CCNA Cloud Data Security Questions

A pre-signed URL embeds temporary credentials in the link itself, granting time-limited access to one specific object without exposing bucket permissions or requiring the partner to hold Microsoft Entra ID credentials. The expiry parameter satisfies the automatic revocation constraint, while scoping to a single object meets the least-privilege requirement for external sharing.

De-identification transforms (tokenisation, masking, generalisation) remove or replace direct identifiers so stored records no longer expose customer identities, satisfying the requirement to protect sensitive data at rest. Unlike detection-only controls, they proactively reduce the data's sensitivity before exposure, limiting breach impact and supporting privacy compliance.

Crypto-shredding involves encrypting each user's data with a unique key and then deleting the key when deletion is requested. This renders the data irrecoverable, even in backups and replicas, because the ciphertext cannot be decrypted. It effectively achieves permanent deletion without having to locate and erase every copy. This is a robust method for complying with deletion requirements in distributed systems.

Generalization replaces specific values with broader categories, and suppression removes certain data fields. These techniques are core to anonymization frameworks like k-anonymity, making it difficult to re-identify individuals. They align with privacy regulations that require anonymization for data analysis.

Crypto-shredding renders data unrecoverable by deleting the encryption key. In a multi-tenant cloud object store, physical destruction of specific data is not feasible, but destroying the unique key makes the ciphertext useless. This meets the irretrievable destruction requirement without relying on provider media sanitization.

Customer-managed keys ensure that snapshots retain encryption tied to the organization's key policy, so a copied snapshot cannot be decrypted without access to those keys. This protects the session tokens even if the snapshot leaves the original region. Provider-managed keys may still protect the snapshot, but the organization has less control over access and revocation.

Server-side encryption with provider-managed keys automatically encrypts data at rest and the cloud provider handles all key management, including rotation and storage. This meets the requirement for encryption at rest with minimal operational overhead, as the startup does not need to manage any keys. It is the simplest and most appropriate choice for this scenario.

Differential privacy adds mathematical noise to data or query results, ensuring that the inclusion or exclusion of any single individual does not significantly affect the output. This preserves aggregate statistical properties while preventing re-identification. It is specifically designed for analytics scenarios where utility must be maintained. Unlike masking or tokenization, it provides a quantifiable privacy guarantee, making it the best fit for this requirement.

Cloud DLP scans storage repositories and uses pattern matching and checksums to detect credit card numbers, then applies classification labels automatically. This directly satisfies the requirement to identify and label sensitive data at scale, which manual tagging or generic encryption services cannot achieve.

Object lifecycle management policies allow administrators to define rules that automatically delete objects after a specified period. These policies are enforced by the cloud provider, and deletion is typically permanent and irreversible (unless versioning or soft delete is enabled). The provider logs lifecycle actions, providing verifiability. This meets the requirements for automatic, verifiable, and irreversible deletion.

Versioning retains prior copies of each object, so overwritten or encrypted current versions can be replaced by restoring an earlier, unencrypted version. This recovers the original data without paying a ransom or relying on provider intervention.

Cryptographic erase works by destroying the encryption keys, rendering the data unreadable. If keys are backed up or escrowed, the data can be recovered, violating the requirement. Therefore, ensuring key destruction and non-recoverability is paramount. This includes removing all copies of the key from backups, HSMs, and key management systems.

Client-side encryption means data is encrypted before it leaves the organisation, so the cloud provider never holds the plaintext or the keys. That gives maximum control over key management, unlike server-side options where the provider participates.

Volume-level encryption with a customer-managed key encrypts data at rest transparently to the application, so no application changes are needed. The organization controls the key lifecycle in the cloud KMS, and the provider can still take snapshots because encryption is handled at the storage layer. Performance impact is minimal since encryption is offloaded to the storage infrastructure.

Client-side encryption encrypts data before transmission, so plaintext never reaches the provider. Because the organisation generates and retains its own keys, the cloud provider performs no key management, satisfying the requirement for full customer control.

Effective classification requires the ability to identify sensitive data patterns. Prebuilt or customizable detectors for PII and PHI enable the solution to recognize formats like Social Security numbers, credit card numbers, and medical record identifiers. Machine learning models can improve accuracy by learning from context. Without these, the solution cannot accurately classify data, especially across diverse data types and languages.

Cryptographic erasure destroys the key material, making every encrypted copy—including provider replicas and backups—unreadable without needing to locate each copy. Because the firm controls the customer-managed key, it does not rely on provider deletion guarantees. This meets the 24-hour irrecoverability requirement even when physical copies persist, and is a recognized cloud data destruction technique.

Hold Your Own Key keeps key generation and storage inside the customer's on-premises HSM, so the cloud provider never gains access to plaintext keys. This directly satisfies the regulation's mandate that keys remain on-premises and inaccessible to the provider, unlike cloud-hosted alternatives where the provider retains custodial control.

A CASB with DLP can inspect data in transit, identify PII patterns, and enforce policies based on content and volume. It can block or alert on exports that exceed the defined threshold to external IPs, directly addressing the requirement. This is the most appropriate control because it operates at the data level and can be applied across cloud services.

Data residency policies enforced through the cloud provider's region lock feature allow the organization to restrict data storage and processing to a specific geographic region. This ensures that personal data remains within the EU, complying with GDPR's cross-border transfer restrictions. It is a direct control that prevents replication to other regions.

A pre-signed URL carries a cryptographic signature embedding its expiry timestamp. Once that time passes, the storage service validates the signature and rejects the request, returning an access denied error rather than serving the object.

Backups and DR sites often retain data separately, so deletions must be propagated to them. Without this, data could persist indefinitely. This control is critical to ensure that deletion requests are honored across all storage locations, including offsite replicas, meeting the regulatory requirement.

Keeping replication within the EU and disabling cross-region replication prevents customer data leaving the jurisdiction, satisfying GDPR and local data residency rules. Disaster recovery is still provided through same-region replication, so compliance is met without unlawful transfer.

Crypto-shredding makes data unrecoverable by destroying the unique encryption key, even if ciphertext remains in backups or replicas. This effectively satisfies the right to erasure because the data cannot be decrypted. It works across regions and immutable backups without needing to physically delete every copy.

A cloud KMS with automatic rotation and HSM-backed keys provides automated key rotation at defined intervals, stores keys in HSMs, and generates audit logs. This directly meets the requirements for automatic 90-day rotation, HSM storage, and auditability without manual effort.

Client-side encryption with keys held in an on-premises HSM ensures the cloud provider never has access to the plaintext or the keys. The firm retains exclusive control and can revoke access by simply not providing the key. This directly satisfies the requirement to prevent provider administrators from accessing plaintext data.

A cloud-native DLP service integrated with the storage API can inspect data in real time as it is accessed or moved, and can enforce policies to block exfiltration. It provides granular reporting and is designed for the cloud environment. This meets the requirements for real-time detection and prevention of sensitive data loss.

Because versioning preserved the pre-ransomware copies, the unencrypted objects still exist as prior versions. Deleting the current encrypted versions or promoting the previous versions restores data directly, avoiding full backup restoration and satisfying the efficient recovery requirement.

Server-side encryption with provider-managed keys automatically encrypts data at rest and handles key management, rotation, and storage. It requires no customer action and imposes minimal operational overhead. Since the logs are not highly sensitive and the requirement is simply encryption at rest, this option meets the compliance need without additional complexity. It is the default and most cost-effective approach for such scenarios.

Customer-managed encryption keys let the organisation retain sole control over key material and rotation schedules, while the cloud provider performs the actual cryptographic operations. This satisfies the stem's dual constraint: keys the healthcare organisation controls, without managing the encryption process itself.

A cloud-native DLP service can be configured to trigger on object creation events, inspect contents for PII, and take actions such as blocking or alerting. This provides near real-time detection and prevention. Integration with the storage service enables automatic scanning without manual intervention.

The Cloud DLP API inspects data at rest, using infoType detectors to identify PII such as names, emails and national identifiers, then applies de-identification transforms like pseudonymisation via crypto-based tokenisation or format-preserving encryption directly to matched columns.

Client-side encryption with keys held exclusively in an on-premises HSM ensures the cloud provider never possesses the key material, so provider administrators cannot decrypt the data. Issuing short-lived data keys allows immediate revocation for a compromised user without re-encrypting all objects, satisfying both requirements.

Automatic key rotation with version retention satisfies both constraints: it rotates the HSM-backed key on the 90-day schedule while preserving prior key versions, so data encrypted under earlier versions remains decryptable. Rotation alone would render old ciphertext unreadable without retained versions.

An IPsec VPN encrypts all traffic traversing the tunnel between on-premises gateways and cloud networks, covering every protocol rather than individual sessions. This satisfies the requirement that all data in transit be encrypted, since the tunnel provides blanket protection regardless of application.

HYOK retains key material within the customer's on-premises HSM, with cryptographic operations performed locally or via a proxy, so keys never leave the HSM. This satisfies the regulatory mandate while still permitting encryption of cloud data at rest.

HSMs validated to FIPS 140-2 Level 3 or higher provide physical tamper evidence and identity-based authentication, directly satisfying the stem's tamper-evidence requirement. Level 3's tamper-response mechanisms destroy keys on intrusion attempts, unlike software-based key stores. This certification also underpins key separation by enforcing cryptographic boundaries between tenants and roles within Microsoft Entra ID-integrated KMS deployments.

Restricted fits because the stem demands the highest sensitivity tier for severe damage plus regulatory penalties. Unlike Confidential, which covers unauthorised disclosure causing damage, Restricted is reserved for data whose compromise triggers legal sanctions, so it satisfies the classification scheme's top-level handling, encryption and access-control requirements.

IAM policies define who can access resources, and enabling logging (e.g., cloud audit logs) records access attempts. This combination ensures both access control and auditability, directly meeting the scenario's requirements. It is a fundamental cloud security practice.

A pre-signed URL embeds temporary credentials and an expiry directly into the link, granting read-only access to one specific object without creating an identity or sharing bucket keys. This satisfies the auditor's time-limited, single-file requirement, unlike broader role-based or bucket-level permissions.

A format-preserving token maintains the data format so existing applications and databases can process it without schema changes, while the token vault isolates the mapping to the original PAN. Strict access controls on the vault limit exposure and reduce PCI DSS scope because most systems handle only tokens. This design directly minimizes raw PAN propagation into logs and analytics.

Restricted is the highest classification tier, reserved for data whose disclosure causes severe harm, such as customer financial records. Assigning it satisfies the stem's requirement to enforce the strongest protection, exceeding Confidential or Internal levels used for policies and marketing material.

Versioning retains prior and deleted object states within the same bucket, letting you recover overwritten or removed objects without separate backups. It directly addresses both accidental deletion and unintended modification by preserving each object's earlier versions for restoration.

Client-side encryption ensures that data is encrypted before it reaches the cloud provider, and the company retains sole control of the keys. The provider only stores ciphertext and cannot access plaintext keys, satisfying the requirement for exclusive control and preventing provider access.

Client-side encryption encrypts data before it reaches the cloud, and storing keys in an on-premises HSM ensures the company retains exclusive control. The cloud provider only sees ciphertext and never has access to the plaintext or the keys. This satisfies both encryption at rest and sole key control requirements.