CCSP Cloud Data Security Practice Test 6 — 15 Questions

Question 1

An administrator notices the log entries in the exhibit from a cloud-hosted server. What is the MOST likely security concern indicated by these logs?

Accepted Answer

A brute-force attack succeeded in logging into the system, and a database password was exposed in the command line. The log entries show a successful SSH login followed by a MySQL command that includes the database password in plaintext on the command line (e.g., `mysql -u root -pPassword123`). This indicates a brute-force attack succeeded, and the password was exposed in the process list or shell history, which is a critical data security concern.

Answer

Data was exfiltrated from the MySQL database

Answer

The MySQL database was accessed by an unauthorized user

Answer

A failed SSH login attempt indicates a misconfigured firewall

Question 2

A company uses cloud storage for sensitive data and wants to ensure that the cloud provider cannot access their encryption keys. Which approach should they implement?

Accepted Answer

Cloud External Key Manager (EKM). Cloud External Key Manager (EKM) allows the customer to manage and store encryption keys outside the cloud provider's infrastructure, often in an on-premises HSM or a third-party key management system. This ensures the cloud provider never has access to the plaintext keys, meeting the requirement that the provider cannot access the encryption keys. EKM typically uses protocols like PKCS#11 or KMIP to allow the cloud service to perform cryptographic operations without exposing the keys to the provider.

Answer

Cloud KMS with software keys

Answer

Cloud KMS with hardware keys

Answer

Cloud HSM

Question 3

A financial services company is migrating a critical database to the cloud. The database contains columns with PII that must be encrypted. Performance is the highest priority, and the system must support queries on encrypted data. Which technique should be used?

Accepted Answer

Tokenization. Tokenization is correct because it replaces sensitive PII with non-sensitive tokens that retain the format and length of the original data, allowing queries to run on the tokens without exposing the actual values. This approach provides strong security while maintaining high performance, as the token mapping is stored separately and queries are executed against the tokenized data without decryption overhead.

Answer

Hashing

Answer

Application-level encryption

Answer

Transparent Data Encryption (TDE)

Question 4

Which TWO statements about data classification are correct?

Accepted Answer

Data classification can be based on context and content.. Option C is correct because data classification can be based on both context (e.g., source, creator, location) and content (e.g., keywords, patterns, data values). This dual approach allows organizations to apply classification rules that consider the environment and the actual data, enabling more accurate and granular protection. For example, a document containing a credit card number (content) created by the finance department (context) could be classified as 'Confidential'.

Answer

Data classification is performed once at creation.

Answer

Data classification must be automated to be effective.

Answer

Data classification is solely based on regulatory requirements.

Question 5

What does this bucket policy enforce?

Accepted Answer

The policy denies all uploads unless they use SSE-KMS.. The bucket policy uses a Condition block with `s3:x-amz-server-side-encryption` set to `aws:kms`, which means any upload must include the `x-amz-server-side-encryption` header with the value `aws:kms`. If the header is missing or set to any other value (e.g., `AES256` for SSE-S3), the request is denied. This enforces that all uploads use SSE-KMS, but does not require a specific KMS key unless a `kms:EncryptionContext` or `kms:KeyArn` condition is also present.

Answer

All objects must be encrypted with a specific KMS key.

Answer

Any object uploaded without encryption will be denied.

Answer

Only objects encrypted with SSE-S3 are allowed.

Question 6

A customer requires complete control over encryption keys used to protect data at rest in the cloud. Which cloud service model provides the most direct control?

Accepted Answer

Infrastructure as a Service (IaaS). Option A is correct. IaaS gives customers control over the entire infrastructure stack, including encryption key management. PaaS and SaaS abstract away much of that control, limiting customer-managed key options.

Answer

Anything as a Service (XaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 7

Which THREE statements about cryptographic key lifecycle management are correct?

Accepted Answer

Key usage should be logged and audited.. Option A is correct because auditing key usage is a fundamental requirement for accountability and compliance in cryptographic key management. Logging every key operation (e.g., generation, encryption, decryption, signing) allows detection of unauthorized use or policy violations, and is mandated by standards like NIST SP 800-57 Part 1, which states that audit logs must be protected and reviewed regularly.

Answer

Key backup must be encrypted and stored separately from the keys they protect.

Answer

Key rotation policies must ensure all data is re-encrypted with the new key immediately.

Question 8

A company uses a cloud-based file sharing service and wants to prevent sensitive data from being shared externally. Which cloud data security capability is most appropriate?

Accepted Answer

Scanning data at rest in cloud storage with DLP. Option C is correct because Data Loss Prevention (DLP) scanning of data at rest in cloud storage directly identifies and blocks sensitive content (e.g., PII, PCI-DSS data) stored in files before it can be shared externally. This capability is purpose-built for preventing unauthorized sharing by inspecting the actual content of files in the cloud repository, such as Amazon S3 or Azure Blob Storage, using pattern matching and fingerprinting.

Answer

Inspecting data in use within applications

Answer

Monitoring network traffic for data exfiltration

Answer

Encrypting data in transit

Question 9

Based on the CloudTrail log, why did the Decrypt call fail?

Accepted Answer

The key policy denied access.. The Decrypt call failed because the key policy attached to the AWS KMS CMK explicitly denied the IAM role or user making the request. CloudTrail logs show the error code 'AccessDenied' or 'UnauthorizedOperation', which indicates that the key policy did not grant the necessary kms:Decrypt permission to the principal. Even if the CMK is enabled and the ciphertext is valid, a restrictive key policy will block the operation.

Answer

The encryption algorithm mismatch.

Answer

The ciphertext was tampered.

Answer

The CMK was disabled.

Question 10

An organization stores archival data in cloud cold storage and requires each customer's data to be encrypted with unique keys managed by the customer. Which encryption approach meets this requirement?

Accepted Answer

Client-side encryption. Client-side encryption ensures that data is encrypted before it is sent to the cloud, and the customer retains sole control over the encryption keys. This approach meets the requirement for each customer's data to be encrypted with unique keys managed by the customer, as the cloud provider never has access to the keys or the unencrypted data.

Answer

Server-side encryption with customer-managed keys (SSE-KMS)

Answer

Server-side encryption with cloud-provider keys (SSE-S3)

Answer

Server-side encryption with customer-provided keys (SSE-C)

Question 11

Which TWO statements about data masking are correct?

Accepted Answer

Data masking replaces sensitive data with realistic fictional data.. Option D is correct because data masking replaces sensitive data (e.g., credit card numbers, SSNs) with realistic but fictitious data that preserves the original data's format and referential integrity, ensuring that the masked data remains usable for testing or analytics without exposing actual sensitive information. This is distinct from encryption, as masking does not use a key to transform data but rather substitutes it with a non-sensitive equivalent.

Answer

Data masking is a form of encryption.

Answer

Data masking is primarily used for production environments.

Answer

Data masking is reversible.

Question 12

An enterprise uses a Cloud Access Security Broker (CASB) to monitor cloud application usage. The CASB generates alerts about potential data loss prevention events. What is the primary purpose of the CASB's DLP capabilities?

Accepted Answer

To detect and prevent unauthorized sharing of sensitive data based on policies. The primary purpose of a CASB's DLP capabilities is to enforce policies that detect and prevent unauthorized sharing of sensitive data. This is achieved by inspecting content in transit (e.g., via API or proxy) and applying rules such as blocking, quarantining, or alerting on policy violations. Option C correctly captures this core function of policy-based detection and prevention, which goes beyond simple blocking or classification.

Answer

To block all uploads of sensitive data to cloud apps

Answer

To classify data automatically using machine learning

Answer

To encrypt data before it is sent to cloud apps

Question 13

What additional security benefit does the VPC endpoint provide?

Accepted Answer

It ensures data is not traversing the public internet.. A VPC endpoint (specifically an interface or gateway endpoint) allows instances within a VPC to privately connect to supported AWS services (like S3 or DynamoDB) without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect. The core security benefit is that all traffic between the VPC and the service stays entirely within the AWS network backbone and never traverses the public internet, eliminating exposure to internet-based threats.

Answer

It encrypts data in transit.

Answer

It provides an additional layer of authentication.

Answer

It enables cross-region replication.

Question 14

A company must ensure that cloud storage data is retained even if authorized users attempt to delete it, to comply with a legal hold. Which configuration is most effective?

Accepted Answer

Enable immutable storage (WORM) on the bucket. Immutable storage (WORM) on a bucket prevents any object from being deleted or overwritten for a specified retention period, even by authorized users or the root account. This directly enforces legal hold requirements by making data tamper-proof and deletion-proof at the storage layer, regardless of user permissions.

Answer

Implement data classification labels

Answer

Enable versioning on the storage bucket

Answer

Encrypt data with customer-managed keys

Question 15

A developer accidentally uploaded a file containing API credentials to a public cloud storage bucket. The cloud provider states they cannot guarantee deletion of the object. Which practice could have prevented this incident?

Accepted Answer

Data loss prevention for cloud storage. Data Loss Prevention (DLP) for cloud storage can automatically scan objects for sensitive content, such as API credentials, before or after upload. When configured with policies to block or quarantine files containing patterns like access keys, DLP prevents the data from ever being stored in a public bucket, eliminating the risk even if the provider cannot guarantee deletion. This proactive control addresses the root cause—sensitive data exposure—rather than relying on post-incident remediation.

Answer

Bucket versioning

Answer

Access control lists

Answer

Server-side encryption

CCSP Cloud Data Security Practice Test 6 — 15 Questions

Exhibit

CCSP Cloud Data Security Practice Test 6 — 15 Questions

Exhibit