CCSP Cloud Data Security Practice Test 3 — 15 Questions

Question 1

Match each cloud incident response phase to its primary activity.

Question 2

A company uses a cloud storage service to store sensitive customer data. They need to ensure that data is encrypted at rest using keys managed by the cloud provider. Which encryption model should they use?

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). The requirement specifies that the cloud provider manages the encryption keys. SSE-S3 uses keys that are entirely managed by AWS (S3) for encrypting data at rest, with each object encrypted by a unique key that is itself encrypted by a regularly rotated master key. This aligns perfectly with the scenario where the customer does not want to manage keys.

Answer

Server-Side Encryption with AWS KMS (SSE-KMS)

Answer

Client-Side Encryption (CSE)

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 3

A cloud architect is designing a data loss prevention (DLP) solution for a SaaS application. The DLP must inspect data in transit between end users and the cloud as well as data at rest. Which combination of controls is most appropriate?

Accepted Answer

Deploy a cloud DLP service for content inspection and enforce encryption at rest.. Option B is correct because a cloud DLP service (e.g., AWS Macie, Microsoft Purview) can inspect data in transit by analyzing API calls or traffic patterns, and encryption at rest (e.g., AES-256) protects stored data. This combination directly addresses both inspection of data in transit and protection of data at rest, which is the core requirement of the question.

Answer

Use network segmentation and security groups.

Answer

Use encryption at rest and backup retention policies.

Answer

Implement a web application firewall (WAF) and a VPN.

Question 4

During a cloud migration, a company discovers that some sensitive data was inadvertently stored in an object storage bucket with public read access. The security team needs to determine the scope of exposure and remediate. What is the FIRST step they should take?

Accepted Answer

Review the bucket's access logs to identify any unauthorized access.. The first step is to review the bucket's access logs (e.g., AWS CloudTrail or S3 server access logs) to identify any unauthorized access. This determines the scope of exposure—who accessed the data, when, and from where—before taking any remediation action. Without this forensic step, the company cannot assess breach notification obligations or legal liability.

Answer

Notify the data protection authority.

Answer

Change the bucket's permission to private.

Answer

Immediately delete all objects in the bucket.

Question 5

A company is implementing a cloud key management system (KMS) to control encryption keys for sensitive data. Which practice is essential to ensure the security of the keys?

Accepted Answer

Periodically rotate the encryption keys.. Periodic key rotation is essential because it limits the amount of data encrypted under a single key, reducing the impact of a key compromise and complying with cryptographic best practices (e.g., NIST SP 800-57). In a cloud KMS, rotation can be automated using key versions, where old keys are retained for decryption while new keys are used for encryption, ensuring forward secrecy and operational security.

Answer

Use a single key for all encryption operations to simplify management.

Answer

Export keys to the cloud provider's hardware security module (HSM).

Answer

Store encryption keys in the same region as the encrypted data.

Question 6

An organization is adopting a cloud-based data warehouse and needs to ensure data masking is applied to personally identifiable information (PII) for analysts who should not see actual values. Which technique is most appropriate?

Accepted Answer

Dynamic data masking in the data warehouse.. Dynamic data masking (DDM) is the correct choice because it applies masking rules at query runtime directly within the data warehouse, allowing analysts to see obfuscated PII without altering the underlying stored data. This meets the requirement for on-the-fly masking for specific users while preserving the original values for authorized roles.

Answer

Static data masking on the source database.

Answer

Encrypt the PII columns and restrict the decryption key.

Answer

Tokenization of the PII fields.

Question 7

A cloud security auditor is assessing a company's data classification policy for their cloud environment. Which finding would be considered a critical deficiency?

Accepted Answer

The data classification scheme does not include labels for public, internal, confidential, and restricted.. Without data classification labels, it is impossible to enforce appropriate controls. Option A is critical. Other options are important but not as fundamental as missing labels.

Answer

The data classification policy is reviewed annually.

Answer

The policy does not specify retention periods for each classification.

Answer

Employees receive data classification training once during onboarding.

Question 8

A SaaS provider stores customer data in a multi-tenant database. A new regulation requires that data of former customers be completely erased within 30 days of account closure. Which process should the provider implement?

Accepted Answer

Encrypt each customer's data with a unique key and delete the key upon account closure.. Option D is correct because it implements cryptographic erasure, which renders the data permanently inaccessible by deleting the unique encryption key. This approach satisfies the regulation's requirement for complete erasure within 30 days without physically destroying hardware or risking data remnants, as the encrypted data becomes irrecoverable without the key. In a multi-tenant SaaS environment, this method is efficient, scalable, and avoids service disruption to other tenants sharing the same storage.

Answer

Physically destroy the hard drives containing the data.

Answer

Mark the data as deleted and exclude it from query results.

Answer

Overwrite the data with zeros using a secure delete tool.

Question 9

A cloud customer wants to ensure that their data is encrypted during transmission between their on-premises data center and the cloud provider's service. Which protocol should they use?

Accepted Answer

Transport Layer Security (TLS) 1.2. TLS 1.2 is the correct choice because it is specifically designed to secure data in transit over networks, such as between an on-premises data center and a cloud provider. It operates at the transport layer, providing encryption, authentication, and integrity for HTTP-based traffic (HTTPS), which is the most common method for cloud API interactions. IPSec, while also a valid encryption protocol, is typically used for site-to-site VPN tunnels at the network layer, not for securing individual service-to-service transmissions like those to a cloud provider's REST API.

Answer

Internet Protocol Security (IPSec)

Answer

Secure Shell (SSH)

Answer

Remote Desktop Protocol (RDP)

Question 10

A company's cloud storage bucket policy inadvertently allowed anonymous users to list and read objects. After discovering the exposure, the security team has corrected the policy. Which additional step is critical to prevent recurrence?

Accepted Answer

Implement automated policy validation as part of the infrastructure as code deployment process.. Option D is correct because implementing automated policy validation as part of the infrastructure as code (IaC) deployment process ensures that any bucket policy changes are automatically checked against security rules before they are applied. This prevents misconfigurations like allowing anonymous access from reaching production, addressing the root cause rather than just reacting after exposure. In cloud environments like AWS S3, tools such as AWS CloudFormation with cfn-nag or Terraform with Sentinel can enforce policies programmatically, eliminating human error in manual reviews.

Answer

Enable logging and monitoring to detect similar exposures.

Answer

Assign a dedicated security team to manually approve all policy changes.

Answer

Review all existing bucket policies and correct any other misconfigurations.

Question 11

Which TWO of the following are effective strategies for protecting sensitive data in a public cloud environment?

Accepted Answer

Data masking to obscure sensitive fields in non-production environments.. A (data masking) and B (tokenization) are both common techniques. C (storing encryption keys with data) is insecure. D (storing all data in one bucket) violates least privilege. E (using same key for all data) is poor practice.

Answer

Using the same encryption key for all data to simplify key management.

Answer

Storing encryption keys in the same storage bucket as the encrypted data.

Answer

Consolidating all sensitive data into a single storage bucket for easier management.

Question 12

Which THREE of the following are required components of a cloud data lifecycle policy?

Accepted Answer

Data deletion procedures. Data deletion procedures are a required component of a cloud data lifecycle policy because they define how data is securely and irreversibly removed at the end of its useful life. This includes methods such as cryptographic erasure, overwriting with patterns (e.g., NIST SP 800-88), or degaussing, ensuring compliance with legal and regulatory requirements. Without explicit deletion procedures, data may persist in cloud storage, leading to unauthorized access or retention violations.

Answer

Legal hold process

Answer

Data encryption algorithm selection

Question 13

Which TWO of the following are best practices for cloud key management?

Accepted Answer

Use separate keys for different tenants or applications.. A (rotate keys) and B (separate keys per tenant) are recommended. C (hard-code keys) is bad. D (store keys in same region) is not a security practice. E (use same key for all) is poor.

Answer

Hard-code encryption keys in application source code for simplicity.

Answer

Store keys in the same geographic region as the data for low latency.

Answer

Use a single master key for all encryption operations.

Question 14

The exhibit shows a bucket policy applied to a cloud storage bucket. After applying this policy, the security team notices that objects in the bucket are publicly accessible. Which additional condition should be added to restrict access to only authorized applications?

Accepted Answer

Add a condition that limits access to specific IP addresses or VPC endpoints.. Option A is correct because the bucket policy already grants public access via 'Principal': '*', so removing that principal or changing actions won't fix the underlying exposure. By adding a condition that restricts access to specific IP addresses or VPC endpoints, you ensure that only requests originating from authorized network sources can access the bucket, effectively overriding the broad principal wildcard.

Answer

Remove the 'Principal': '*' statement to make the bucket private.

Answer

Change the Action to s3:PutObject to limit exposure.

Answer

Add a condition to require Multi-Factor Authentication (MFA).

Question 15

The exhibit shows a key policy for a customer master key (CMK) in a cloud KMS. An administrator wants to prevent the AppRole from using the key to decrypt data. Which change to the policy would accomplish this?

Accepted Answer

Remove "kms:Decrypt" from the action list in the AppRole statement.. Option D is correct because the AppRole's current policy statement explicitly includes 'kms:Decrypt' in the action list, granting it permission to decrypt data. By removing 'kms:Decrypt' from that action list, the AppRole retains its other allowed actions (such as kms:Encrypt) but can no longer perform decryption operations. This is the most precise and least disruptive change, as it only removes the specific permission needed to prevent decryption without affecting other allowed actions.

Answer

Add a deny statement for AppRole with effect "Deny" for kms:Decrypt.

Answer

Remove the entire "Allow use of the key" statement.

Answer

Change the AppRole action list to include only kms:Encrypt.