CCSP Cloud Data Security Practice Test 3 — 15 Questions

Question 1

A company is implementing a DLP strategy to protect PII in cloud storage. They need to discover sensitive data and then apply de-identification transforms. Which THREE de-identification transforms are appropriate for anonymizing PII while maintaining data utility for analytics? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pseudonymisation. Masking, tokenization, and pseudonymisation are de-identification transforms that protect PII while preserving some utility. Masking obscures parts of data (e.g., showing only last four digits). Tokenization replaces with tokens that can be mapped back. Pseudonymisation replaces with consistent pseudonyms that are reversible with additional data. Bucketing groups values into ranges, which can be useful but may reduce utility. Encryption is not considered a de-identification transform in DLP context.

Answer

Encryption

Answer

Bucketing

Question 2

A company is planning to implement data classification for its cloud environment. Which TWO components are essential for an effective data classification scheme? (Select TWO.)

Accepted Answer

A process to tag resources with the appropriate classification labels. A classification scheme with defined labels (e.g., public, internal, confidential, restricted) and a process for tagging resources with those labels are essential. Automated DLP scanning can enforce classification but is not essential for the scheme itself. Encryption and access controls are separate security controls.

Answer

Encryption at rest for all classified data

Answer

Access control policies based on classification

Answer

Automated DLP scanning to enforce classification

Question 3

A financial services company stores customer transaction data in a cloud object storage service. The security team wants to ensure that if a malicious insider gains access to the storage bucket, they cannot read the data. Which encryption approach provides the highest level of protection against the cloud provider and insiders?

Accepted Answer

Client-side encryption using a customer-managed key. Client-side encryption means data is encrypted before it is uploaded to the cloud. The cloud provider never has access to the encryption keys, and data remains encrypted at rest and in transit (if TLS is also used). This protects against both the cloud provider and insiders with administrative access to the storage service.

Answer

Server-side encryption with AES-256 (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Transport Layer Security (TLS) for data in transit

Question 4

A healthcare organization is migrating electronic health records (EHR) to the cloud and must comply with HIPAA. They want to use cloud-native encryption but retain the ability to immediately revoke access to all encrypted data. Which key management strategy best meets this requirement?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in the cloud KMS. The cloud service is authorized to use the key, but the customer can revoke access at any time by disabling the key, effectively rendering the data inaccessible. This provides control without the complexity of client-side encryption.

Answer

Hold your own key (HYOK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption

Question 5

An organization uses a cloud-based data analytics platform with data stored in a data warehouse. The security team discovers that some tables contain unencrypted personally identifiable information (PII). They need to automatically scan the data warehouse for PII and apply pseudonymization to protect sensitive columns. Which cloud service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP (Data Loss Prevention) APIs can scan data stores like BigQuery for sensitive data types (PII, credit card numbers, etc.) and apply de-identification transforms such as pseudonymization, masking, tokenization, etc. This is the intended service for automated discovery and protection.

Answer

Cloud Storage bucket policies

Answer

Cloud Access Security Broker (CASB)

Answer

Cloud Key Management Service (KMS)

Question 6

A company is implementing a data classification policy for cloud storage. They want to label objects with tags indicating the sensitivity level (e.g., 'Confidential'). Which benefit does tagging resources with classification labels provide?

Accepted Answer

It allows enforcement of data handling policies based on sensitivity. Tags enable automated enforcement of access controls, encryption requirements, and retention policies. For example, a policy can prevent objects tagged 'Confidential' from being made public. Tags also facilitate auditing and reporting.

Answer

It provides client-side encryption keys

Answer

It automatically encrypts data at rest

Answer

It reduces storage costs by moving data to cheaper tiers

Question 7

A global e-commerce company must store customer payment data in a specific geographic region to comply with local data residency laws. Which cloud configuration ensures that data never leaves the required region?

Accepted Answer

Select a specific cloud region for the storage and disable cross-region replication. Data residency is achieved by selecting a cloud region (e.g., 'EU-West-1') and configuring storage buckets or databases with region-specific policies. Additionally, bucket policies can explicitly deny access from outside the region, and replication features should be disabled or configured to stay within the region.

Answer

Use a global load balancer to route traffic

Answer

Enable cross-region replication to a secondary region for disaster recovery

Answer

Store data in a private cloud on-premises

Question 8

A security architect is designing a multi-cloud data protection strategy. They need to give a third-party auditor time-limited, read-only access to a specific file in a cloud storage bucket. Which access control method is most appropriate?

Accepted Answer

Pre-signed URL with an expiration time. Pre-signed URLs (or signed URLs) grant temporary access to a specific object without requiring the auditor to have cloud credentials. They can be configured with expiration times and permissions (e.g., read-only).

Answer

Cloud VPN connection for the auditor

Answer

Bucket ACL granting read access to the auditor's cloud account

Answer

IAM policy granting read access to the auditor's user

Question 9

A company uses a cloud key management service (KMS) with an HSM-backed key for encrypting sensitive data. They want to ensure that the key is automatically rotated every 90 days and that older key versions are retained for decryption of previously encrypted data. Which KMS feature should be configured?

Accepted Answer

Automatic key rotation with version retention. Key rotation in cloud KMS (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) can be set to automatic rotation with a specified period. Old key versions are retained so that data encrypted with older keys can still be decrypted. The key material changes, but key ID remains the same.

Answer

Key aliasing

Answer

Key destruction schedule

Answer

Key revocation policy

Question 10

Which phase of the cloud data lifecycle involves making data available for processing by applications and users?

Accepted Answer

Use. The cloud data lifecycle consists of Create, Store, Use, Share, Archive, Destroy. The 'Use' phase is when data is accessed and processed.

Answer

Archive

Answer

Store

Answer

Create

Question 11

A cloud security engineer needs to protect a storage bucket from accidental deletion and ransomware attacks. Which two features should be enabled together for maximum protection?

Accepted Answer

Bucket versioning and object lock. Versioning keeps multiple variants of an object, allowing recovery from accidental deletion or overwrite. Object lock (immutability) prevents objects from being deleted or overwritten for a specified retention period, protecting against ransomware. Combining both provides defense in depth.

Answer

IAM policies and MFA delete

Answer

Cross-region replication and lifecycle policies

Answer

Server access logging and bucket policies

Question 12

An organization wants to classify data in the cloud and assign labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. What is the primary purpose of this classification scheme?

Accepted Answer

To apply appropriate security controls based on sensitivity. Data classification helps determine appropriate security controls, such as encryption requirements, access permissions, and handling procedures. It guides policy enforcement.

Answer

To reduce cloud storage costs by moving data to cheaper tiers

Answer

To enable public sharing of data

Answer

To comply with data localization laws

Question 13

A company needs to encrypt data in transit between its on-premises data center and a cloud virtual private cloud (VPC). They require a dedicated, encrypted tunnel with consistent throughput. Which solution should be used?

Accepted Answer

Cloud VPN (IPsec) connection. A site-to-site VPN (IPsec VPN) provides an encrypted tunnel over the public internet between on-premises and cloud VPC. For higher throughput and reliability, dedicated connections like AWS Direct Connect or Azure ExpressRoute can be used with optional encryption. However, the question specifies 'encrypted tunnel', which VPN provides.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for all API communication

Answer

Cloud KMS key for envelope encryption

Question 14

A cloud security team is implementing data loss prevention for a data lake that stores customer support logs. They need to redact credit card numbers from the logs before they are used for analytics. Which DLP de-identification technique should be applied?

Accepted Answer

Masking. Masking replaces sensitive data with a placeholder, such as replacing credit card digits with asterisks, while preserving format for analytics. Tokenization replaces data with tokens but requires a token vault. Masking is simpler for one-way redaction.

Answer

Date shifting

Answer

Bucketing

Answer

Tokenization

Question 15

A cloud architect is designing key management for a multi-tenant SaaS application. The architect must ensure that each customer's encryption keys are isolated and that the cloud provider cannot access the keys. Which TWO key management strategies meet these requirements? (Select TWO.)

Accepted Answer

Client-side encryption. Client-side encryption ensures data is encrypted before it reaches the cloud, so the cloud provider never sees plaintext or keys. Hold Your Own Key (HYOK) keeps the key on-premises in an HSM, never exposing it to the cloud. Both give the customer exclusive control.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default server-side encryption