CCSP Cloud Data Security Practice Test 5 — 15 Questions

Question 1

A global enterprise is designing a cloud storage architecture with cross-region replication for disaster recovery. They must ensure that data replicated to a secondary region is encrypted with keys managed by the customer, and that those keys are stored in the secondary region's key management service (KMS). Which THREE capabilities must be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Permission for the replication service to use the secondary region's key. To meet the requirements, the customer must use customer-managed keys (CMK) in the secondary region, enable cross-region replication, and ensure the replication service has permission to use the target region's key via an appropriate access control mechanism.

Answer

Default encryption with provider keys

Answer

Client-side encryption before upload

Question 2

A cloud architect is designing a data classification strategy for a multi-cloud environment. The strategy must automatically tag resources with classification labels and enforce access controls based on those labels. Which THREE components are essential for this automated classification and enforcement?

Accepted Answer

IAM policies that reference classification tags. Automated DLP scanning detects and classifies data, tagging applies labels, and IAM policies enforce access based on those labels.

Answer

Pre-signed URLs for temporary access

Answer

HSM-backed key generation

Question 3

A healthcare company stores patient records in a cloud storage bucket. They need to encrypt the data at rest using encryption keys that they manage themselves, but they want to generate the keys within the cloud provider's key management service. Which encryption option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys within the cloud provider's KMS, giving them control over key lifecycle without the operational overhead of generating keys externally.

Answer

Client-side encryption

Answer

Server-side encryption with Amazon S3-managed keys (SSE-S3)

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 4

A financial institution is implementing a data classification scheme for their cloud environment. They have data that, if exposed, could cause severe damage to the organization and is subject to strict regulatory requirements. Which classification level should be applied to this data?

Accepted Answer

Restricted. Restricted data is the highest classification level, typically used for data that, if compromised, could cause severe damage and is subject to strict regulations.

Answer

Confidential

Answer

Public

Answer

Internal

Question 5

An organization uses a cloud storage service with versioning enabled. They discover that a ransomware attack encrypted all current versions of their files. However, they can still recover the data. Which feature protects them?

Accepted Answer

Versioning. Versioning retains previous versions of objects, so even if current versions are encrypted, previous unencrypted versions can be restored. This protects against ransomware and accidental deletion.

Answer

Pre-signed URLs

Answer

Cross-region replication

Answer

Object lock

Question 6

A company wants to use a cloud KMS to encrypt data but requires that the encryption key never leaves their on-premises hardware security module (HSM) due to compliance. Which key management model should they adopt?

Accepted Answer

Hold Your Own Key (HYOK). Hold Your Own Key (HYOK) allows the customer to retain the key in their on-premises HSM, and the cloud service must call back to the on-premises HSM for each encryption/decryption operation. This provides maximum control but introduces latency.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Customer-Supplied Encryption Key (CSEK)

Answer

Bring Your Own Key (BYOK)

Question 7

An organization is moving sensitive customer data to the cloud and must ensure that data is encrypted before being sent to the cloud provider. They want to maintain full control over the encryption keys and not rely on the cloud provider for any key management. Which approach should they use?

Accepted Answer

Client-side encryption. Client-side encryption involves encrypting data on-premises or on the client side before uploading to the cloud. The keys are controlled entirely by the customer, and the cloud provider never has access to the plaintext or keys.

Answer

VPN encryption

Answer

Server-side encryption with AWS KMS

Answer

Transparent Data Encryption (TDE)

Question 8

A multinational corporation must comply with GDPR and store EU customer data only within the European Union. Which cloud storage security measure directly addresses this requirement?

Accepted Answer

Data residency configuration. Data residency policies restrict data storage to specific geographic regions. By selecting cloud regions within the EU, the organization ensures data does not leave the EU, complying with GDPR data localization requirements.

Answer

Pre-signed URLs

Answer

Bucket policies with IAM conditions

Answer

Cross-region replication

Question 9

A security team is setting up a DLP solution to scan cloud storage for credit card numbers. They want to automatically mask the detected credit card numbers so that only the last four digits are visible. Which DLP de-identification transform should they use?

Accepted Answer

Masking. Masking is a de-identification transform that replaces part of the sensitive data with a placeholder, such as showing only the last four digits of a credit card number.

Answer

Pseudonymization

Answer

Bucketing

Answer

Tokenization

Question 10

A cloud architect is designing a data lifecycle policy for a SaaS application. According to the cloud data lifecycle, which phase immediately follows the 'Share' phase?

Accepted Answer

Archive. The cloud data lifecycle is: Create, Store, Use, Share, Archive, Destroy. After sharing, data is typically archived for long-term retention before eventual destruction.

Answer

Store

Answer

Use

Answer

Destroy

Question 11

An organization uses cloud storage and wants to protect against accidental deletion of objects. They also want to be able to recover previous versions of objects in case of unintended modifications. Which feature should they enable?

Accepted Answer

Versioning. Versioning in cloud storage preserves every version of an object, allowing recovery from accidental deletions or overwrites.

Answer

Bucket policies

Answer

Access logs

Answer

Server-side encryption

Question 12

A company is required to encrypt all data in transit between its on-premises data center and its cloud environment. They have a hybrid cloud setup and need a secure tunnel for all traffic. Which solution should they implement?

Accepted Answer

VPN connection. A VPN (Virtual Private Network) creates an encrypted tunnel between the on-premises network and the cloud VPC, ensuring all traffic in transit is encrypted.

Answer

Client-side encryption

Answer

Pre-signed URLs

Answer

TLS 1.2+ for all API calls

Question 13

An organization uses a cloud DLP API to scan data in Cloud Storage and BigQuery for sensitive information. They need to replace social security numbers (SSNs) with a non-reversible token that can be used for consistent mapping without exposing the original SSN. Which de-identification technique should they use?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a unique, non-reversible token that maintains referential integrity. Unlike masking, it completely replaces the original value.

Answer

Masking

Answer

Date shifting

Answer

Pseudonymization

Question 14

A cloud security architect is designing a key management strategy for a multi-cloud environment. They want to ensure that encryption keys are generated and stored on-premises but can be used by cloud services for encryption operations. Which two key management models meet these requirements? (Choose two.)

Accepted Answer

Hold Your Own Key (HYOK). BYOK allows generating keys on-premises and importing them into cloud KMS. HYOK keeps keys on-premises and cloud services call back to the on-premises HSM for operations. Both involve keys originating on-premises.

Answer

Customer-Managed Encryption Key (CMEK)

Answer

Cloud provider default encryption

Answer

Client-side encryption

Question 15

A financial services company is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. They need to identify and classify data containing personally identifiable information (PII) such as credit card numbers and social security numbers. Which three capabilities should the DLP solution provide? (Choose three.)

Accepted Answer

Classification of data based on content. Cloud DLP solutions typically include discovery (scanning for sensitive data), classification (labeling data types), and de-identification transforms (masking, tokenization) to protect data.

Answer

Encryption at rest using AES-256

Answer

Blocking public access to buckets