CCSP Cloud Data Security Practice Question
A cloud security team is implementing data loss prevention (DLP) for sensitive data in a cloud data warehouse. They need to detect and classify Social Security numbers (SSNs) stored in tables. Which cloud service capability is most appropriate for this task?
⚠ Common exam trap
CCSP often tests whether candidates confuse access control with data classification — the trap is picking IAM or bucket policies because they sound like 'security controls,' when the question specifically asks about detecting and classifying sensitive content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud DLP API
Cloud DLP API is purpose-built to discover, classify, and de-identify sensitive data such as SSNs, credit card numbers, and PHI across storage and data warehouses using built-in and custom infoType detectors. It can scan BigQuery tables, Cloud Storage, and Datastore directly, making it the correct tool for detecting and classifying SSNs in a cloud data warehouse. The other options are access-control or key-management services that do not perform content inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Object storage bucket policies
Why it's wrong here
Bucket policies authorise or deny access to objects; they cannot scan table contents or match SSN patterns, so no classification occurs. They are tempting because they enforce data protection at rest in object storage, which would be the right control when restricting who may read a bucket, not detecting sensitive values inside a warehouse.
- ✓
Cloud DLP API
Why this is correct
Cloud DLP API inspects and classifies data at rest, using built-in infoType detectors to identify SSN patterns within warehouse tables, satisfying the requirement to detect and classify stored sensitive data. Unlike encryption or access controls, it performs content-level discovery, matching the stem's classification constraint directly.
- ✗
Key management service
Why it's wrong here
A key management service stores and rotates encryption keys; it never inspects table rows, so it cannot detect or classify SSNs. It is tempting because it protects warehouse data at rest, and would be correct when the requirement is to manage customer-managed keys for encryption rather than discover sensitive content.
- ✗
Identity and access management (IAM)
Why it's wrong here
IAM governs who may query or administer the warehouse; it grants or denies access but does not scan column values for SSN patterns, so no classification happens. It is tempting because least-privilege access is a core DLP control, and would be correct when the requirement is restricting identities rather than discovering sensitive data.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.