CCSP Cloud Data Security Practice Test 4 — 15 Questions

Question 1

The exhibit shows a bucket policy that grants public read access. What is the most effective way to remove this public access?

Accepted Answer

Enable S3 Block Public Access settings at the bucket or account level.. Option C is correct because S3 Block Public Access settings provide a definitive, override-capable mechanism to prevent any public access to an S3 bucket, regardless of other policies or ACLs. These settings can be applied at the bucket or account level and will block all public access even if a bucket policy explicitly grants it, making them the most effective and secure method to remove public access.

Answer

Add an access control list (ACL) that denies public access.

Answer

Change the bucket policy to deny all access.

Answer

Enable bucket versioning and delete the public objects.

Question 2

A company is migrating sensitive customer data to the cloud. They need to classify data according to the organization's data classification policy, which includes public, internal, confidential, and restricted categories. Which of the following is the MOST important step to ensure data classification is effective in the cloud?

Accepted Answer

Integrate classification labels with DLP and access control policies. Integrating classification labels with DLP and access control policies ensures that the classification scheme is enforced automatically, not just documented. This allows the cloud infrastructure to apply appropriate protections (e.g., blocking unauthorized access or preventing data exfiltration) based on the label, making classification actionable and effective in a dynamic cloud environment.

Answer

Assign a data custodian to manually tag data objects

Answer

Implement encryption for all data at rest and in transit

Answer

Store each classification level in separate cloud regions

Question 3

A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?

Accepted Answer

Use client-side encryption with keys stored in the consumer's on-premises HSM. Option A is correct because client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.

Answer

Use a TLS tunnel to the storage service

Answer

Enable server-side encryption with keys managed by the cloud provider

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 4

A company uses a hybrid cloud architecture with on-premises key management and cloud services. They need to ensure that encryption keys used for cloud data are never exposed to the cloud provider. Which key management approach best meets this requirement?

Accepted Answer

Use a BYOK solution with an on-premises HSM and key caching. Option C is correct because a Bring Your Own Key (BYOK) solution with an on-premises Hardware Security Module (HSM) allows the company to generate and store encryption keys locally, then securely transfer them to the cloud for use without exposing the raw key material to the cloud provider. Key caching ensures that the cloud service can perform operations without the provider ever having persistent access to the plaintext keys, meeting the requirement that keys are never exposed to the cloud provider.

Answer

Use the cloud provider's native key management service

Answer

Store keys in a cloud key vault with access logs

Answer

Deploy a cloud-based HSM and store keys only there

Question 5

A security team is implementing Data Loss Prevention (DLP) for a SaaS application that stores customer PII. They want to detect when sensitive data is shared externally via email. Which is the best approach?

Accepted Answer

Use the SaaS application's API DLP rules to scan email content and attachments. Option B is correct because content-based DLP scanning of email attachments is the standard way to detect sensitive data in transit. Option A is wrong because network DLP at the cloud perimeter cannot inspect encrypted email traffic. Option C is wrong because endpoint DLP on user devices is not effective for cloud email. Option D is wrong because database DLP is for structured data at rest, not email.

Answer

Implement database DLP to monitor queries to the PII database

Answer

Install endpoint DLP agents on all user devices

Answer

Deploy network DLP at the cloud provider's network perimeter

Question 6

After decommissioning a cloud database, a company is concerned about data remanence. They have overwritten all storage blocks with zeros. However, regulatory auditors require proof that the data is unrecoverable. What additional step should the company take?

Accepted Answer

Request a certificate of destruction from the cloud provider. Option C is correct because most cloud providers offer a certification of destruction that confirms data has been sanitized according to standards. Option A is wrong because physical destruction is not always possible in cloud. Option B is wrong because degaussing is for magnetic media, not cloud storage. Option D is wrong because the provider typically does not provide raw disk drives.

Answer

Physically destroy the storage media

Answer

Shred the hard drives

Answer

Degauss the drives

Question 7

A financial services company is migrating to the cloud and must retain transaction records for seven years for regulatory compliance. They plan to use object storage with lifecycle policies. What is the most secure configuration for long-term data retention?

Accepted Answer

Enable object lock with retention mode set to compliance. Option B is correct because Object Lock with compliance retention mode provides the strongest guarantee against data modification or deletion, even by root users. This mode ensures that once an object is written, it cannot be overwritten or deleted until the retention period expires, which is critical for meeting the seven-year regulatory retention requirement. Unlike other options, compliance mode enforces a legal hold that cannot be removed by any user, including cloud administrators, making it the most secure configuration for immutable long-term retention.

Answer

Configure a lifecycle policy to transition to archive storage after seven years

Answer

Store objects in write-once-read-many (WORM) storage class

Answer

Use server-side encryption with KMS key

Question 8

A cloud application processes credit card numbers. To reduce PCI DSS scope, the company wants to remove the original PAN from its databases and use a surrogate value that can be reversed only by a privileged application. Which data protection technique should they use?

Accepted Answer

Tokenization using a cloud-based token vault. Tokenization replaces the original PAN with a randomly generated surrogate value (token) that has no mathematical relationship to the original data. The token can be reversed only by a privileged application that has access to the token vault, which stores the mapping between tokens and actual PANs. This effectively removes the PAN from the application's databases, reducing PCI DSS scope because the tokenized data is not considered sensitive cardholder data.

Answer

Truncation of the first 6 and last 4 digits

Answer

Dynamic data masking in the application tier

Answer

Symmetric encryption with a key stored in the database

Question 9

A development team is working with production-like data in a non-production cloud environment. To comply with data privacy regulations, sensitive fields must be obscured without being retrievable. Which technique should they apply?

Accepted Answer

Irreversible masking. Irreversible masking (C) is correct because it transforms sensitive data into a non-reversible format, ensuring that the original values cannot be retrieved. This meets the requirement of obscuring production-like data in a non-production environment while complying with data privacy regulations that prohibit reversible transformations. Unlike encryption or tokenization, irreversible masking does not provide any decryption or mapping mechanism, making it suitable for scenarios where data must be permanently de-identified.

Answer

Format-preserving encryption

Answer

Reversible masking

Answer

Tokenization

Question 10

A company uses a Cloud Access Security Broker (CASB) to enforce security policies on SaaS applications. They want to ensure that data uploaded to a file-sharing service does not contain Social Security numbers (SSNs). Which CASB capability is most effective?

Accepted Answer

Inline DLP scanning. Inline DLP scanning is the most effective CASB capability for preventing data containing Social Security numbers from being uploaded to a file-sharing service because it inspects the content of files in real time as they are being uploaded. The CASB acts as a proxy, intercepting the HTTP/HTTPS traffic, parsing the file payload, and applying pattern-matching algorithms (e.g., regex for SSN format) to block the upload before it reaches the SaaS application. This proactive, real-time enforcement is essential for data loss prevention (DLP) at the point of upload.

Answer

Contextual access control

Answer

API-based data discovery

Answer

Encryption of data in transit

Question 11

Which TWO data states must be encrypted to meet common compliance requirements for data in the cloud? (Choose two.)

Accepted Answer

Data at rest. Data at rest (C) must be encrypted because compliance frameworks like PCI DSS, HIPAA, and GDPR require protection of stored data against unauthorized access. Encryption at rest typically uses AES-256 or similar algorithms to secure data on disks, databases, or object storage, ensuring that even if physical media is compromised, the data remains unreadable.

Answer

Data in audit logs

Answer

Data in backup

Answer

Data in use

Question 12

Which THREE controls help protect data in use within a cloud environment? (Choose three.)

Accepted Answer

Confidential computing. Confidential computing protects data in use by executing computations within a hardware-based Trusted Execution Environment (TEE), such as Intel SGX or AMD SEV, which isolates the data and code from the host operating system and hypervisor. This ensures that even privileged users or cloud administrators cannot access the plaintext data while it is being processed in memory.

Answer

Tokenization

Answer

Access control lists

Question 13

Which TWO data lifecycle stages are most critical for applying encryption controls in a cloud object storage service? (Choose two.)

Accepted Answer

Data in transit. At rest and in transit are the lifecycle stages where encryption is typically applied. In use is not fully supported by object storage. Creation and deletion are events, not states.

Answer

Data in use

Answer

Data deletion

Answer

Data creation

Question 14

An administrator configured the above key policy for a KMS key used to encrypt S3 backup data. The backup role 'BackupRole' is in the same account. However, when the backup service attempts to use the key to decrypt objects, the operation fails. What is the most likely cause?

Accepted Answer

The 'kms:ViaService' condition restricts calls to those originating from S3, but the backup service uses direct KMS API. The 'kms:ViaService' condition key restricts KMS API calls to those that originate from a specific AWS service, in this case S3. However, the backup service is likely making direct KMS API calls (e.g., Decrypt) rather than having S3 proxy the request, so the condition fails. The key policy explicitly denies access unless the call comes via S3, which is why decryption fails.

Answer

The principal ARN is incorrect because the role name contains uppercase letters

Answer

The key policy requires a grant token that is not being provided

Answer

The action list does not include 'kms:Decrypt' for S3

Question 15

An Azure application uses a key vault key for client-side encryption of data. The application also communicates with a cloud service over HTTPS. After deploying, the handshake failure occurs. Which of the following is the most likely cause?

Accepted Answer

The client and server do not have a common TLS version or cipher suite. The handshake failure occurs at the transport layer (TLS/SSL), which is independent of client-side encryption using a key vault key. The most likely cause is a mismatch in TLS versions or cipher suites between the client and server, as HTTPS relies on a successful TLS handshake. Options A, B, and D relate to the key vault key's availability or configuration, which would not cause a TLS handshake failure.

Answer

The application is using the wrong key version

Answer

The key vault key is not accessible due to network restrictions

Answer

The key vault key is not enabled for encryption

CCSP Cloud Data Security Practice Test 4 — 15 Questions

Exhibit

CCSP Cloud Data Security Practice Test 4 — 15 Questions

Exhibit