CCSP Cloud Data Security Practice Test 5 — 15 Questions

Question 1

A healthcare company stores patient records in a cloud storage bucket. They need to encrypt the data at rest using encryption keys that they manage themselves, but they want to generate the keys within the cloud provider's key management service. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys within the cloud provider's KMS, giving them control over key lifecycle without the operational overhead of generating keys externally.

Answer

Client-side encryption

Answer

Server-side encryption with Amazon S3-managed keys (SSE-S3)

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 2

A financial institution is implementing a data classification scheme for their cloud environment. They have data that, if exposed, could cause severe damage to the organization and is subject to strict regulatory requirements. Which classification level should be applied to this data?

Accepted Answer

Restricted. Restricted data is the highest classification level, typically used for data that, if compromised, could cause severe damage and is subject to strict regulations.

Answer

Confidential

Answer

Public

Answer

Internal

Question 3

An organization uses a cloud storage service with versioning enabled. They discover that a ransomware attack encrypted all current versions of their files. However, they can still recover the data. Which feature protects them?

Accepted Answer

Versioning. Versioning retains previous versions of objects, so even if current versions are encrypted, previous unencrypted versions can be restored. This protects against ransomware and accidental deletion.

Answer

Pre-signed URLs

Answer

Cross-region replication

Answer

Object lock

Question 4

A company wants to use a cloud KMS to encrypt data but requires that the encryption key never leaves their on-premises hardware security module (HSM) due to compliance. Which key management model should they adopt?

Accepted Answer

Hold Your Own Key (HYOK). Hold Your Own Key (HYOK) allows the customer to retain the key in their on-premises HSM, and the cloud service must call back to the on-premises HSM for each encryption/decryption operation. This provides maximum control but introduces latency.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Customer-Supplied Encryption Key (CSEK)

Answer

Bring Your Own Key (BYOK)

Question 5

An organization is moving sensitive customer data to the cloud and must ensure that data is encrypted before being sent to the cloud provider. They want to maintain full control over the encryption keys and not rely on the cloud provider for any key management. Which approach should they use?

Accepted Answer

Client-side encryption. Client-side encryption involves encrypting data on-premises or on the client side before uploading to the cloud. The keys are controlled entirely by the customer, and the cloud provider never has access to the plaintext or keys.

Answer

VPN encryption

Answer

Server-side encryption with AWS KMS

Answer

Transparent Data Encryption (TDE)

Question 6

A multinational corporation must comply with GDPR and store EU customer data only within the European Union. Which cloud storage security measure directly addresses this requirement?

Accepted Answer

Data residency configuration. Data residency policies restrict data storage to specific geographic regions. By selecting cloud regions within the EU, the organization ensures data does not leave the EU, complying with GDPR data localization requirements.

Answer

Pre-signed URLs

Answer

Bucket policies with IAM conditions

Answer

Cross-region replication

Question 7

A security team is setting up a DLP solution to scan cloud storage for credit card numbers. They want to automatically mask the detected credit card numbers so that only the last four digits are visible. Which DLP de-identification transform should they use?

Accepted Answer

Masking. Masking is a de-identification transform that replaces part of the sensitive data with a placeholder, such as showing only the last four digits of a credit card number.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 8

An organization wants to share a large file from a cloud storage bucket with an external partner for a limited time. They need to ensure that the partner can only access the specific file and that the access expires automatically. Which method should they use?

Accepted Answer

Use a pre-signed URL. Pre-signed URLs (or signed URLs) grant time-limited access to a specific object. The URL contains authentication information and an expiration time, allowing the partner to download the object without needing AWS credentials.

Answer

Make the bucket public

Answer

Create a new IAM user for the partner and attach a policy to the bucket

Answer

Use cross-region replication

Question 9

A cloud architect is designing a data lifecycle policy for a SaaS application. According to the cloud data lifecycle, which phase immediately follows the 'Share' phase?

Accepted Answer

Archive. The cloud data lifecycle is: Create, Store, Use, Share, Archive, Destroy. After sharing, data is typically archived for long-term retention before eventual destruction.

Answer

Store

Answer

Use

Answer

Destroy

Question 10

An organization uses cloud storage and wants to protect against accidental deletion of objects. They also want to be able to recover previous versions of objects in case of unintended modifications. Which feature should they enable?

Accepted Answer

Versioning. Versioning in cloud storage preserves every version of an object, allowing recovery from accidental deletions or overwrites.

Answer

Bucket policies

Answer

Access logs

Answer

Server-side encryption

Question 11

A company is required to encrypt all data in transit between its on-premises data center and its cloud environment. They have a hybrid cloud setup and need a secure tunnel for all traffic. Which solution should they implement?

Accepted Answer

VPN connection. A VPN (Virtual Private Network) creates an encrypted tunnel between the on-premises network and the cloud VPC, ensuring all traffic in transit is encrypted.

Answer

Client-side encryption

Answer

Pre-signed URLs

Answer

TLS 1.2+ for all API calls

Question 12

An organization uses a cloud DLP API to scan data in Cloud Storage and BigQuery for sensitive information. They need to replace social security numbers (SSNs) with a non-reversible token that can be used for consistent mapping without exposing the original SSN. Which de-identification technique should they use?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a unique, non-reversible token that maintains referential integrity. Unlike masking, it completely replaces the original value.

Answer

Masking

Answer

Date shifting

Answer

Pseudonymization

Question 13

A cloud security architect is designing a key management strategy for a multi-cloud environment. They want to ensure that encryption keys are generated and stored on-premises but can be used by cloud services for encryption operations. Which two key management models meet these requirements? (Choose two.)

Accepted Answer

Hold Your Own Key (HYOK). BYOK allows generating keys on-premises and importing them into cloud KMS. HYOK keeps keys on-premises and cloud services call back to the on-premises HSM for operations. Both involve keys originating on-premises.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Cloud provider default encryption

Answer

Client-side encryption

Question 14

A financial services company is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. They need to identify and classify data containing personally identifiable information (PII) such as credit card numbers and social security numbers. Which three capabilities should the DLP solution provide? (Choose three.)

Accepted Answer

Classification of data based on content. Cloud DLP solutions typically include discovery (scanning for sensitive data), classification (labeling data types), and de-identification transforms (masking, tokenization) to protect data.

Answer

Encryption at rest using AES-256

Answer

Blocking public access to buckets

Question 15

An organization is designing a data residency strategy for compliance with data sovereignty laws. They must ensure that customer data remains within specific geographic boundaries. Which three measures should they implement? (Choose three.)

Accepted Answer

Use IAM policies to restrict API calls to specific regions. To enforce data residency, organizations should choose cloud regions in the required geography, configure bucket policies to restrict storage location, and use IAM policies to limit access from other regions. Cross-region replication would violate data residency.

Answer

Use pre-signed URLs for all access

Answer

Enable cross-region replication for disaster recovery