CCSP Cloud Data Security Practice Test 2 — 15 Questions

Question 1

A developer receives the above error when trying to encrypt an object using a customer-managed KMS key. What is the MOST likely cause?

Accepted Answer

The KMS key policy does not grant encrypt permission to the user. The error indicates the user lacks permission to encrypt with the specified KMS key. Since the key is customer-managed, its key policy must explicitly grant the `kms:Encrypt` action to the user or role. Without this permission, AWS KMS denies the request, even if the user has other IAM permissions.

Answer

The S3 bucket policy denies KMS actions

Answer

The user is not in the same region as the key

Answer

The KMS key is disabled

Question 2

A DevOps engineer runs the above command and gets the error. What is the MOST likely missing permission?

Accepted Answer

storage.objects.list. The command likely involves listing objects within a bucket (e.g., `gsutil ls` or an equivalent `GET /b/{bucket}/o` API call). The error indicates the principal lacks the `storage.objects.list` permission, which is required to enumerate objects in a bucket. Without this permission, the API returns a 403 Forbidden error even if the principal has other storage permissions.

Answer

storage.buckets.get

Answer

storage.buckets.list

Answer

storage.objects.get

Question 3

A multinational financial services company uses a hybrid cloud environment with workloads in AWS and Azure. They recently acquired a smaller firm and must integrate their data while maintaining compliance with GDPR and PCI DSS. The acquired firm stores customer payment data in an on-premises Oracle database and wants to migrate it to the cloud. During the migration, they must ensure that the data is encrypted at all times—at rest, in transit, and during processing. The security team has implemented TLS for data in transit and plans to use cloud-native encryption for at-rest data. However, they are concerned about data being processed in memory or temporary storage. They also need to maintain key separation so that the cloud provider cannot access the encryption keys. The CISO wants to implement a solution that minimizes performance impact while meeting compliance requirements. Which of the following is the BEST course of action?

Accepted Answer

Implement a cloud-based HSM (Hardware Security Module) for key management and use confidential computing for processing.. Option B is correct because it addresses the requirement for data to be encrypted during processing (in memory) via confidential computing, which uses hardware-based trusted execution environments (TEEs) to protect data in use. A cloud-based HSM ensures key separation by keeping encryption keys under the customer's exclusive control, preventing the cloud provider from accessing them, and minimizes performance impact compared to software-based encryption.

Answer

Use the cloud provider's native KMS with automatic key rotation and rely on encryption at rest.

Answer

Encrypt data with client-side encryption before upload and store keys in the cloud KMS.

Answer

Use tokenization for all sensitive data and store tokens in a separate cloud database.

Question 4

A software-as-a-service (SaaS) provider hosts customer data in a multi-tenant cloud environment. Each customer's data is stored in separate databases but shares a common infrastructure. A customer reports that they can see another customer's data in their application dashboard. The development team investigates and finds no application-level bugs. The security team suspects the issue is related to cloud data isolation. The provider uses a public cloud database service with separate schemas per customer. The database service uses shared compute resources. The provider's compliance team is concerned about data leakage between tenants. Which of the following is the MOST effective way to ensure data isolation in this environment?

Accepted Answer

Implement row-level security (RLS) on the database tables to restrict access based on customer ID.. Row-level security (RLS) is the most effective because it enforces data isolation directly within the shared database engine, filtering rows based on the customer ID predicate. This prevents any cross-tenant data access even if the application layer is compromised or misconfigured, as the database itself evaluates the security policy on every query. Unlike encryption or auditing, RLS provides a deterministic access control mechanism that operates at the query execution level, ensuring that each tenant sees only their own data.

Answer

Use application-level encryption with different keys per customer.

Answer

Enable database auditing and monitor for anomalies.

Answer

Move each customer to a separate database instance.

Question 5

A healthcare organization stores patient records in a cloud-based object storage service. To comply with HIPAA, they must ensure that data is encrypted at rest and that encryption keys are managed by the organization itself. Which key management approach should they implement?

Accepted Answer

Implement a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud.. Option D is correct because HIPAA requires the organization to maintain control over encryption keys, and a Bring Your Own Key (BYOK) model with a hardware security module (HSM) in the cloud allows the healthcare organization to generate, store, and manage their own keys externally while using them for cloud-based encryption. This approach ensures that the cloud provider cannot access the keys, meeting the regulatory requirement for key management by the organization itself.

Answer

Use server-side encryption with S3-managed keys (SSE-S3).

Answer

Use server-side encryption with AWS KMS-managed keys (SSE-KMS).

Answer

Use client-side encryption with customer-supplied encryption keys (CSEKS).

Question 6

A multinational corporation uses a cloud CASB to enforce data loss prevention (DLP) policies across SaaS applications. The security team discovers that sensitive data is being exfiltrated via encrypted traffic that the CASB cannot inspect. What is the most effective design change to mitigate this risk?

Accepted Answer

Deploy a forward proxy with SSL/TLS interception capabilities.. Option C is correct because a forward proxy with SSL/TLS interception capabilities allows the CASB to decrypt, inspect, and re-encrypt traffic, enabling DLP policy enforcement on data in transit. This design change addresses the root cause—encrypted traffic bypassing inspection—without breaking application functionality or security.

Answer

Implement user training to prevent data exfiltration.

Answer

Block all encrypted traffic at the network perimeter.

Answer

Disable TLS/SSL encryption for all sensitive data transfers.

Question 7

A cloud architect is designing a data classification scheme for a financial services firm. The data includes public marketing materials, internal emails, customer account numbers, and credit card information. Which two data categories should be classified as 'restricted' under PCI DSS and other regulations?

Accepted Answer

Credit card information. Credit card information (Option B) is classified as 'restricted' because PCI DSS explicitly mandates strict controls for cardholder data, including primary account numbers (PANs), expiration dates, and CVV codes. This data requires encryption at rest and in transit, access controls, and regular security audits to comply with the Payment Card Industry Data Security Standard.

Answer

Public marketing materials

Answer

Internal emails

Question 8

A company uses a cloud key management service (KMS) with automatic key rotation enabled. Which TWO statements about key rotation are true?

Accepted Answer

New key material is generated, and the old key material is retained for decryption.. Option C is correct because cloud KMS services (e.g., AWS KMS, Azure Key Vault) implement automatic key rotation by generating new cryptographic key material while retaining the old key material. This allows data encrypted with the previous key version to still be decrypted, as the old key material is not destroyed but simply marked as retired for encryption operations.

Answer

The key ID changes after each rotation.

Answer

The old key is immediately destroyed after rotation.

Answer

All data encrypted with the old key must be re-encrypted.

Question 9

A security engineer applies the above bucket policy to an S3 bucket containing sensitive data. Which of the following best describes the effect of this policy?

Accepted Answer

It denies access to objects over HTTP, but allows HTTPS.. The bucket policy uses a `Deny` effect with a `Condition` block that checks `aws:SecureTransport` equals `false`. This condition denies access when the request is made over HTTP (non-secure transport), effectively blocking HTTP requests while allowing HTTPS requests. The policy does not affect HTTPS requests because the condition only triggers when `SecureTransport` is false.

Answer

It allows all access to the bucket.

Answer

It denies access to objects over HTTPS, but allows HTTP.

Answer

It denies all access to the bucket.

Question 10

A cloud security team is implementing tokenization for a payment system. Which THREE statements correctly describe tokenization characteristics?

Accepted Answer

The original sensitive data is stored in a secure token vault.. Option B is correct because tokenization replaces sensitive data (e.g., credit card numbers) with a token, and the original data is stored securely in a token vault. This vault is isolated and access-controlled, ensuring that only authorized systems can detokenize the data when needed. The vault is the authoritative source for mapping tokens back to original values, which is fundamental to tokenization's security model.

Answer

Tokenization uses encryption algorithms to protect data.

Answer

Tokenization is reversible using the token alone.

Question 11

A large e-commerce company uses a multi-cloud environment with workloads in AWS and Azure. They store customer payment data in an AWS S3 bucket and use Azure SQL Database for transactional data. The company requires that all data at rest be encrypted using keys managed by their on-premises HSM. They have implemented AWS KMS with custom key store (CloudHSM) for S3, and Azure SQL TDE with Azure Key Vault (using BYOK) for the database. Recently, the security team noticed that some S3 objects are not encrypted with the expected key, and there are intermittent access failures to the Azure SQL database. Investigation reveals that the AWS KMS key ID changed after a recent security incident, and the Azure Key Vault key has been disabled due to a misconfigured access policy. What is the most effective course of action to restore encryption compliance and service availability?

Accepted Answer

Re-establish synchronization between on-premises HSM and cloud key stores: update AWS KMS custom key store with correct key and fix Azure Key Vault access policies.. Option A is correct because the root cause is a loss of synchronization between the on-premises HSM and the cloud key stores. Updating the AWS KMS custom key store (CloudHSM) with the correct key restores S3 encryption compliance, while fixing the Azure Key Vault access policy re-enables the BYOK key for SQL TDE, restoring service availability. This directly addresses the specific failures: the changed KMS key ID and the disabled Key Vault key.

Answer

Implement client-side encryption for all data, bypassing cloud KMS.

Answer

Switch S3 to use SSE-S3 and Azure SQL to use service-managed keys.

Answer

Roll back all encryption to use cloud-provided managed keys to simplify operations.

Question 12

A financial services company is migrating sensitive customer data to a cloud environment. The compliance team requires that all data at rest be encrypted using a key managed by the organization, not the cloud provider. Which solution should the company implement?

Accepted Answer

Client-side encryption using a customer-managed key. Option C is correct because client-side encryption ensures that data is encrypted before it leaves the organization's control, and the customer retains sole possession of the encryption key. This satisfies the compliance requirement that the cloud provider never has access to the key, as the provider only stores the encrypted ciphertext. In contrast, server-side encryption options (like SSE-S3) involve the provider managing or having access to the key material.

Answer

Enforce TLS 1.2 for all data transfers

Answer

Implement tokenization for all sensitive fields

Answer

Server-side encryption with AWS S3 managed keys (SSE-S3)

Question 13

A cloud security architect is designing a data loss prevention (DLP) strategy for a multi-cloud environment. Which TWO actions are effective in preventing unauthorized exfiltration of sensitive data?

Accepted Answer

Implement strict Identity and Access Management (IAM) policies with least privilege. Option D is correct because implementing strict IAM policies with least privilege ensures that users and services have only the minimum permissions necessary to perform their functions. This directly limits the attack surface and prevents unauthorized access to sensitive data, which is a foundational control against exfiltration. Without least privilege, even with other controls in place, an over-privileged account could be exploited to move or copy data out of the environment.

Answer

Enable detailed logging and monitoring of all data access events

Answer

Encrypt all data at rest using provider-managed keys

Answer

Use a cloud access security broker (CASB) to enforce data classification

Question 14

A cloud security engineer reviews the S3 bucket policy shown in the exhibit. What is the net effect of this policy when a request originates from IP address 203.0.113.10 over HTTPS?

Accepted Answer

Deny access because the request is from the specified IP range. The S3 bucket policy includes a Deny statement that blocks all requests from the IP range 203.0.113.0/24, which includes 203.0.113.10. The SecureTransport condition is only applied to the Allow statement, not the Deny, so HTTPS is irrelevant to the Deny effect. Since the request matches the IP address in the Deny statement, it is denied regardless of protocol.

Answer

Deny access because the request does not meet the SecureTransport condition

Answer

Allow access because the condition for Deny does not include SecureTransport

Answer

Allow access because the request uses HTTPS

Question 15

Drag and drop the steps for managing identity and access in a multi-cloud environment using a centralized identity provider (IdP) into the correct order.

CCSP Cloud Data Security Practice Test 2 — 15 Questions

Exhibit

CCSP Cloud Data Security Practice Test 2 — 15 Questions

Exhibit