CCSP Cloud Data Security Practice Test 6 — 15 Questions

Question 1

A company is moving its data to the cloud and must ensure that all data at rest is encrypted using keys that are generated and managed on-premises, with the cloud provider having no access to the keys. Which encryption method should be used?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-supplied encryption keys (CSEK) allow the customer to generate and manage keys outside the cloud, giving the maximum control and ensuring the cloud provider cannot access the keys.

Answer

Bring Your Own Key (BYOK)

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

AES-256 Server-Side Encryption

Question 2

A healthcare organization stores patient records in a cloud object storage bucket. The compliance team requires that all files containing Protected Health Information (PHI) be automatically identified and classified. Which service should the organization implement to scan the bucket for PHI and label the data accordingly?

Accepted Answer

Cloud DLP API. Cloud DLP (Data Loss Prevention) APIs can scan cloud storage for sensitive data like PHI and perform classification and labeling.

Answer

Cloud Audit Logs

Answer

Cloud KMS

Answer

Identity and Access Management (IAM)

Question 3

A financial services company must comply with a regulation that requires encryption keys used for cloud services to be generated and stored on-premises in a Hardware Security Module (HSM). The cloud provider must not have any access to the keys. Which key management approach should the company adopt?

Accepted Answer

Hold Your Own Key (HYOK). Hold Your Own Key (HYOK) ensures the key never leaves the on-premises HSM, providing the highest level of control and preventing cloud provider access.

Answer

Cloud KMS with HSM-backed keys

Answer

Customer-Managed Encryption Keys (CMEK)

Answer

Bring Your Own Key (BYOK)

Question 4

A multinational corporation is migrating its data to the cloud and needs to ensure that data belonging to EU residents never leaves the EU region due to GDPR data sovereignty requirements. Additionally, the company wants to prevent accidental deletion and protect against ransomware. Which combination of cloud storage features should be implemented to meet these requirements?

Accepted Answer

Bucket policy restricting to EU regions and versioning. Configuring a bucket policy that restricts data storage to EU regions ensures data residency. Enabling versioning protects against accidental deletion and ransomware by allowing recovery of previous object versions.

Answer

IAM policies and access logs

Answer

Cross-region replication and object lock

Answer

Client-side encryption and signed URLs

Question 5

Which of the following is the correct order of phases in the cloud data lifecycle?

Accepted Answer

Create, Store, Use, Share, Archive, Destroy. The standard cloud data lifecycle is Create, Store, Use, Share, Archive, Destroy.

Answer

Store, Create, Use, Share, Destroy, Archive

Answer

Create, Use, Store, Share, Archive, Destroy

Answer

Create, Share, Store, Use, Archive, Destroy

Question 6

A company uses a cloud object storage service to host a public website. The website content is static and needs to be accessible to anyone on the internet, but the company wants to prevent direct listing of the bucket contents. Which combination of access controls should be configured?

Accepted Answer

Block public access to the bucket and use pre-signed URLs for objects. Blocking public access to the bucket while allowing access via signed URLs provides time-limited access to specific objects without exposing the entire bucket.

Answer

IAM policies granting public access to the bucket

Answer

Enable versioning and cross-region replication

Answer

Bucket ACLs set to public and block public access disabled

Question 7

An organization must implement encryption for data in transit between its on-premises data center and a cloud provider. The data is sensitive and the organization requires a dedicated, encrypted tunnel. Which solution should be used?

Accepted Answer

VPN connection. A VPN (Virtual Private Network) provides a dedicated, encrypted tunnel for hybrid connectivity between on-premises and cloud.

Answer

Client-side encryption before upload

Answer

TLS 1.2 for API communication

Answer

Cloud KMS for key exchange

Question 8

Which data classification level typically includes information that, if disclosed, could cause serious damage to an organization, such as trade secrets or personally identifiable information (PII)?

Accepted Answer

Restricted. Restricted data is the highest classification level, covering data that could cause severe damage if disclosed.

Answer

Internal

Answer

Confidential

Answer

Public

Question 9

A cloud security engineer needs to de-identify a dataset containing credit card numbers before sharing it with a third-party analytics team. The engineer wants to replace each credit card number with a unique token that can be used for correlation but cannot be reversed to obtain the original number. Which de-identification technique should be used?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a non-reversible token, preserving the ability to correlate records without exposing the original values.

Answer

Pseudonymisation

Answer

Masking

Answer

Bucketing

Question 10

A company uses a cloud KMS service with an HSM backing for key storage. The security policy requires that keys be rotated automatically every 90 days and that old keys be retained for at least one year to decrypt archived data. Which key management feature should be configured to meet these requirements?

Accepted Answer

Key versioning with rotation schedule. Key rotation schedules and key version management allow automatic rotation and retention of old key versions for decryption of older data.

Answer

Key hierarchy with root key separation

Answer

Key policy with conditions for automatic rotation

Answer

Key import with manual rotation

Question 11

Which of the following is the primary benefit of using client-side encryption for data stored in the cloud?

Accepted Answer

Maximum control over encryption keys. Client-side encryption ensures that the cloud provider never has access to the encryption keys or the plaintext data, giving the customer maximum control.

Answer

Automatic key rotation

Answer

Simplified key management

Answer

Reduced latency for data access

Question 12

A company has enabled object versioning on its cloud storage bucket to protect against accidental deletion. A ransomware attack encrypts all objects and creates new versions. To recover the data, the company needs to restore the previous unencrypted versions. What is the most efficient recovery method?

Accepted Answer

Delete the current versions or use the previous versions directly. Since versioning is enabled, the company can delete the current (encrypted) versions or use the previous versions directly, effectively reverting to the state before the attack.

Answer

Use the object lifecycle policy to delete current versions

Answer

Request the cloud provider to restore from their backups

Answer

Restore from a backup stored in a different region

Question 13

A cloud security architect is designing a data loss prevention (DLP) strategy for a cloud environment that stores sensitive customer data. Which TWO techniques should be implemented to proactively identify and protect sensitive data? (Select TWO.)

Accepted Answer

De-identification transforms. Automated DLP scanning can discover sensitive data, and de-identification transforms can protect data by masking or tokenizing sensitive elements.

Answer

Cross-region replication

Answer

Bucket policies blocking all public access

Answer

Enabling object versioning

Question 14

A multinational corporation must comply with data residency requirements that mandate certain data must remain within the European Union. Additionally, the company needs to ensure high availability and disaster recovery for this data. Which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Configure cross-region replication to another EU region. Choosing EU regions ensures data stays within the EU. Cross-region replication within the EU provides DR. IAM policies with region conditions enforce access controls.

Answer

Use cross-region replication to a region outside the EU

Answer

Enable public access to the bucket for all users

Question 15

A cloud security team is implementing encryption for data at rest in a cloud storage service. They require that the encryption keys be managed by the customer and that the cloud provider has access to the keys only when authorized by the customer. Which TWO key management options meet these requirements? (Select TWO.)

Accepted Answer

Customer-Managed Encryption Keys (CMEK). CMEK (Customer-Managed Encryption Keys) allows the customer to create and manage keys in cloud KMS, and BYOK (Bring Your Own Key) allows importing keys into cloud KMS. In both cases, the provider can access the keys when authorized.

Answer

Cloud Provider Default Encryption

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Hold Your Own Key (HYOK)