CCSP Cloud Data Security — Timed 20 Questions

Question 1

A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?

Accepted Answer

Hold your own key (HYOK). HYOK (Hold Your Own Key) allows the customer to keep keys on-premises in their own HSM, never exposing them to the cloud provider. This provides maximum control but can introduce latency.

Answer

Customer-managed encryption keys (CMEK)

Answer

Bring your own key (BYOK)

Answer

Cloud provider default encryption (SSE-S3)

Question 2

A healthcare organization is storing protected health information (PHI) in a cloud object storage service. They want to ensure that if a storage bucket is accidentally made public, the data remains unreadable. Which combination of controls best addresses this risk?

Accepted Answer

Enable server-side encryption with AES-256 and block public access. Enabling object-level encryption with customer-managed keys (CMEK) and blocking public access at the bucket level ensures that even if the bucket is misconfigured, data is encrypted and inaccessible without the key.

Answer

Apply data classification labels and enable DLP scanning

Answer

Enable bucket versioning and cross-region replication

Answer

Use pre-signed URLs and IAM policies

Question 3

A multinational corporation must comply with GDPR and local data residency laws. They are designing a cloud storage architecture that will store customer data in the EU region. However, to improve disaster recovery, they want to replicate data to a secondary region outside the EU. Which approach meets compliance requirements?

Accepted Answer

Use same-region replication within the EU and disable cross-region replication. To comply with data residency laws, data must stay within the EU. Replicating to a non-EU region violates GDPR. Instead, they should replicate to another EU region or use encryption with customer-managed keys and ensure the key is stored in the EU.

Answer

Use cross-region replication to a non-EU region but apply client-side encryption before upload

Answer

Use cross-region replication to a US region and encrypt data with SSE-S3

Answer

Use cross-region replication to a non-EU region and rely on a Data Processing Agreement (DPA)

Question 4

A cloud security engineer is configuring a Data Loss Prevention (DLP) API to scan a cloud storage bucket for personally identifiable information (PII). Which of the following is a de-identification technique that replaces sensitive values with a token that can be mapped back to the original data using a secure lookup table?

Accepted Answer

Tokenization. Tokenization replaces sensitive data with a token that can be reversed via a lookup table, preserving referential integrity while protecting the original data.

Answer

Pseudonymization

Answer

Bucketing

Answer

Masking

Question 5

Which of the following is the most granular method to grant time-limited access to a specific object in a cloud storage bucket without requiring the requester to have AWS credentials?

Accepted Answer

Pre-signed URLs. Pre-signed URLs (or signed URLs) grant time-limited access to a specific object, and the requester does not need to be authenticated with cloud credentials.

Answer

Bucket ACLs

Answer

Bucket policies with conditions

Answer

IAM policies

Question 6

An organization wants to use cloud KMS to manage encryption keys. They require automatic key rotation every 90 days and the ability to define granular access policies for who can use the keys. Which key management model should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow the customer to create and manage keys in cloud KMS, enabling automatic rotation and fine-grained access policies.

Answer

Cloud provider default encryption

Answer

Customer-supplied encryption keys (CSEK)

Answer

Bring your own key (BYOK)

Question 7

A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?

Accepted Answer

Switch to server-side encryption with CMEK and grant the analytics service access to the KMS key. Client-side encryption typically prevents the cloud provider from accessing keys, but to allow processing, the data must be decrypted. Using customer-managed keys (CMEK) and granting the analytics service access to the keys via KMS policies enables processing while keeping key control with the customer.

Answer

Use client-side encryption but store the key in the cloud provider's key vault

Answer

Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data

Answer

Continue using client-side encryption and provide the analytics service with the encryption key

Question 8

A data classification scheme for a cloud environment defines labels such as Public, Internal, Confidential, and Restricted. Which label should be applied to data that, if disclosed, would cause severe damage to the organization and is subject to regulatory fines?

Accepted Answer

Restricted. Restricted is the highest classification level, used for data that would cause severe damage if disclosed and is subject to strict regulatory controls.

Answer

Public

Answer

Confidential

Answer

Internal

Question 9

A cloud storage bucket is configured with versioning enabled. A ransomware attack encrypts all objects in the bucket. How can the organization recover the original data?

Accepted Answer

Restore from previous versions of the objects. Versioning preserves previous versions of objects. The organization can restore previous unencrypted versions, provided they have not been deleted and the ransomware did not delete versions.

Answer

Use the cloud provider's backup service to restore the bucket

Answer

Replicate data from the cross-region replica

Answer

Use the cloud provider's ransomware recovery service

Question 10

When data is in transit between an on-premises data center and a cloud service, which of the following is the minimum encryption standard recommended by security best practices?

Accepted Answer

TLS 1.2. TLS 1.2 or higher is the minimum standard for encrypting data in transit to protect against eavesdropping and tampering.

Answer

IPsec with 3DES

Answer

TLS 1.0

Answer

SSL 3.0

Question 11

A data lifecycle policy requires that data be destroyed after a retention period. In a cloud object storage service, what is the most secure method to ensure that data is irretrievably destroyed?

Accepted Answer

Use a lifecycle policy to expire objects and delete delete markers. Object deletion with versioning disabled ensures that the data is removed and cannot be recovered. If versioning is enabled, a delete marker is added; previous versions remain. Configuring a lifecycle policy to expire objects after a retention period automates deletion.

Answer

Overwrite the objects with random data multiple times before deletion

Answer

Enable MFA delete and then delete the objects

Answer

Delete the objects and then delete the bucket

Question 12

An organization is deploying a cloud DLP solution to scan data at rest. They want to automatically classify and tag sensitive data, and then apply access controls based on the tags. Which cloud service capability is most directly used to enforce access decisions based on data classification tags?

Accepted Answer

IAM policies with tag-based conditions. Cloud services often use IAM policies that can conditionally grant access based on resource tags. For example, AWS IAM policies can use Condition blocks to allow access only if the resource has a specific tag (e.g., classification=confidential).

Answer

Bucket policies with Principal ARN

Answer

Object ACLs with canned ACLs

Answer

Pre-signed URLs with expiration time

Question 13

A cloud security architect is designing a key management strategy to meet regulatory requirements for key separation and tamper evidence. Which TWO of the following are benefits of using hardware security modules (HSMs) backing a cloud KMS? (Select TWO.)

Accepted Answer

Compliance with FIPS 140-2 Level 3 or higher. HSMs provide tamper-resistant hardware for key generation and storage, ensuring keys are protected against physical tampering. They also provide a root of trust for key management.

Answer

Eliminates the need for customer-managed keys

Answer

Reduced latency for encryption operations

Answer

Automatic key rotation without customer intervention

Question 14

A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)

Accepted Answer

Establishing a VPN for hybrid connectivity. TLS 1.2+, VPNs, and HTTPS are standard controls for encrypting data in transit. Data classification is a policy, not a technical control. Encryption at rest protects stored data, not in transit.

Answer

Setting data classification labels on the data

Answer

Encrypting data at rest using AES-256

Question 15

An organization is implementing a data loss prevention (DLP) solution to protect sensitive data in cloud storage. Which TWO of the following are capabilities of a cloud DLP service? (Select TWO.)

Accepted Answer

De-identification transforms such as masking and tokenization. Cloud DLP services can scan data for sensitive patterns (like credit card numbers) and apply de-identification transforms to redact or mask data. They do not manage encryption keys or automate backup.

Answer

Automatic encryption key rotation

Answer

Enforcing multi-factor authentication

Answer

Automated backup of sensitive data

Question 16

A financial services company stores customer transaction data in a cloud object storage bucket. The company requires that all data be encrypted at rest using keys that it generates and manages on-premises, with the cloud provider having no access to the keys. Which encryption approach should the company use?

Accepted Answer

Customer-supplied encryption keys (CSEK). CSEK (customer-supplied encryption keys) allows the customer to provide their own keys for encrypting cloud storage objects, and the cloud provider does not retain access to the keys. BYOK involves importing keys into the cloud KMS, which the provider can manage. CMEK uses keys created in the cloud KMS. Server-side encryption uses provider-managed keys.

Answer

Server-side encryption with AES-256

Answer

Bring your own key (BYOK)

Answer

Customer-managed encryption keys (CMEK)

Question 17

A healthcare organization is migrating electronic health records to the cloud and must comply with data residency requirements that mandate all patient data remain within the European Union. The cloud provider offers multiple regions globally. Which of the following is the most appropriate action to ensure compliance?

Accepted Answer

Select a cloud region located in the European Union for data storage.. Selecting a cloud region located within the EU (e.g., Frankfurt or London) physically stores data in that geography, satisfying data residency requirements. Object-level access controls manage permissions but do not affect data location. Data classification is a governance step but does not ensure residency. Cross-region replication would copy data outside the EU, violating compliance.

Answer

Enable cross-region replication to a secondary EU region.

Answer

Configure object-level access controls to restrict access to EU-based users only.

Answer

Apply data classification labels to all objects to indicate EU data.

Question 18

A company uses a cloud KMS to manage encryption keys for its cloud storage buckets. The security team wants to ensure that keys are rotated automatically every 90 days and that access to keys is restricted based on user roles. Which key management feature should they configure?

Accepted Answer

Key rotation policy and IAM-based key policies. Key rotation policies allow automatic generation of new key material on a schedule, and IAM-based key policies restrict access to keys based on roles. Key versions manage the history of rotated keys. Key deletion is a separate operation. Key import is for BYOK scenarios.

Answer

Key versioning and deletion policies

Answer

Key import and export policies

Answer

Key expiration and renewal policies

Question 19

A multinational corporation uses a cloud DLP service to scan data stored in cloud storage and BigQuery for personally identifiable information (PII). The DLP scan identifies credit card numbers in a dataset. According to the cloud data lifecycle, at which stage should the DLP scan ideally be performed to minimize exposure?

Accepted Answer

Create. DLP scanning should ideally occur during the Create stage, as data is being created or ingested, to prevent sensitive data from being stored without proper protections. Scanning at Store stage may allow data to persist. Scanning at Use or Share stages is reactive and may already have exposed data.

Answer

Store

Answer

Use

Answer

Share

Question 20

A security engineer needs to provide temporary access to a specific object in a cloud storage bucket for a third-party auditor, without granting them any other permissions. The access should expire automatically after 24 hours. Which method should the engineer use?

Accepted Answer

Create a pre-signed URL for the object with a 24-hour expiration.. Pre-signed URLs (signed URLs) grant time-limited access to a specific object without requiring the auditor to have AWS credentials. IAM roles would grant broader permissions. Bucket policies provide blanket access. Access keys would be long-lived and insecure.

Answer

Configure a bucket policy that allows access from the auditor's IP address.

Answer

Assign the auditor an IAM role with read-only access to the bucket.

Answer

Generate an access key pair for the auditor and attach a user policy.