CCSP Cloud Data Security Practice Test 4 — 15 Questions

Question 1

A financial institution is migrating to the cloud and must comply with regulations requiring that sensitive data be stored only in specific geographic regions and that access to data is logged and monitored. Which THREE controls should be implemented? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable server access logs for the storage bucket. To enforce data residency, the cloud region must be restricted via IAM or organization policies. Server access logging captures all requests to storage. VPC Service Controls create a security perimeter around cloud resources, preventing data exfiltration. Cross-region replication would violate residency, and default encryption is not sufficient.

Answer

Use default server-side encryption with cloud-managed keys

Answer

Enable cross-region replication for disaster recovery

Question 2

A security analyst is reviewing a cloud storage bucket that contains archived customer records. The analyst wants to ensure that no object in the bucket can be modified or deleted for 7 years to meet regulatory retention requirements. Which TWO features should be enabled? (Select TWO.)

Accepted Answer

Bucket versioning. Object lock (retention mode) enforces a retention period on objects, preventing deletion or modification. Versioning allows recovery in case of accidental deletion of lock or creation of delete markers. Together they provide a comprehensive retention solution, though object lock alone may suffice if versioning is not required.

Answer

Bucket ACL restricting write access

Answer

Lifecycle policy to transition to archival storage

Answer

Cross-region replication

Question 3

A healthcare organization is storing patient records in a cloud object storage service. They must encrypt data at rest with keys they control and rotate regularly, but they do not want to manage the encryption process themselves. Which encryption option should they use?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows the customer to create and manage keys in the cloud KMS, while the cloud service performs encryption/decryption using those keys, providing control without operational burden.

Answer

Server-side encryption with cloud provider default keys

Answer

Customer-supplied encryption keys (CSEK)

Answer

Client-side encryption

Question 4

A financial services company uses a cloud DLP API to scan data stored in Cloud Storage and BigQuery. They need to reduce the risk of exposing credit card numbers in reports by replacing the first 12 digits with asterisks while preserving the last four. Which de-identification technique should they apply?

Accepted Answer

Masking. Masking allows selective obfuscation of parts of a data value, such as showing only the last four digits of a credit card number.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 5

A multinational corporation must ensure that customer data from the European Union is stored and processed only within EU regions to comply with GDPR. They are using a cloud provider with data centers globally. What is the primary mechanism to enforce this requirement?

Accepted Answer

Selecting cloud regions located within the EU for all services. Cloud providers allow customers to select specific geographic regions for resource deployment, ensuring data residency compliance.

Answer

Client-side encryption with keys stored in the EU

Answer

Using a VPN to route all traffic through an EU gateway

Answer

Configuring IAM policies to restrict access to EU-based administrators

Question 6

A cloud security architect is designing a key management strategy for a hybrid cloud environment. The organization requires that encryption keys never leave their on-premises hardware security module (HSM) due to strict regulatory mandates, yet cloud services must be able to perform encryption operations on data at rest. Which key management approach meets these requirements?

Accepted Answer

Hold Your Own Key (HYOK). HYOK (Hold Your Own Key) keeps the key in the customer's on-prem HSM; the cloud service sends data to be encrypted/decrypted on-prem, which can introduce latency but satisfies key location constraints.

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud provider default encryption

Answer

Bring Your Own Key (BYOK)

Question 7

A data governance team is developing a classification scheme for cloud-stored data. They want to label data based on sensitivity, from least to most restrictive. Which of the following is a typical classification category for highly sensitive data that could cause severe damage if disclosed?

Accepted Answer

Restricted. In common classification schemes, 'Restricted' is the highest level, used for data that requires strict access control and protection.

Answer

Internal

Answer

Confidential

Answer

Public

Question 8

An organization uses cloud object storage with versioning enabled. After a ransomware attack, they discover that many objects were encrypted by the attacker. How does versioning help in this scenario?

Accepted Answer

It allows restoration of the previous unencrypted version of each object. Versioning retains previous versions of objects, so if the current version is encrypted or modified, the last unmodified version can be restored, provided the attacker did not delete versions.

Answer

It replicates objects to a different region for disaster recovery

Answer

It prevents any object from being overwritten or deleted

Answer

It automatically encrypts all objects with customer-managed keys

Question 9

A cloud security team is implementing data loss prevention (DLP) for sensitive data in a cloud data warehouse. They need to detect and classify Social Security numbers (SSNs) stored in tables. Which cloud service capability is most appropriate for this task?

Accepted Answer

Cloud DLP API. Cloud DLP APIs can scan structured data like BigQuery tables for sensitive patterns (e.g., SSNs) and classify them.

Answer

Object storage bucket policies

Answer

Key management service

Answer

Identity and access management (IAM)

Question 10

A cloud architect is designing a secure data sharing mechanism for a third-party partner. The partner needs temporary access to download a specific object from a private cloud storage bucket, but should not have broader access to the bucket. Which approach should be used?

Accepted Answer

Use a time-limited access URL for the specific object. A time-limited access URL grants temporary access to a specific object without requiring the partner to have cloud credentials or bucket-level permissions.

Answer

Make the object publicly readable

Answer

Use cross-region replication to the partner's account

Answer

Grant the partner a role with read access to the bucket

Question 11

Which phase of the cloud data lifecycle involves the removal of data in a manner that ensures it cannot be reconstructed, typically using techniques like cryptographic erasure or degaussing?

Accepted Answer

Destroy. The Destroy phase is when data is securely disposed of, ensuring it cannot be recovered.

Answer

Store

Answer

Share

Answer

Archive

Question 12

A company is using a cloud provider's key management service (KMS) with HSM-backed keys. They want to ensure that key material is automatically replaced periodically to limit the impact of a potential key compromise. Which KMS feature should they configure?

Accepted Answer

Key rotation. Key rotation automatically generates new key material at defined intervals, reducing the risk of key compromise.

Answer

Key export

Answer

Key revocation

Answer

Key policies

Question 13

An organization is required to use client-side encryption for all data uploaded to a cloud storage service to ensure that the cloud provider has no access to plaintext. However, they also need to allow the cloud provider to perform server-side operations like indexing and search on the encrypted data. Which technology can address this conflict?

Accepted Answer

Searchable encryption. Searchable encryption allows certain operations (e.g., keyword search) on encrypted data without decrypting it, enabling server-side processing while maintaining confidentiality.

Answer

Format-preserving encryption

Answer

Tokenization

Answer

Homomorphic encryption

Question 14

A cloud security analyst is reviewing access logs and notices that a pre-signed URL for an object was used after its expiration time. What should be the outcome of such an access attempt?

Accepted Answer

The request is denied with an access denied error. Pre-signed URLs are time-limited; once expired, the URL is invalid and access is denied.

Answer

The request is redirected to a new URL automatically

Answer

The request is allowed because the URL was generated with valid credentials

Answer

The request is logged but still granted

Question 15

A cloud security team is evaluating DLP techniques to protect sensitive data in a cloud data warehouse. They want to replace sensitive values with realistic but fictitious data for non-production environments while preserving referential integrity. Which TWO de-identification techniques are suitable?

Accepted Answer

Pseudonymization. Tokenization replaces sensitive data with a token that can be consistent across tables, preserving referential integrity. Pseudonymization replaces identifiers with consistent pseudonyms, also preserving relationships.

Answer

Bucketing

Answer

Masking

Answer

Date shifting