CCSP Cloud Data Security — Timed 15 Questions

Question 1

A company is storing sensitive customer data in an S3 bucket. They need to ensure data is encrypted at rest and that the encryption keys are managed by the cloud provider. Which encryption strategy should they use?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3-Managed Keys). SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest using AES-256, with the encryption keys fully managed by AWS. This meets the requirement for the cloud provider to handle key management without any customer involvement in key generation, storage, or rotation.

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)

Question 2

An organization is migrating a legacy application to the cloud and must comply with PCI DSS. The application currently logs credit card numbers in plaintext. Which data security control should be implemented FIRST?

Accepted Answer

Perform data discovery and classification. Before any remediation can be applied, the organization must first perform data discovery and classification to locate where all credit card numbers (PANs) are stored, including logs, databases, and backups. PCI DSS Requirement 3.1 mandates that cardholder data be identified and classified before implementing controls like tokenization or encryption. Without discovery, subsequent controls may miss critical data stores, leaving plaintext PANs exposed.

Answer

Implement tokenization for credit card numbers

Answer

Deploy a data loss prevention (DLP) solution

Answer

Encrypt the database at rest

Question 3

A cloud security architect is designing a key management strategy for a multi-cloud environment. Which of the following is a BEST practice for key management?

Accepted Answer

Use a centralized key management system that integrates with all clouds. Option D is correct because a centralized key management system (KMS) that integrates with all cloud providers enables consistent key lifecycle management, reduces the risk of key sprawl, and ensures uniform access control policies across a multi-cloud environment. This approach aligns with the principle of separation of duties and allows for centralized auditing and rotation without vendor lock-in.

Answer

Use the same key for all data to simplify rotation

Answer

Store keys in each cloud provider's native KMS separately

Answer

Embed keys in application code for simplicity

Question 4

A company uses a cloud-based file storage service and wants to enable client-side encryption to prevent the cloud provider from accessing plaintext data. Which of the following MUST be implemented?

Accepted Answer

Envelope encryption with a master key stored on-premises. Client-side encryption requires that encryption keys are never accessible to the cloud provider. Envelope encryption with a master key stored on-premises ensures the data encryption key (DEK) is encrypted by a master key that remains under the customer's exclusive control, so the cloud service never has the plaintext key or data. This satisfies the requirement of preventing the provider from accessing plaintext data.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Transport Layer Security (TLS) for all uploads

Answer

Key management service (KMS) with auto-rotation

Question 5

A healthcare organization stores patient records in a cloud database. They need to ensure that database administrators cannot view sensitive columns like SSN and diagnosis. Which data masking technique should be applied?

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it allows the healthcare organization to mask sensitive columns (e.g., SSN, diagnosis) in real-time at the database query layer, based on user permissions. DDM does not alter the underlying stored data; it transforms the result set on-the-fly for unauthorized users (like DBAs), ensuring they see masked values while authorized personnel see the actual data. This meets the requirement of preventing database administrators from viewing sensitive columns without changing the data at rest.

Answer

Static data masking

Answer

Encryption at rest

Answer

Tokenization

Question 6

A company is deploying a cloud application that processes credit card transactions. Which standard must they comply with regarding data security?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the mandatory security standard for any organization that handles credit card transactions. It defines strict requirements for protecting cardholder data, including encryption, access control, and network segmentation. Since the application processes credit card transactions, compliance with PCI DSS is legally and contractually required.

Answer

GDPR

Answer

HIPAA

Answer

ISO 27001

Question 7

An organization uses a cloud storage service to share files with external partners. They want to ensure that the files are automatically deleted after 30 days. Which data lifecycle control should be implemented?

Accepted Answer

Lifecycle policy. A lifecycle policy is the correct data lifecycle control because it allows administrators to define rules that automatically expire and delete objects after a specified period, such as 30 days. This is a native feature of cloud storage services like Amazon S3, Azure Blob Storage, and Google Cloud Storage, enabling automated data retention and deletion without manual intervention.

Answer

Object lock

Answer

Versioning

Answer

Access control list

Question 8

A company uses a cloud key management service (KMS) and wants to ensure that keys can be used only within a specific geographic region. Which of the following should be configured?

Accepted Answer

Key policy with a condition for allowed regions. Option C is correct because a key policy with a condition using the `kms:CallerRegion` or `aws:RequestRegion` condition key can explicitly restrict the geographic region where the KMS key can be used. This ensures that any cryptographic operation (e.g., Encrypt, Decrypt) attempted from an unauthorized region is denied, enforcing regional data sovereignty requirements.

Answer

VPC endpoint for KMS

Answer

CloudTrail logging

Answer

Key rotation policy

Question 9

A cloud architect needs to protect data in transit between an on-premises data center and a cloud virtual private cloud (VPC). Which solution is MOST appropriate?

Accepted Answer

VPN with IPsec. An IPsec VPN is the most appropriate solution for protecting data in transit between an on-premises data center and a cloud VPC because it provides network-layer encryption and authentication for all IP traffic between the two sites. IPsec operates at Layer 3, securing the entire tunnel without requiring per-application configuration, and is designed specifically for site-to-site connectivity. This ensures confidentiality, integrity, and replay protection for all data traversing the public internet or a direct connect link.

Answer

SSL certificate on web server

Answer

TLS for each application

Answer

Direct Connect without encryption

Question 10

A company is designing a data retention policy for cloud storage. Regulatory requirements mandate that certain records be kept for 7 years and then securely destroyed. Which combination of controls should be used?

Accepted Answer

Lifecycle policy and secure deletion. A lifecycle policy automates the transition and expiration of objects, allowing you to set a rule to delete objects after 7 years. Secure deletion (e.g., overwriting or cryptographic erasure) ensures the data is irrecoverable, meeting the regulatory requirement for secure destruction. Together, they provide a fully automated, auditable process for retention and destruction.

Answer

Data masking and encryption

Answer

Versioning and MFA delete

Answer

Lifecycle policy and object lock

Question 11

Which TWO of the following are valid methods to protect data at rest in a cloud environment?

Accepted Answer

Client-side encryption. Client-side encryption (A) is a valid method to protect data at rest because the data is encrypted by the client before being transmitted to the cloud provider. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, which remain under the customer's control. It is a strong approach for maintaining data confidentiality and compliance with regulatory requirements.

Answer

Data loss prevention (DLP) policies

Answer

Tokenization

Answer

Transport Layer Security (TLS)

Question 12

Which THREE of the following are key components of a cloud data governance framework?

Accepted Answer

Data retention policies. Data retention policies are a key component of a cloud data governance framework because they define the lifecycle of data, specifying how long data must be kept and when it should be securely deleted. This ensures compliance with legal, regulatory, and business requirements, such as GDPR or HIPAA, and prevents unnecessary storage costs and security risks from outdated data.

Answer

Data masking

Answer

Data encryption at rest

Question 13

Which TWO of the following are benefits of using tokenization for credit card data?

Accepted Answer

Maintains data format for existing systems. Tokenization replaces sensitive credit card data with a non-sensitive token that retains the same format (e.g., a 16-digit number) and length, allowing existing systems, databases, and applications to process the token without modification. This format-preserving property ensures that legacy systems, such as payment gateways or CRM platforms, can continue to operate without requiring costly re-engineering. By using a token instead of the actual PAN, the organization reduces the scope of PCI DSS compliance because the tokenized data is not considered cardholder data under the PCI DSS standard.

Answer

Reversible without a key vault

Answer

Eliminates the need for encryption

Answer

Slows down database queries

Question 14

Which THREE of the following are essential steps in a cloud data discovery process?

Accepted Answer

Map data flows between systems. Option A is correct because mapping data flows between systems is a foundational step in cloud data discovery. It enables organizations to understand how data moves across cloud services, APIs, and storage tiers, which is critical for identifying where sensitive data may be transmitted or stored. Without this mapping, discovery efforts may miss data in transit or in transient storage, leading to incomplete visibility.

Answer

Encrypt all discovered data

Answer

Create backup copies of data

Question 15

An administrator applies the above bucket policy to an S3 bucket containing sensitive data. What is the EFFECT of this policy?

Accepted Answer

Denies access if the request does not use HTTPS. The bucket policy uses a `Deny` effect with a condition `aws:SecureTransport` set to `false`, which means any request that does not use HTTPS (i.e., plain HTTP) is denied. This enforces encryption in transit for all access to the S3 bucket, ensuring sensitive data is not transmitted over an unencrypted channel. Option C correctly identifies that the policy denies access if the request does not use HTTPS.

Answer

Allows public read access

Answer

Allows access only from specific IP addresses

Answer

Denies access if the request uses HTTPS