CCSP Cloud Data Security Practice Test 3 — 15 Questions

Question 1

A financial services company stores customer transaction data in a cloud object storage service. The security team wants to ensure that if a malicious insider gains access to the storage bucket, they cannot read the data. Which encryption approach provides the highest level of protection against the cloud provider and insiders?

Accepted Answer

Client-side encryption using a customer-managed key. Client-side encryption means data is encrypted before it is uploaded to the cloud. The cloud provider never has access to the encryption keys, and data remains encrypted at rest and in transit (if TLS is also used). This protects against both the cloud provider and insiders with administrative access to the storage service.

Answer

Server-side encryption with AES-256 (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Transport Layer Security (TLS) for data in transit

Question 2

A healthcare organization is migrating electronic health records (EHR) to the cloud and must comply with HIPAA. They want to use cloud-native encryption but retain the ability to immediately revoke access to all encrypted data. Which key management strategy best meets this requirement?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in the cloud KMS. The cloud service is authorized to use the key, but the customer can revoke access at any time by disabling the key, effectively rendering the data inaccessible. This provides control without the complexity of client-side encryption.

Answer

Hold your own key (HYOK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption

Question 3

An organization uses a cloud-based data analytics platform with data stored in a data warehouse. The security team discovers that some tables contain unencrypted personally identifiable information (PII). They need to automatically scan the data warehouse for PII and apply pseudonymization to protect sensitive columns. Which cloud service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP (Data Loss Prevention) APIs can scan data stores like BigQuery for sensitive data types (PII, credit card numbers, etc.) and apply de-identification transforms such as pseudonymization, masking, tokenization, etc. This is the intended service for automated discovery and protection.

Answer

Cloud Storage bucket policies

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Key Management Service (KMS)

Question 4

A company is implementing a data classification policy for cloud storage. They want to label objects with tags indicating the sensitivity level (e.g., 'Confidential'). Which benefit does tagging resources with classification labels provide?

Accepted Answer

It allows enforcement of data handling policies based on sensitivity. Tags enable automated enforcement of access controls, encryption requirements, and retention policies. For example, a policy can prevent objects tagged 'Confidential' from being made public. Tags also facilitate auditing and reporting.

Answer

It provides client-side encryption keys

Answer

It automatically encrypts data at rest

Answer

It reduces storage costs by moving data to cheaper tiers

Question 5

A global e-commerce company must store customer payment data in a specific geographic region to comply with local data residency laws. Which cloud configuration ensures that data never leaves the required region?

Accepted Answer

Select a specific cloud region for the storage and disable cross-region replication. Data residency is achieved by selecting a cloud region (e.g., 'EU-West-1') and configuring storage buckets or databases with region-specific policies. Additionally, bucket policies can explicitly deny access from outside the region, and replication features should be disabled or configured to stay within the region.

Answer

Use a global load balancer to route traffic

Answer

Enable cross-region replication to a secondary region for disaster recovery

Answer

Store data in a private cloud on-premises

Question 6

A security architect is designing a multi-cloud data protection strategy. They need to give a third-party auditor time-limited, read-only access to a specific file in a cloud storage bucket. Which access control method is most appropriate?

Accepted Answer

Pre-signed URL with an expiration time. Pre-signed URLs (or signed URLs) grant temporary access to a specific object without requiring the auditor to have cloud credentials. They can be configured with expiration times and permissions (e.g., read-only).

Answer

Cloud VPN connection for the auditor

Answer

Bucket ACL granting read access to the auditor's cloud account

Answer

IAM policy granting read access to the auditor's user

Question 7

A company uses a cloud key management service (KMS) with an HSM-backed key for encrypting sensitive data. They want to ensure that the key is automatically rotated every 90 days and that older key versions are retained for decryption of previously encrypted data. Which KMS feature should be configured?

Accepted Answer

Automatic key rotation with version retention. Key rotation in cloud KMS (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) can be set to automatic rotation with a specified period. Old key versions are retained so that data encrypted with older keys can still be decrypted. The key material changes, but key ID remains the same.

Answer

Key aliasing

Answer

Key destruction schedule

Answer

Key revocation policy

Question 8

Which phase of the cloud data lifecycle involves making data available for processing by applications and users?

Accepted Answer

Use. The cloud data lifecycle consists of Create, Store, Use, Share, Archive, Destroy. The 'Use' phase is when data is accessed and processed.

Answer

Archive

Answer

Store

Answer

Create

Question 9

A cloud security engineer needs to protect a storage bucket from accidental deletion and ransomware attacks. Which two features should be enabled together for maximum protection?

Accepted Answer

Bucket versioning and object lock. Versioning keeps multiple variants of an object, allowing recovery from accidental deletion or overwrite. Object lock (immutability) prevents objects from being deleted or overwritten for a specified retention period, protecting against ransomware. Combining both provides defense in depth.

Answer

IAM policies and MFA delete

Answer

Cross-region replication and lifecycle policies

Answer

Server access logging and bucket policies

Question 10

An organization wants to classify data in the cloud and assign labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. What is the primary purpose of this classification scheme?

Accepted Answer

To apply appropriate security controls based on sensitivity. Data classification helps determine appropriate security controls, such as encryption requirements, access permissions, and handling procedures. It guides policy enforcement.

Answer

To reduce cloud storage costs by moving data to cheaper tiers

Answer

To enable public sharing of data

Answer

To comply with data localization laws

Question 11

A company needs to encrypt data in transit between its on-premises data center and a cloud virtual private cloud (VPC). They require a dedicated, encrypted tunnel with consistent throughput. Which solution should be used?

Accepted Answer

Cloud VPN (IPsec) connection. A site-to-site VPN (IPsec VPN) provides an encrypted tunnel over the public internet between on-premises and cloud VPC. For higher throughput and reliability, dedicated connections like AWS Direct Connect or Azure ExpressRoute can be used with optional encryption. However, the question specifies 'encrypted tunnel', which VPN provides.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for all API communication

Answer

Cloud KMS key for envelope encryption

Question 12

A cloud security team is implementing data loss prevention for a data lake that stores customer support logs. They need to redact credit card numbers from the logs before they are used for analytics. Which DLP de-identification technique should be applied?

Accepted Answer

Masking. Masking replaces sensitive data with a placeholder, such as replacing credit card digits with asterisks, while preserving format for analytics. Tokenization replaces data with tokens but requires a token vault. Masking is simpler for one-way redaction.

Answer

Date shifting

Answer

Bucketing

Answer

Tokenization

Question 13

A cloud architect is designing key management for a multi-tenant SaaS application. The architect must ensure that each customer's encryption keys are isolated and that the cloud provider cannot access the keys. Which TWO key management strategies meet these requirements? (Select TWO.)

Accepted Answer

Client-side encryption. Client-side encryption ensures data is encrypted before it reaches the cloud, so the cloud provider never sees plaintext or keys. Hold Your Own Key (HYOK) keeps the key on-premises in an HSM, never exposing it to the cloud. Both give the customer exclusive control.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption

Question 14

A financial institution is migrating to the cloud and must comply with regulations requiring that sensitive data be stored only in specific geographic regions and that access to data is logged and monitored. Which THREE controls should be implemented? (Select THREE.)

Accepted Answer

Enable server access logs for the storage bucket. To enforce data residency, the cloud region must be restricted via IAM or organization policies. Server access logging captures all requests to storage. VPC Service Controls create a security perimeter around cloud resources, preventing data exfiltration. Cross-region replication would violate residency, and default encryption is not sufficient.

Answer

Use default server-side encryption with cloud-managed keys

Answer

Enable cross-region replication for disaster recovery

Question 15

A security analyst is reviewing a cloud storage bucket that contains archived customer records. The analyst wants to ensure that no object in the bucket can be modified or deleted for 7 years to meet regulatory retention requirements. Which TWO features should be enabled? (Select TWO.)

Accepted Answer

Bucket versioning. Object lock (retention mode) enforces a retention period on objects, preventing deletion or modification. Versioning allows recovery in case of accidental deletion of lock or creation of delete markers. Together they provide a comprehensive retention solution, though object lock alone may suffice if versioning is not required.

Answer

Bucket ACL restricting write access

Answer

Lifecycle policy to transition to archival storage

Answer

Cross-region replication