CCSP Cloud Data Security Practice Test 6 — 15 Questions

Question 1

An organization is designing a data residency strategy for compliance with data sovereignty laws. They must ensure that customer data remains within specific geographic boundaries. Which three measures should they implement? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IAM policies to restrict API calls to specific regions. To enforce data residency, organizations should choose cloud regions in the required geography, configure bucket policies to restrict storage location, and use IAM policies to limit access from other regions. Cross-region replication would violate data residency.

Answer

Use pre-signed URLs for all access

Answer

Enable cross-region replication for disaster recovery

Question 2

A company is moving its data to the cloud and must ensure that all data at rest is encrypted using keys that are generated and managed on-premises, with the cloud provider having no access to the keys. Which encryption method should be used?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-supplied encryption keys (CSEK) allow the customer to generate and manage keys outside the cloud, giving the maximum control and ensuring the cloud provider cannot access the keys.

Answer

Bring Your Own Key (BYOK)

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

AES-256 Server-Side Encryption

Question 3

A healthcare organization stores patient records in a cloud object storage bucket. The compliance team requires that all files containing Protected Health Information (PHI) be automatically identified and classified. Which service should the organization implement to scan the bucket for PHI and label the data accordingly?

Accepted Answer

Data Loss Prevention (DLP) service. A Data Loss Prevention (DLP) service can scan cloud object storage for sensitive data like PHI and perform classification and labeling. This is a common capability provided by cloud providers and third-party solutions.

Answer

Cloud Audit Logs

Answer

Cloud KMS

Answer

Identity and Access Management (IAM)

Question 4

A financial services company must comply with a regulation that requires encryption keys used for cloud services to be generated and stored on-premises in a Hardware Security Module (HSM). The cloud provider must not have any access to the keys. Which key management approach should the company adopt?

Accepted Answer

Hold Your Own Key (HYOK). Hold Your Own Key (HYOK) ensures the key never leaves the on-premises HSM, providing the highest level of control and preventing cloud provider access.

Answer

Cloud KMS with HSM-backed keys

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

Bring Your Own Key (BYOK)

Question 5

A multinational corporation is migrating its data to the cloud and needs to ensure that data belonging to EU residents never leaves the EU region due to GDPR data sovereignty requirements. Additionally, the company wants to prevent accidental deletion and protect against ransomware. Which combination of cloud storage features should be implemented to meet these requirements?

Accepted Answer

Bucket policy restricting to EU regions and versioning. Configuring a bucket policy that restricts data storage to EU regions ensures data residency. Enabling versioning protects against accidental deletion and ransomware by allowing recovery of previous object versions.

Answer

IAM policies and access logs

Answer

Cross-region replication and object lock

Answer

Client-side encryption and signed URLs

Question 6

Which of the following is the correct order of phases in the cloud data lifecycle?

Accepted Answer

Create, Store, Use, Share, Archive, Destroy. The standard cloud data lifecycle is Create, Store, Use, Share, Archive, Destroy.

Answer

Store, Create, Use, Share, Destroy, Archive

Answer

Create, Use, Store, Share, Archive, Destroy

Answer

Create, Share, Store, Use, Archive, Destroy

Question 7

A company uses a cloud object storage service to host a public website. The website content is static and needs to be accessible to anyone on the internet, but the company wants to prevent direct listing of the bucket contents. Which combination of access controls should be configured?

Accepted Answer

Bucket ACLs set to public and block public access disabled. Setting bucket ACLs to public and disabling block public access allows anonymous read access to objects. However, to prevent listing of bucket contents, the ACL must grant only object-level read (GetObject) and not bucket-level list (ListBucket). In cloud storage services like AWS S3, a bucket ACL with READ grants list access, so a bucket policy is typically used instead. In this scenario, with the given options, C is the only choice that enables public access while attempting to prevent listing, though it may not fully achieve it in all providers.

Answer

IAM policies granting public access to the bucket

Answer

Enable versioning and cross-region replication

Answer

Block public access to the bucket and use pre-signed URLs for objects

Question 8

An organization must implement encryption for data in transit between its on-premises data center and a cloud provider. The data is sensitive and the organization requires a dedicated, encrypted tunnel. Which solution should be used?

Accepted Answer

VPN connection. A VPN (Virtual Private Network) provides a dedicated, encrypted tunnel for hybrid connectivity between on-premises and cloud.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for API communication

Answer

Cloud KMS for key exchange

Question 9

Which data classification level typically includes information that, if disclosed, could cause serious damage to an organization, such as trade secrets or personally identifiable information (PII)?

Accepted Answer

Restricted. Restricted data is the highest classification level, covering data that could cause severe damage if disclosed.

Answer

Internal

Answer

Confidential

Answer

Public

Question 10

A cloud security engineer needs to de-identify a dataset containing credit card numbers before sharing it with a third-party analytics team. The engineer wants to replace each credit card number with a unique token that can be used for correlation but cannot be reversed to obtain the original number. Which de-identification technique should be used?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a non-reversible token, preserving the ability to correlate records without exposing the original values.

Answer

Pseudonymisation

Answer

Masking

Answer

Bucketing

Question 11

A company uses a cloud KMS service with an HSM backing for key storage. The security policy requires that keys be rotated automatically every 90 days and that old keys be retained for at least one year to decrypt archived data. Which key management feature should be configured to meet these requirements?

Accepted Answer

Key versioning with rotation schedule. Key rotation schedules and key version management allow automatic rotation and retention of old key versions for decryption of older data.

Answer

Key hierarchy with root key separation

Answer

Key policy with conditions for automatic rotation

Answer

Key import with manual rotation

Question 12

Which of the following is the primary benefit of using client-side encryption for data stored in the cloud?

Accepted Answer

Maximum control over encryption keys. Client-side encryption ensures that the cloud provider never has access to the encryption keys or the plaintext data, giving the customer maximum control.

Answer

Automatic key rotation

Answer

Simplified key management

Answer

Reduced latency for data access

Question 13

A company has enabled object versioning on its cloud storage bucket to protect against accidental deletion. A ransomware attack encrypts all objects and creates new versions. To recover the data, the company needs to restore the previous unencrypted versions. What is the most efficient recovery method?

Accepted Answer

Delete the current versions or use the previous versions directly. Since versioning is enabled, the company can delete the current (encrypted) versions or use the previous versions directly, effectively reverting to the state before the attack.

Answer

Use the object lifecycle policy to delete current versions

Answer

Request the cloud provider to restore from their backups

Answer

Restore from a backup stored in a different region

Question 14

A cloud security architect is designing a data loss prevention (DLP) strategy for a cloud environment that stores sensitive customer data. Which TWO techniques should be implemented to proactively identify and protect sensitive data? (Select TWO.)

Accepted Answer

De-identification transforms. Automated DLP scanning can discover sensitive data, and de-identification transforms can protect data by masking or tokenizing sensitive elements.

Answer

Cross-region replication

Answer

Bucket policies blocking all public access

Answer

Enabling object versioning

Question 15

A multinational corporation must comply with data residency requirements that mandate certain data must remain within the European Union. Additionally, the company needs to ensure high availability and disaster recovery for this data. Which TWO measures should be implemented? (Select TWO.)

Accepted Answer

Configure cross-region replication to another EU region. To comply with data residency and ensure availability/DR, select cloud regions located within the EU (D) and configure cross-region replication to another EU region (A). IAM policies restricting data access to EU regions are access controls and do not ensure the data remains stored within the EU. Options C and E violate residency or security. Therefore, A and D are correct.

Answer

Implement IAM policies with conditions restricting data access to EU regions

Answer

Use cross-region replication to a region outside the EU

Answer

Enable public access to the bucket for all users