CCSP Cloud Data Security Practice Question
A healthcare organization is storing protected health information (PHI) in a cloud object storage service. They want to ensure that if a storage bucket is accidentally made public, the data remains unreadable. Which combination of controls best addresses this risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable server-side encryption with AES-256 and block public access
Enabling object-level encryption with customer-managed keys (CMEK) and blocking public access at the bucket level ensures that even if the bucket is misconfigured, data is encrypted and inaccessible without the key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable server-side encryption with AES-256 and block public access
Why this is correct
Encryption at rest and blocking public access protect against data exposure even if the bucket is misconfigured.
- ✗
Apply data classification labels and enable DLP scanning
Why it's wrong here
Classification and DLP detect sensitive data but don't prevent exposure; they are detective controls.
- ✗
Enable bucket versioning and cross-region replication
Why it's wrong here
Versioning protects against deletion, not unauthorized access. Replication is for durability, not access control.
- ✗
Use pre-signed URLs and IAM policies
Why it's wrong here
Pre-signed URLs grant time-limited access but don't prevent data exposure if the bucket is public.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.