CCSP Cloud Data Security Practice Test 4 — 15 Questions

Question 1

A healthcare organization is storing patient records in a cloud object storage service. They must encrypt data at rest with keys they control and rotate regularly, but they do not want to manage the encryption process themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows the customer to create and manage keys in the cloud KMS, while the cloud service performs encryption/decryption using those keys, providing control without operational burden.

Answer

Server-side encryption with cloud provider default keys

Answer

Customer-supplied encryption keys (CSEK)

Answer

Client-side encryption

Question 2

A financial services company uses a cloud DLP API to scan data stored in Cloud Storage and BigQuery. They need to reduce the risk of exposing credit card numbers in reports by replacing the first 12 digits with asterisks while preserving the last four. Which de-identification technique should they apply?

Accepted Answer

Masking. Masking allows selective obfuscation of parts of a data value, such as showing only the last four digits of a credit card number.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 3

A multinational corporation must ensure that customer data from the European Union is stored and processed only within EU regions to comply with GDPR. They are using a cloud provider with data centers globally. What is the primary mechanism to enforce this requirement?

Accepted Answer

Selecting cloud regions located within the EU for all services. Cloud providers allow customers to select specific geographic regions for resource deployment, ensuring data residency compliance.

Answer

Client-side encryption with keys stored in the EU

Answer

Using a VPN to route all traffic through an EU gateway

Answer

Configuring IAM policies to restrict access to EU-based administrators

Question 4

A cloud security architect is designing a key management strategy for a hybrid cloud environment. The organization requires that encryption keys never leave their on-premises hardware security module (HSM) due to strict regulatory mandates, yet cloud services must be able to perform encryption operations on data at rest. Which key management approach meets these requirements?

Accepted Answer

Hold Your Own Key (HYOK). HYOK (Hold Your Own Key) keeps the key in the customer's on-prem HSM; the cloud service sends data to be encrypted/decrypted on-prem, which can introduce latency but satisfies key location constraints.

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud provider default encryption

Answer

Bring Your Own Key (BYOK)

Question 5

A data governance team is developing a classification scheme for cloud-stored data. They want to label data based on sensitivity, from least to most restrictive. Which of the following is a typical classification category for highly sensitive data that could cause severe damage if disclosed?

Accepted Answer

Restricted. In common classification schemes, 'Restricted' is the highest level, used for data that requires strict access control and protection.

Answer

Internal

Answer

Confidential

Answer

Public

Question 6

An organization uses cloud object storage with versioning enabled. After a ransomware attack, they discover that many objects were encrypted by the attacker. How does versioning help in this scenario?

Accepted Answer

It allows restoration of the previous unencrypted version of each object. Versioning retains previous versions of objects, so if the current version is encrypted or modified, the last unmodified version can be restored, provided the attacker did not delete versions.

Answer

It replicates objects to a different region for disaster recovery

Answer

It prevents any object from being overwritten or deleted

Answer

It automatically encrypts all objects with customer-managed keys

Question 7

A cloud security team is implementing data loss prevention (DLP) for sensitive data in a cloud data warehouse. They need to detect and classify Social Security numbers (SSNs) stored in tables. Which cloud service capability is most appropriate for this task?

Accepted Answer

Cloud DLP API. Cloud DLP APIs can scan structured data like BigQuery tables for sensitive patterns (e.g., SSNs) and classify them.

Answer

Object storage bucket policies

Answer

Key management service

Answer

Identity and access management (IAM)

Question 8

A cloud architect is designing a secure data sharing mechanism for a third-party partner. The partner needs temporary access to download a specific object from a private cloud storage bucket, but should not have broader access to the bucket. Which approach should be used?

Accepted Answer

Use a pre-signed URL. Pre-signed URLs grant time-limited access to a specific object without requiring the partner to have AWS credentials or bucket-level permissions.

Answer

Make the object publicly readable

Answer

Use cross-region replication to the partner's account

Answer

Grant the partner IAM role with read access to the bucket

Question 9

Which phase of the cloud data lifecycle involves the removal of data in a manner that ensures it cannot be reconstructed, typically using techniques like cryptographic erasure or degaussing?

Accepted Answer

Destroy. The Destroy phase is when data is securely disposed of, ensuring it cannot be recovered.

Answer

Store

Answer

Share

Answer

Archive

Question 10

A company is using a cloud provider's key management service (KMS) with HSM-backed keys. They want to ensure that key material is automatically replaced periodically to limit the impact of a potential key compromise. Which KMS feature should they configure?

Accepted Answer

Key rotation. Key rotation automatically generates new key material at defined intervals, reducing the risk of key compromise.

Answer

Key export

Answer

Key revocation

Answer

Key policies

Question 11

An organization is required to use client-side encryption for all data uploaded to a cloud storage service to ensure that the cloud provider has no access to plaintext. However, they also need to allow the cloud provider to perform server-side operations like indexing and search on the encrypted data. Which technology can address this conflict?

Accepted Answer

Searchable encryption. Searchable encryption allows certain operations (e.g., keyword search) on encrypted data without decrypting it, enabling server-side processing while maintaining confidentiality.

Answer

Format-preserving encryption

Answer

Tokenization

Answer

Homomorphic encryption

Question 12

A cloud security analyst is reviewing access logs and notices that a pre-signed URL for an object was used after its expiration time. What should be the outcome of such an access attempt?

Accepted Answer

The request is denied with an access denied error. Pre-signed URLs are time-limited; once expired, the URL is invalid and access is denied.

Answer

The request is redirected to a new URL automatically

Answer

The request is allowed because the URL was generated with valid credentials

Answer

The request is logged but still granted

Question 13

A cloud security team is evaluating DLP techniques to protect sensitive data in a cloud data warehouse. They want to replace sensitive values with realistic but fictitious data for non-production environments while preserving referential integrity. Which TWO de-identification techniques are suitable?

Accepted Answer

Pseudonymization. Tokenization replaces sensitive data with a token that can be consistent across tables, preserving referential integrity. Pseudonymization replaces identifiers with consistent pseudonyms, also preserving relationships.

Answer

Bucketing

Answer

Masking

Answer

Date shifting

Question 14

A global enterprise is designing a cloud storage architecture with cross-region replication for disaster recovery. They must ensure that data replicated to a secondary region is encrypted with keys managed by the customer, and that those keys are stored in the secondary region's KMS. Which THREE capabilities must be enabled?

Accepted Answer

IAM permission for the replication service to use the secondary region's key. To meet the requirements, the customer must use CMEK (customer-managed keys) in the secondary region, enable cross-region replication, and ensure the replication service has permission to use the target region's key via IAM permission.

Answer

Default encryption with provider keys

Answer

Client-side encryption before upload

Question 15

A cloud architect is designing a data classification strategy for a multi-cloud environment. The strategy must automatically tag resources with classification labels and enforce access controls based on those labels. Which THREE components are essential for this automated classification and enforcement?

Accepted Answer

IAM policies that reference classification tags. Automated DLP scanning detects and classifies data, tagging applies labels, and IAM policies enforce access based on those labels.

Answer

Pre-signed URLs for temporary access

Answer

HSM-backed key generation