Certified Cloud Security Professional CCSP (CCSP) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option A is wrong because contractual clauses are legal agreements that rely on trust and enforcement after a breach; they do not provide technical enforcement and cannot prevent accidental or malicious data movement. Option B is wrong because IAM policies control who can access data, not where data is stored or replicated; they do not restrict the geographic location of data. Option D is wrong because client-side encryption protects data confidentiality but does not control the physical storage location; encrypted data can still be stored or replicated in any region the cloud provider supports.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because compliance mode locks objects immutably and prevents any user, including cloud administrators, from shortening the retention period or removing legal holds, which would hinder the ability to support immediate legal holds that may require adjustments. Option C is wrong because lifecycle policies only manage deletion based on age and do not provide immutability or legal hold capabilities, risking data modification or deletion before the 7-year retention period ends. Option D is wrong because client-managed keys and deletion timestamps do not enforce retention or prevent data deletion; they only track when data should be deleted, leaving the data vulnerable to accidental or malicious deletion.

Why this answer

How to eliminate wrong answers

Option B is wrong because relying solely on the provider's data residency feature does not address the risk of data being accessed from outside the EEA, which would violate GDPR's transfer restrictions without an appropriate safeguard mechanism. Option C is wrong because pseudonymization alone does not constitute an adequate safeguard under GDPR for international data transfers; it reduces identifiability but does not prevent the data from being subject to foreign legal access or processing outside the EEA. Option D is wrong because while encryption with on-premises key storage can reduce exposure, it does not eliminate the legal requirement for a valid transfer mechanism under GDPR (such as SCCs or Binding Corporate Rules) when the cloud provider operates globally and data may be accessed from outside the EEA.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because AWS Config rules are reactive and can only detect and remediate non-compliant objects after they are uploaded; they do not prevent the initial upload failure caused by the bucket policy, so the access denied errors would still occur. Option C is wrong because relying solely on S3 default encryption without a bucket policy does not enforce that all uploads use the custom KMS key; a user or script could still override the default encryption by explicitly specifying SSE-S3 or another key, leading to non-compliant objects. Option D is wrong because migrating to a new bucket with AWS DataSync is unnecessarily disruptive, does not address the root cause of the automation scripts not setting encryption headers, and would still require a similar policy and default encryption setup on the new bucket.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because updating a key alias does not change the underlying key material; it only reassigns a friendly name to the same key, so it does not achieve rotation. Option C is wrong because creating a new key and updating all applications to use it is a manual, error-prone process that defeats the purpose of automated rotation and can cause decryption failures if old data is not re-encrypted. Option D is wrong because a third-party HSM (Hardware Security Module) is used for generating and storing keys outside the cloud KMS, but it does not provide automatic key rotation; rotation would still need to be implemented separately.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because creating a new VPC does not resolve the underlying capacity shortage; the VPC is a logical network container, and the error is a physical resource constraint in the specific Availability Zone. Option C is wrong because waiting 24 hours is not a reliable or recommended practice; capacity may not become available within that timeframe, and AWS does not guarantee replenishment on a fixed schedule. Option D is wrong because increasing the instance size (e.g., from t2.micro to t2.medium) would likely require even more resources, exacerbating the capacity issue rather than solving it, and the error is about the specific instance type requested, not its size.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-S3 (AES-256) uses server-side encryption with Amazon S3-managed keys, which do not require any additional grants or KMS permissions; the error would not occur due to missing grants. Option B is wrong because if the bucket were configured to block all public access, the error would typically be a 403 Access Denied, but the scenario states the bucket policy and user permissions appear correct, implying the bucket is not blocking all access. Option C is wrong because if the bucket policy denied all s3:GetObject actions, the user would consistently fail to download any object, but the analyst would likely see a different error or the policy would be obviously incorrect; the question states the policy 'appears correct,' so a blanket deny is not the most likely cause.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because server-side encryption with cloud provider-managed keys (SSE-S3) means the cloud provider generates, manages, and stores the encryption keys, giving the provider potential access to the keys and violating the requirement for exclusive customer control. Option B is wrong because SSL/TLS encryption only protects data in transit between the client and the cloud service; it does not provide encryption at rest for the stored database, so it fails the core requirement. Option D is wrong because server-side encryption with customer-provided keys (SSE-C) still involves the cloud provider performing the encryption and decryption operations using keys supplied by the customer, meaning the provider has temporary access to the keys in memory during operations, which does not meet the requirement for exclusive customer control over the keys.

Why this answer

How to eliminate wrong answers

Option B is wrong because S3 bucket policies control access to S3 objects, not KMS encryption actions; KMS permissions are governed by key policies and IAM policies, not S3 bucket policies. Option C is wrong because KMS keys are regional resources, but a user can call KMS from any region as long as they specify the correct key ARN and have permissions; the error is not region-related. Option D is wrong because a disabled key would return a `DisabledException` or `KMSInvalidStateException`, not a generic access denied error.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because adding a Deny statement for the 10.0.0.0/16 range would block all traffic from the corporate network, including the security team's subnet (10.0.1.0/24), which is the opposite of the desired outcome. Option B is wrong because adding a Deny for IP addresses outside 10.0.1.0/24 is overly broad and would deny access from any IP not in that subnet, but the original policy already has an Allow for 10.0.0.0/16; a Deny for all other IPs would not fix the over-permissive Allow and could cause unintended conflicts in policy evaluation (Deny always overrides Allow). Option C is wrong because removing the Condition element would allow access from any IP address, which completely violates the security requirement to restrict access to the security team's subnet.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Resource Groups are used to organize and manage resources based on tags, but they do not enforce tagging policies or prevent untagged instances from being launched. Option B is wrong because CloudTrail is an auditing service that logs API calls; it can alert on missing tags after the fact but does not prevent the creation of untagged instances. Option D is wrong because AWS Config rules are detective and can trigger auto-remediation to tag instances after creation, but they do not enforce the policy at the time of launch, leaving a window where untagged instances exist and may be used.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option B is wrong because auto-scaling the application tier adds more compute instances, which increases the number of concurrent database connection requests and can worsen connection exhaustion, not fix it. Option C is wrong because read replicas only offload read queries, not the connection management overhead or write-related timeouts. Option D is wrong because increasing database instance size provides more memory/CPU but does not address the fundamental issue of connection churn or exhaustion; the database may still hit its max_connections limit.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because HTTPS (port 443) is typically required to be open to the internet for a public web server to serve encrypted traffic; restricting it to a specific IP range would break functionality for external users. Option C is wrong because outbound traffic (Rule 4) is necessary for the web server to fetch updates, resolve DNS, or communicate with backend services; removing it would likely break application functionality. Option D is wrong because RDP (port 3389) should never be allowed from anywhere (0.0.0.0/0) due to its high risk of brute-force attacks; the statement suggests allowing it, which worsens security posture.

Why this answer

How to eliminate wrong answers

Option A is wrong because a disk snapshot captures only persistent storage (the virtual disk), not volatile memory (RAM), so it cannot acquire evidence like running processes, kernel modules, or active network connections. Option B is wrong because network packet capture collects traffic traversing the network interface, not the contents of system memory; it cannot capture in-memory data such as process memory or cached credentials. Option D is wrong because running `dd if=/dev/mem` from within the VM requires root access and modifies the system state (e.g., writing to /tmp), which can overwrite evidence and trigger anti-forensic mechanisms; moreover, it may not be supported in all cloud VM configurations (e.g., paravirtualized kernels) and violates the principle of minimal interference in a production environment.

Why this answer

How to eliminate wrong answers

Option A is wrong because dedicated (single-tenant) hosts isolate VMs from other customers but do not prevent data remanence on the host's local storage after migration; residual files can still persist and be accessible to the same tenant's future VMs or during host reuse. Option C is wrong because the customer cannot perform a secure wipe of the original host after each migration; in a public IaaS model, the cloud provider controls the hypervisor and physical host, and customers lack the privileges or access to execute such operations. Option D is wrong because encrypted live migration protects data in transit during the VM move but does not address data at rest left behind on the source host's local storage; it prevents interception of the migration stream, not residual files.

Why this answer

How to eliminate wrong answers

Option A is wrong because using the same key for all data violates the cryptographic isolation principle; if that single key is compromised, all data is exposed, and rotation becomes a massive operational burden. Option B is wrong because storing keys separately in each cloud provider's native KMS creates fragmented key management, increases complexity for cross-cloud data sharing, and makes consistent policy enforcement nearly impossible. Option C is wrong because embedding keys in application code is a severe security violation; keys can be extracted from code repositories, logs, or decompiled binaries, directly contradicting the NIST SP 800-57 recommendation to never store keys in plaintext or in code.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing AWS access key and secret key in environment variables violates the principle of least privilege by introducing long-term, static credentials that must be managed, rotated, and could be exposed in logs or function output; AWS Lambda natively supports IAM roles for temporary credentials. Option B is wrong because using root user credentials grants unrestricted, full administrative access to the entire AWS account, which is a severe security risk and directly contradicts least privilege; root credentials should never be used for programmatic access. Option C is wrong because setting the S3 bucket policy to allow public read access makes the data accessible to anyone on the internet, bypassing authentication and authorization entirely, which is the opposite of least privilege and could lead to data exposure.

Why this answer

How to eliminate wrong answers

Option A is wrong because SSL/TLS protects data in transit between clients and the database, not data at rest or the key used for TDE; it does not prevent unauthorized use of the key stored in the KMS. Option B is wrong because audit logging on key management operations is a detective control that records unauthorized access attempts after they occur, but does not prevent the key from being used by unauthorized personnel. Option D is wrong because disabling automatic key rotation and relying on manual rotation increases the risk of human error and delays in key refresh, leaving the key vulnerable for longer periods and failing to ensure it cannot be used by unauthorized personnel.

Why this answer

How to eliminate wrong answers

Option B is wrong because setting Principal to "*" is not inherently insecure; AWS S3 bucket policies commonly use "*" to grant public access, and security is enforced through conditions like IP restrictions and SecureTransport requirements. Option C is wrong because the Deny statement applies when SecureTransport is false, but the Allow statement explicitly requires SecureTransport to be true; therefore, a request from IP 192.0.2.10 over HTTP would be denied by the Deny statement (since SecureTransport is false) and also would not satisfy the Allow condition. Option D is wrong because the Allow statement is restricted to the specific IP address 192.0.2.10; any other IP address attempting GetObject over HTTPS would not match the Allow condition and would be implicitly denied (or explicitly denied if another Deny statement exists).

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a VPN only encrypts traffic and provides a corporate IP address; it does not inspect API payloads for sensitive data, so DLP policies are not enforced on the content of API requests. Option C is wrong because blocking non-corporate devices via conditional access does not prevent the user from accessing data from a corporate device that is compromised or from using a different method to bypass DLP; it also does not address the core issue of API-level data exfiltration. Option D is wrong because tokenization replaces sensitive data with tokens, but if the user already has access to the original sensitive data via API calls, tokenization does not prevent them from retrieving the actual data; it is a data masking technique, not a DLP enforcement mechanism for API traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because SaaS delivers a fully managed application where the cloud provider controls the entire stack, including encryption key management, making it impossible for the customer to maintain sole control over keys. Option C is wrong because Hybrid Cloud is a deployment model (not a service model) that combines on-premises and cloud resources; it does not inherently grant sole control over encryption keys in the public cloud portion. Option D is wrong because PaaS abstracts the underlying infrastructure, and while it may offer some encryption options, the provider often retains access to the keys or manages them on behalf of the customer, violating the requirement for sole customer control.

Why this answer

How to eliminate wrong answers

Option A is wrong because relying solely on cloud-native KMS and encryption at rest does not protect data during processing (in memory or temporary storage), and the cloud provider may have access to the keys, violating key separation. Option C is wrong because storing keys in the cloud KMS still gives the provider potential access to the keys, failing key separation, and client-side encryption does not protect data during processing. Option D is wrong because tokenization replaces sensitive data with tokens but does not encrypt the data during processing; the original data must still be processed somewhere, and storing tokens in a separate cloud database does not address in-memory protection or key separation.

Why this answer

How to eliminate wrong answers

Option B is wrong because using a single cloud provider's key management service creates a single point of failure; if that provider experiences an outage, all keys become unavailable, blocking access to encrypted data. Option C is wrong because storing encryption keys in the same storage as encrypted data violates the fundamental security principle of separation of duties and key management best practices, as an attacker who compromises the storage can access both the ciphertext and the keys. Option D is wrong because using hardware security modules (HSMs) in one data center still presents a single point of failure; if that data center goes offline, keys are inaccessible, and this approach does not address multi-cloud availability requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Deny statement explicitly blocks any request that does not use HTTPS, regardless of the source IP, so access is not allowed from any IP even with HTTPS unless the IP is also in 10.0.0.0/24. Option C is wrong because the policy does not block access from the VPC; it allows access from the 10.0.0.0/24 IP range, which could include VPC resources, and there is no VPC-specific condition. Option D is wrong because the explicit Deny only applies to requests without HTTPS; requests with HTTPS from the allowed IP range are permitted, so not all access is denied.

Why this answer

How to eliminate wrong answers

Option B (Backup and restore) is wrong because restoring from backups typically takes hours, far exceeding the 15-minute RTO, and the RPO of 5 minutes cannot be guaranteed with periodic backups. Option C (Pilot light) is wrong because while it can achieve a low RTO, the RPO is often higher than 5 minutes due to the need to replicate data and start application servers, and the failover process introduces delay. Option D (Warm standby) is wrong because even though it has a reduced recovery time compared to pilot light, the RPO of 5 minutes is difficult to achieve consistently without active-active replication, and the failover still requires time to promote the standby environment.

Why this answer

How to eliminate wrong answers

Option A is wrong because using the cloud provider's default encryption keys violates the compliance requirement that encryption keys be managed by the customer (CMEK), and it does not allow the customer to control key lifecycle or rotation. Option C is wrong because disabling encryption for PHI at rest is a direct violation of compliance mandates (e.g., HIPAA) and security best practices; network segmentation alone does not protect data at rest. Option D is wrong because using a single customer-managed key for all databases creates a single point of failure and a large blast radius—if that key is compromised, all databases are exposed, and automatic rotation does not mitigate the risk of a key already being compromised.

Why this answer

How to eliminate wrong answers

Option B is wrong because HTTPS does encrypt the entire HTTP request, including the query string, during transit; the issue is not lack of encryption on the wire but exposure in logs and history. Option C is wrong because API keys are a valid authentication method and can be tied to a user session or application identity; the weakness here is not about session binding but about exposure in URLs. Option D is wrong because API keys are valid for use in query strings; they do not require a certificate, and certificates are used for TLS mutual authentication, not for API key transmission.

Why this answer

How to eliminate wrong answers

Option A is wrong because inspecting data in use within applications (e.g., via runtime application self-protection) focuses on protecting data while it is being processed in memory, not on preventing external sharing of stored files. Option B is wrong because monitoring network traffic for data exfiltration (e.g., via network DLP or IDS/IPS) detects data leaving the network after it has been shared, but does not prevent the initial sharing action at the storage layer. Option D is wrong because encrypting data in transit (e.g., TLS 1.3) protects data during transmission but does not prevent authorized users from sharing encrypted files externally or control access to the stored content.

Why this answer

Why this order

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because format-preserving encryption (FPE) is a reversible cryptographic technique that allows the original data to be recovered with the correct key, which violates the requirement that sensitive fields must be obscured without being retrievable. Option B is wrong because reversible masking, by definition, includes a method to restore the original data (e.g., via a lookup table or deterministic algorithm), which does not satisfy the 'not retrievable' condition. Option D is wrong because tokenization replaces sensitive data with a token that is mapped back to the original value in a secure vault, providing reversibility and thus failing the requirement for irreversible obscuration.

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling DLP on the API gateway is a detective control that would inspect outgoing data but does not stop the ongoing exfiltration using already compromised keys; it also requires time to configure and tune, leaving the attack active. Option C is wrong because restricting API access to specific IP addresses used by the mobile app's backend is ineffective if the attacker can spoof those IPs or if the mobile app communicates directly from user devices with dynamic IPs, and it does not address the compromised key issue. Option D is wrong because implementing ABAC policies to limit data access per API key is a preventive measure that should be applied after key rotation, but it does not revoke the already stolen keys, so the attacker can continue exfiltration until the keys are invalidated.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because continuing with cloud-provider-managed keys does not meet the compliance requirement for customer-managed keys (CMK) with automatic rotation, and additional logging does not address the encryption key ownership mandate. Option C is wrong because manual rotation of a CMK introduces operational overhead and risk of human error, and it does not satisfy the 'automatic rotation' requirement; it also does not inherently avoid downtime, as key rotation latency can still occur. Option D is wrong because implementing client-side encryption with a key stored in a secure vault and disabling server-side encryption would require significant application changes, increase complexity, and may not integrate seamlessly with managed services like Amazon RDS and S3, potentially causing more downtime risk than server-side CMK rotation.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because tokenization is a remediation step that cannot be correctly applied until the organization knows where all PANs reside; implementing it first risks missing data in logs or other unindexed locations. Option B is wrong because deploying a DLP solution without first discovering and classifying the data would result in poorly tuned policies that may fail to detect PANs in legacy log formats or generate excessive false positives. Option C is wrong because encrypting the database at rest does not address PANs stored in plaintext logs, application memory, or backup files, and PCI DSS requires protection of cardholder data wherever it exists, not just in the database.

Why this answer

How to eliminate wrong answers

Option A is wrong because data classification labels only tag data with metadata (e.g., sensitivity level) but do not enforce any retention or deletion prevention; they are a governance tool, not a technical control. Option C is wrong because versioning retains overwritten or deleted object versions but still allows deletion of the current version and does not prevent permanent deletion of all versions; it is not a legal hold mechanism. Option D is wrong because encryption with customer-managed keys protects data confidentiality but does not prevent deletion of the encrypted objects; the storage system can still delete the ciphertext and keys.

Why this answer

How to eliminate wrong answers

Option A is wrong because Reserved instances require a 1- or 3-year commitment and are designed for steady-state, predictable workloads, not a short 5-hour daily batch job, leading to wasted cost for unused hours. Option B is wrong because On-demand instances provide full pricing flexibility but are the most expensive option, making them suboptimal for a cost-optimized architecture when spot instances can handle the same workload at a fraction of the cost. Option D is wrong because Dedicated hosts are physical servers dedicated to a single tenant, used for compliance or licensing needs, and are the most expensive option, offering no cost benefit for a batch processing job that does not require physical isolation.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because public cloud deployments rely on multi-tenant architectures where multiple customers share the same physical infrastructure, with isolation achieved through logical controls such as hypervisor memory isolation, network ACLs, and tenant-specific encryption keys; this inherently provides lower isolation compared to a dedicated private cloud. Option B is wrong because hybrid cloud combines private and public cloud resources, and while the private portion offers high isolation, the public cloud component introduces multi-tenancy, reducing the overall isolation level across the deployment. Option D is wrong because community cloud is a multi-tenant model shared among several organizations with common concerns (e.g., regulatory compliance), and while it offers some isolation via policy-based segmentation, it does not achieve the dedicated, single-tenant isolation of a private cloud.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because misconfigured storage buckets expose data through incorrect access control policies (e.g., public read/write ACLs), which encryption does not prevent—encryption protects data at rest but does not enforce access controls. Option C is wrong because SQL injection is an application-layer attack that exploits improper input validation in the application code, and encryption of data at rest does not prevent injection or protect data while it is being processed in memory. Option D is wrong because side-channel attacks on shared physical hardware exploit timing, power consumption, or electromagnetic leaks to infer data; encryption keys managed by the customer do not prevent these physical-layer attacks, which target the compute or memory operations rather than the stored encrypted data.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because long-lived bearer tokens, such as static OAuth2 tokens, increase the risk of token theft and reuse; they lack the per-request cryptographic binding of mTLS and violate least privilege by providing persistent access without rotation. Option C is wrong because assigning IAM roles with broad permissions (e.g., wildcard actions or resources) grants excessive privileges, directly contradicting the principle of least privilege by allowing a service to access more than necessary. Option D is wrong because a shared API key across all services creates a single point of failure and common credential; if the key is compromised, all services are exposed, and there is no way to isolate or revoke access per service.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a site-to-site VPN extends the on-premises network into the cloud, which does not replicate segmentation and firewall rules but instead merges the networks, potentially breaking isolation and requiring additional routing and firewall policies. Option C is wrong because an IDPS monitors and alerts on malicious traffic but does not enforce network segmentation or firewall rules; it is a detection control, not a preventive control for segmentation. Option D is wrong because SD-WAN optimizes traffic routing and bandwidth across WAN links but does not provide network segmentation or firewall rule enforcement within the cloud environment.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because overwriting data with multiple patterns of zeros and ones (e.g., DoD 5220.22-M) is impractical in a cloud data warehouse where data is stored on distributed, shared, and often versioned storage systems; the cloud provider may retain snapshots, replicas, or previous versions that are not overwritten, leaving residual data recoverable. Option C is wrong because tokenization replaces sensitive data with tokens but retains the token mapping, which does not destroy the original data; the mapping can be reversed, and the original data remains stored elsewhere, failing to achieve irrecoverable deletion. Option D is wrong because deleting data via the cloud provider's API and removing pointers only removes logical references; the underlying data blocks remain on physical media and can be recovered through forensic techniques or provider-side snapshots, making it insufficient for compliance with irrecoverable destruction requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because encrypting the database connection (e.g., using TLS/SSL) protects data in transit from eavesdropping but does not prevent the execution of malicious SQL statements; the injection still occurs at the application layer. Option B is wrong because rate limiting on the login endpoint only mitigates brute-force or credential-stuffing attacks by restricting request frequency; it has no effect on the content of a single request that contains SQL injection payload. Option C is wrong because enforcing strong password policies (e.g., complexity, length) reduces the risk of credential compromise but does not address the vulnerability of unsanitized input in SQL queries; an attacker can still inject SQL without needing valid credentials.

Why this answer

How to eliminate wrong answers

Option A is wrong because principal ARNs in AWS IAM are case-sensitive but role names can contain uppercase letters; the ARN format uses the role name exactly as defined, so uppercase letters are valid and not the cause of failure. Option C is wrong because grant tokens are used with KMS grants, not key policies; the key policy here does not require a grant token, and the error is unrelated to grants. Option D is wrong because the action list includes 'kms:Decrypt' for the backup role (as shown in the policy snippet), so the missing action is not the issue.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because storing all customer data on-premises defeats the purpose of cloud migration and does not address the bank's need to use cloud services for customer data while remaining compliant. Option B is wrong because accepting the 90-day timeline and relying on a contractual liability shift does not absolve the bank from its regulatory obligation to delete data within 30 days; GDPR holds the data controller (the bank) ultimately responsible. Option D is wrong because negotiating an SLA for 30-day deletion on all data may not be feasible or enforceable for archived data due to technical constraints like tape-based storage or immutable snapshots, and the provider's standard process may still take 90 days for such data.

Why this answer

How to eliminate wrong answers

Option A is wrong because blocking all HTTPS traffic to the cloud storage application is an overly broad and disruptive measure that would break legitimate business use of the sanctioned application, and it does not address the root cause of the DLP policy not being enforced on encrypted traffic. Option C is wrong because logging only metadata for encrypted traffic would reduce visibility and prevent the CASB from inspecting the payload, making it impossible to enforce DLP policies on the content of the traffic. Option D is wrong because disabling HTTPS and forcing HTTP would expose the data in transit to interception and tampering, violating security best practices and potentially regulatory compliance requirements, and it does not leverage the existing SSL inspection capability of the CASB.