CCSP Cloud Data Security Practice Test 5 — 15 Questions

Question 1

An analyst receives the above error when trying to download a file from an S3 bucket. The bucket policy and user permissions appear correct. What is the most likely cause?

Accepted Answer

The user lacks permission to decrypt the object using the KMS key. When an S3 object is encrypted with a customer-managed KMS key (SSE-KMS), the s3:GetObject API call requires the user to have both s3:GetObject permission on the bucket policy and kms:Decrypt permission on the specific KMS key. Even if the bucket policy and user IAM permissions appear correct for S3 actions, the absence of the KMS decrypt grant will cause an access denied error. This is a common misconfiguration because the error message does not explicitly mention KMS, leading analysts to overlook the key permission.

Answer

The object is encrypted with SSE-S3, which requires additional grants

Answer

The bucket is configured to block all public access

Answer

The bucket policy denies all s3:GetObject actions

Question 2

A company is migrating sensitive customer data to a public cloud storage service. They want to ensure that even the cloud provider cannot access the plaintext data. Which encryption strategy should they implement?

Accepted Answer

Client-side encryption before uploading data. Client-side encryption ensures that data is encrypted before it leaves the customer's environment, so the cloud provider only ever receives ciphertext. This means the cloud provider cannot access the plaintext data, even if the storage service is compromised or the provider is legally compelled to disclose data. The encryption keys are managed and stored by the customer, not the cloud provider.

Answer

Server-side encryption with cloud-provider-managed keys

Answer

Tokenization of sensitive fields at the application layer

Answer

Enforcing role-based access control (RBAC) on the storage bucket

Question 3

An organization uses a cloud database service and needs to protect data at rest. They enable Transparent Data Encryption (TDE) with a customer-managed key stored in the cloud provider's key management service. Which additional control should they implement to ensure the key cannot be used by unauthorized personnel?

Accepted Answer

Implement key rotation with a short rotation interval. Option C is correct because implementing key rotation with a short interval ensures that even if a customer-managed key is compromised or accessed by unauthorized personnel, the window of exposure is minimized. TDE with a customer-managed key in a cloud KMS relies on the key's secrecy; frequent rotation invalidates older key material, reducing the risk of long-term unauthorized decryption of data at rest.

Answer

Enable SSL/TLS for all database connections

Answer

Enable audit logging on key management operations

Answer

Disable automatic key rotation and rely on manual rotation

Question 4

A financial institution uses a cloud-based data warehouse to store customer transaction records. They must comply with a regulation that requires deletion of data after 7 years. Which approach should they use to ensure data is irrecoverably destroyed?

Accepted Answer

Encrypt the data and then destroy the encryption keys (cryptographic erasure). Cryptographic erasure (Option B) is the correct approach because it renders the encrypted data irrecoverable by securely destroying the encryption keys, making the ciphertext permanently undecipherable. This method is recognized by standards like NIST SP 800-88 as an effective sanitization technique for data at rest, especially in cloud environments where physical access to storage media is unavailable. It ensures compliance with the 7-year deletion requirement without needing to overwrite or physically destroy the underlying cloud storage.

Answer

Overwrite the data with multiple patterns of zeros and ones

Answer

Tokenize the data and retain the token mapping

Answer

Delete the data using the cloud provider's API and remove pointers

Question 5

A cloud architect is designing a data classification scheme for a SaaS application. Data must be classified based on sensitivity and regulatory requirements. Which of the following is the PRIMARY reason to classify data?

Accepted Answer

To apply appropriate security controls based on data sensitivity. The primary reason to classify data in a cloud environment is to enable the application of appropriate security controls based on data sensitivity. Classification drives the selection of encryption standards, access control policies, and data loss prevention (DLP) rules, ensuring that sensitive data receives stronger protection while lower-sensitivity data is handled with less restrictive measures. Without classification, security controls would be applied uniformly, leading to either over-protection of trivial data or under-protection of critical data.

Answer

To reduce storage costs by identifying obsolete data

Answer

To comply with a specific data protection regulation

Answer

To improve data access speeds for high-priority data

Question 6

An organization uses a cloud-based DLP solution to monitor outbound traffic. They want to prevent the exfiltration of credit card numbers. Which detection technique is most appropriate for this requirement?

Accepted Answer

Regular expression matching for credit card number patterns. Regular expression matching (option D) is the most appropriate technique because credit card numbers follow well-defined, predictable patterns (e.g., 16 digits, specific starting digits for each issuer like 4 for Visa, 5 for MasterCard, and Luhn algorithm validation). This allows the DLP solution to detect credit card numbers in outbound traffic without requiring a pre-populated list or prior training, making it ideal for real-time monitoring of unknown or new card numbers.

Answer

Exact data matching against a list of known card numbers

Answer

Machine learning classification of sensitive data

Answer

Fingerprinting of known credit card documents

Question 7

A multi-national corporation uses a cloud storage service to store files that are subject to data residency requirements. Data must remain within a specific geographic region. Which of the following controls provides the STRONGEST assurance that data does not leave the region?

Accepted Answer

Using the cloud provider's data residency policy with region-restricted storage buckets. Option C is correct because using the cloud provider's data residency policy with region-restricted storage buckets enforces data at rest to be physically stored only in the specified geographic region. This is a technical control implemented at the infrastructure layer, ensuring that the cloud provider's storage service will not replicate or move data outside the designated region, providing the strongest assurance against data leaving the region.

Answer

Contractual clauses with the cloud provider

Answer

Implementing strict IAM policies to limit data access

Answer

Client-side encryption with keys managed on-premises

Question 8

A cloud security team is implementing a key management system for encrypting data in a multi-cloud environment. They need to ensure that keys are available even if one cloud provider experiences an outage. What is the BEST approach?

Accepted Answer

Implement a multi-cloud key management system that replicates keys across providers. Option A is correct because a multi-cloud key management system that replicates keys across providers ensures high availability and fault tolerance. If one cloud provider experiences an outage, the keys remain accessible from another provider, preventing data decryption failures. This approach aligns with the principle of avoiding a single point of failure in key distribution, which is critical for maintaining continuous data access in a multi-cloud architecture.

Answer

Use a single cloud provider's key management service

Answer

Store encryption keys in the same storage as encrypted data

Answer

Use hardware security modules (HSMs) in one data center

Question 9

A company uses a cloud-based database that contains personally identifiable information (PII). They need to allow developers to run queries against the database for testing purposes without exposing actual PII. Which technique should they use?

Accepted Answer

Apply dynamic data masking to the PII columns. Option C is correct because dynamic data masking (DDM) allows the database to return masked PII to developers in real time without altering the underlying stored data. This technique applies masking rules at query runtime, so developers can run functional tests against production-like data while sensitive values are obfuscated. It avoids the need for separate sanitized copies and preserves referential integrity for testing.

Answer

Encrypt the PII fields at rest

Answer

Grant developers direct access to a copy of the production data

Answer

Tokenize the PII fields with a one-way hash

Question 10

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Accepted Answer

The employee's credentials were stolen via a phishing attack. The correct answer is D because the scenario describes a classic credential theft attack: an employee's credentials are used from an anomalous geographic location to access sensitive cloud storage. Phishing is the most common vector for stealing credentials, as it tricks users into revealing their passwords, which are then reused by attackers to authenticate to cloud services like AWS S3 or Azure Blob Storage. The access logs showing a foreign IP address strongly indicate the credentials were compromised and used by an unauthorized party, not the employee.

Answer

The employee intentionally accessed the data from that country

Answer

A distributed denial-of-service (DDoS) attack overwhelmed access controls

Answer

The cloud storage bucket was misconfigured as public

Question 11

Which TWO of the following are valid data states that must be protected in cloud computing?

Accepted Answer

Data at rest. In cloud computing, data exists in three primary states: at rest (stored on disk or in memory), in transit (moving across networks), and in use (being processed). The CCSP exam specifically identifies 'data at rest' and 'data in transit' as the two fundamental data states that require protection through encryption, access controls, and integrity mechanisms. Option B is correct because data at rest refers to inactive data stored physically on any digital device, such as databases, backups, or archives, and must be safeguarded against unauthorized access or theft.

Answer

Data encryption

Answer

Data integrity

Answer

Data in database

Question 12

Which THREE of the following are key considerations when designing a key management lifecycle for cloud data encryption?

Accepted Answer

Key rotation. Key rotation is a critical lifecycle operation that limits the exposure of encrypted data if a key is compromised. By periodically replacing encryption keys with new ones, organizations reduce the window of vulnerability and comply with standards like NIST SP 800-57, which recommends cryptographic key rotation based on the key's usage period and security strength.

Answer

Key usage monitoring

Answer

Key escrow

Question 13

Which THREE of the following are effective data sanitization methods for cloud environments?

Accepted Answer

Degaussing magnetic media. Degaussing (A) is effective because it uses a strong magnetic field to completely randomize the magnetic domains on hard disk drives (HDDs), rendering all stored data unrecoverable even with advanced forensic tools. This method is approved for the highest security classifications (e.g., NSA/CSS Policy Manual 9-12) but physically destroys the media's ability to store data, making it suitable only for end-of-life disposal.

Answer

Truncating database tables

Answer

Formatting storage volumes

Question 14

The exhibit shows the versioning configuration for an S3 bucket. What effect does enabling MFADelete have on data protection?

Accepted Answer

It requires MFA to permanently delete an object version. Enabling MFADelete on an S3 bucket requires multi-factor authentication to permanently delete an object version or to suspend versioning on the bucket. This adds a critical layer of protection against accidental or malicious deletion of object versions, ensuring that even with administrative credentials, a second factor is needed to complete the destructive operation. It does not affect encryption, overwrite prevention, or all operations—only permanent deletion and versioning suspension.

Answer

It automatically encrypts all new object versions

Answer

It prevents any version of an object from being overwritten

Answer

It requires MFA for all operations on the bucket

Question 15

A cloud administrator applies the bucket policy shown in the exhibit to an S3 bucket. What is the expected outcome?

Accepted Answer

All objects uploaded must be encrypted using server-side encryption with S3-managed keys (SSE-S3). Option A is correct because the bucket policy explicitly denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which corresponds to SSE-S3. This ensures all objects uploaded to the bucket are encrypted at rest using server-side encryption with S3-managed keys, as the policy condition enforces the presence of that specific encryption header.

Answer

All upload requests will be denied unless they include encryption metadata

Answer

All objects must be encrypted with AWS KMS keys

Answer

All objects uploaded must be client-side encrypted before uploading

CCSP Cloud Data Security Practice Test 5 — 15 Questions

Exhibit

CCSP Cloud Data Security Practice Test 5 — 15 Questions

Exhibit