answer

Overwrite the objects with random data multiple times before deletion

Answer

Enable MFA delete and then delete the objects

Answer

Delete the objects and then delete the bucket

Question 4

A cloud security architect is designing a key management strategy to meet regulatory requirements for key separation and tamper evidence. Which TWO of the following are benefits of using hardware security modules (HSMs) backing a cloud KMS? (Select TWO.)

Accepted Answer

Compliance with FIPS 140-2 Level 3 or higher. HSMs provide tamper-resistant hardware for key generation and storage, ensuring keys are protected against physical tampering. They also provide a root of trust for key management.

Answer

Eliminates the need for customer-managed keys

Answer

Reduced latency for encryption operations

Answer

Automatic key rotation without customer intervention

Question 5

A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)

Accepted Answer

Establishing a VPN for hybrid connectivity. TLS 1.2+, VPNs, and HTTPS are standard controls for encrypting data in transit. Data classification is a policy, not a technical control. Encryption at rest protects stored data, not in transit.

Answer

Setting data classification labels on the data

Answer

Encrypting data at rest using AES-256

Question 6

An organization is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. Which TWO of the following are capabilities of a cloud DLP service? (Select TWO.)

Accepted Answer

De-identification transforms such as masking and tokenization. Cloud DLP services can scan data for sensitive patterns (like credit card numbers) and apply de-identification transforms to redact or mask data. They do not manage encryption keys or automate backup.

Answer

Automatic encryption key rotation

Answer

Enforcing multi-factor authentication

Answer

Automated backup of sensitive data

Question 7

A multinational corporation uses a cloud DLP service to scan data stored in cloud storage and a cloud data warehouse for personally identifiable information (PII). The DLP scan identifies credit card numbers in a dataset. According to the cloud data lifecycle, at which stage should the DLP scan ideally be performed to minimize exposure?

Accepted Answer

Create. DLP scanning should ideally occur during the Create stage, as data is being created or ingested, to prevent sensitive data from being stored without proper protections. Scanning at Store stage may allow data to persist. Scanning at Use or Share stages is reactive and may already have exposed data.

Answer

Store

Answer

Use

Answer

Share

Question 8

An organization wants to protect its cloud storage data from ransomware attacks that might encrypt or delete objects. The security team decides to enable a feature that maintains previous versions of objects when changes are made. Which feature is being described?

Accepted Answer

Object versioning. Object versioning keeps multiple variants of an object, allowing restoration to a previous state if data is encrypted or deleted. Cross-region replication is for disaster recovery. Bucket locking prevents deletion but does not maintain versions. Access controls prevent unauthorized access but do not protect against authorized actions.

Answer

Access control lists

Answer

Cross-region replication

Answer

Bucket locking

Question 9

A cloud architect is designing a data classification scheme for a SaaS provider. The provider handles customer data that includes public marketing materials, internal policies, and sensitive customer financial records. Which classification level should be assigned to customer financial records to enforce the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification level, typically used for data that requires the most stringent controls, such as financial records or PII. Public is least sensitive, internal is for company-internal data, confidential is for sensitive but not critical data.

Answer

Internal

Answer

Public

Answer

Confidential

Question 10

A company is implementing a data loss prevention (DLP) strategy for cloud storage. They need to detect and mask credit card numbers in documents stored in a cloud storage bucket. The DLP service provides de-identification transforms including masking, tokenization, and pseudonymization. Which transform should the company use to irreversibly replace the credit card numbers with a placeholder while maintaining the original format for analytics?

Accepted Answer

Masking. Masking replaces sensitive data with a masked version, such as showing only the last four digits, preserving format for analytics. Tokenization substitutes with a token that requires a mapping table. Pseudonymization replaces with a consistent pseudonym that can be reversed. Bucketing groups values into ranges.

Answer

Pseudonymisation

Answer

Bucketing

Answer

Tokenization

Question 11

A small business uses a cloud provider's default server-side encryption (SSE) to encrypt data at rest in their cloud storage. They are concerned about key management overhead. Which statement best describes the key management responsibility for SSE?

Accepted Answer

The cloud provider manages the keys entirely.. With default SSE (e.g., SSE-S3 in AWS), the cloud provider manages the encryption keys entirely. The customer is not involved in key generation, rotation, or storage. CMEK and CSEK require customer involvement. BYOK involves importing customer keys.

Answer

The customer and provider share key management responsibilities.

Answer

Keys are not used; encryption is transparent.

Answer

The customer generates and manages the keys.

Question 12

A company is required by a data sovereignty law to ensure that all data generated by its EU customers is stored and processed within the EU. The company uses a cloud provider with data centers in multiple regions. Which cloud storage configuration should they implement?

Accepted Answer

Select a cloud region located in the EU and disable cross-region replication.. Data residency is achieved by choosing a specific geographic region (e.g., EU) for storage and processing. Cross-region replication would copy data to other regions, potentially violating sovereignty. Data classification and encryption help protect data but do not restrict location.

Answer

Enable cross-region replication to a region in the same country.

Answer

Use client-side encryption for all EU data.

Answer

Apply data classification labels to all EU data.

Question 13

A DevOps team is deploying an application that will store encryption keys in a cloud KMS. The security policy requires that keys be stored in a hardware security module (HSM) and that key material never leaves the HSM boundary. Which key management option should they choose?

Accepted Answer

Cloud KMS with HSM-backed key storage. Cloud KMS with HSM-backed key storage ensures keys are generated and stored in an HSM. CMEK and BYOK typically use software-backed keys unless HSM is specified. HYOK keeps keys on-premises, not in cloud HSM.

Answer

Customer-managed encryption keys (CMEK) with software-backed storage

Answer

Hold your own key (HYOK) with on-premises HSM

Answer

Bring your own key (BYOK) with key import to cloud KMS

Question 14

A company uses a cloud key management service with customer-managed keys to encrypt data in a cloud storage bucket. The security team wants to ensure that if a key is compromised, they can revoke the cloud service's ability to decrypt the data immediately. What should they do?

Accepted Answer

Disable the key in the cloud key management service or revoke the key's access permissions for the cloud service.. With customer-managed keys, the customer controls the key and can revoke the cloud service's access by disabling the key or removing the access permission that allows the service to use the key. Deleting the key would also work but is irreversible. Disabling the key is reversible and immediate.

Answer

Rotate the key to a new version.

Answer

Delete the key permanently from the cloud key management service.

Answer

Regenerate the key material by importing a new key.

Question 15

A cloud security architect is designing access controls for a cloud storage bucket that contains sensitive customer data. The architect needs to implement a solution that provides granular, time-limited access to specific objects for external auditors. Which TWO methods should the architect consider? (Select TWO.)

Accepted Answer

Signed URLs. Pre-signed URLs and signed URLs are both used to grant time-limited access to specific objects without requiring the user to have cloud credentials. IAM roles provide broader access. Bucket policies provide blanket access. Access keys are long-lived.

Answer

Bucket policies

Answer

IAM roles

Answer

Access keys