Cloud Data Security practice questions

Bucket ACLs

Why wrong: ACLs apply to all objects in the bucket and require cloud credentials.

Bucket policies with conditions

Why wrong: Bucket policies with conditions still require the requester to have credentials.

Identity-based policies

Why wrong: IAM policies grant access to users/roles with credentials, not time-limited anonymous access.

Cloud storage bucket policies with principal identification [wrong]

Why wrong: Resource-based policies with principal identifiers control access based on the identity of the requester, not on data classification tags.

Object storage ACLs with predefined permissions [wrong]

Why wrong: ACLs with predefined permissions grant access based on fixed roles or users, not dynamic classification tags.

Time-limited access URLs with expiration time [wrong]

Why wrong: Time-limited access URLs provide temporary access but do not consider data classification tags for enforcement.

Server-side encryption with AES-256

Why wrong: Server-side encryption with AES-256 uses keys managed by the cloud provider, so the provider has access to the keys. This does not meet the requirement of no provider access.

Server-side encryption with bring your own key (BYOK) to cloud KMS

Why wrong: BYOK involves importing your key into the cloud KMS. While the key originates from the customer, once imported, the cloud provider manages its lifecycle and may have access to it. This does not guarantee no provider access.

Server-side encryption with customer-managed keys (CMK) in cloud KMS

Why wrong: CMEK uses keys created and stored in the cloud provider's KMS, which the provider can access. This does not meet the requirement of no provider access.

Enable cross-region replication to a secondary EU region.

Why wrong: Replication may create copies in other regions, potentially violating data residency if the secondary region is outside the EU.

Configure object-level access controls to restrict access to EU-based users only.

Why wrong: Access controls do not control where data is stored; data could still reside outside the EU.

Apply data classification labels to all objects to indicate EU data.

Why wrong: Classification labels help manage data but do not enforce geographic storage location.

Key versioning and deletion policies

Why wrong: Key versioning tracks versions but does not automate rotation; deletion policies manage key removal.

Key import and export policies

Why wrong: Key import/export is for moving keys, not for rotation or access control.

Key expiration and renewal policies

Why wrong: Expiration is a one-time event; renewal may not be automatic.

Configure a bucket access policy that allows access from the auditor's IP address.

Why wrong: Incorrect. A bucket access policy based on IP address would grant access to all objects, not just the specific one, and would not automatically expire.

Assign the auditor a cloud role with read-only access to the bucket.

Why wrong: Incorrect. Assigning a role would grant permissions to the entire bucket or project, exceeding the minimal access needed.

Generate a long-term access key pair for the auditor and attach a user policy.

Why wrong: Incorrect. Generating long-term access keys would not automatically expire and would grant broader access if attached to a user policy.

Make the bucket public

Why wrong: This exposes all objects and is not secure.

Create a new cloud provider user account for the partner and attach a custom policy to the bucket

Why wrong: This grants broader access and does not expire automatically without additional management.

Use cross-region replication

Why wrong: Replication does not provide access control for sharing.

Cross-region replication

Why wrong: Replication is for durability, not access control.

Bucket versioning

Why wrong: Versioning is for data protection, not access control.

Object ACLs with public read access

Why wrong: Public access would allow anyone, not just authorized users.

Customer-managed encryption keys (CMEK)

Why wrong: CMEK uses keys created and managed by the customer in the cloud KMS, but the keys are still stored in the cloud.

Bring your own key (BYOK)

Why wrong: BYOK allows importing keys generated on-premises into the cloud KMS, but once imported, the cloud provider has access to the key material.

Cloud provider default encryption (SSE-S3)

Why wrong: The cloud provider manages the keys, which does not meet the requirement of keeping keys on-premises.

Apply data classification labels and enable DLP scanning

Why wrong: Classification and DLP detect sensitive data but don't prevent exposure; they are detective controls.

Enable bucket versioning and cross-region replication

Why wrong: Versioning protects against deletion, not unauthorized access. Replication is for durability, not access control.

Use pre-signed URLs and IAM policies

Why wrong: Pre-signed URLs grant time-limited access but don't prevent data exposure if the bucket is public.

Use cross-region replication to a non-EU region but apply client-side encryption before upload

Why wrong: Even with client-side encryption, the encrypted data leaving the EU may be considered a transfer of personal data, violating regulations.

Use cross-region replication to a US region and encrypt data with SSE-S3

Why wrong: Replicating data outside the EU violates data residency laws regardless of encryption.

Use cross-region replication to a non-EU region and rely on a Data Processing Agreement (DPA)

Why wrong: A DPA does not override data residency laws; data must physically remain in the EU.

Pseudonymization

Why wrong: Pseudonymization replaces identifiers with pseudonyms, but is usually not reversible without additional information.

Bucketing

Why wrong: Bucketing groups values into ranges (e.g., age groups) and is not reversible.

Masking

Why wrong: Masking partially obscures data (e.g., showing only last 4 digits) but is not reversible.

Cloud provider default encryption

Why wrong: Default encryption uses provider-managed keys; the customer cannot control rotation or policies.

Customer-supplied encryption keys (CSEK)

Why wrong: CSEK requires the customer to supply keys with each request; rotation is not automated via KMS.

Bring your own key (BYOK)

Why wrong: BYOK involves importing keys from on-premises; rotation is managed by the customer but not necessarily automated via cloud KMS.

Use client-side encryption but store the key in the cloud provider's key vault

Why wrong: Storing the key in the cloud provider's key vault gives the provider access to the key, violating the requirement.

Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data

Why wrong: Envelope encryption with a cloud KMS key still uses a key stored in the provider's KMS, which the provider can access.

Switch to server-side encryption with customer-managed keys and grant the analytics service access to the key management service (KMS)

Why wrong: Server-side encryption with customer-managed keys stores the key in the cloud KMS, which is operated by the provider, so the provider can access the key. This does not meet the requirement.

Public

Why wrong: Public data is intended for public disclosure and no damage.

Confidential

Why wrong: Confidential data requires protection; disclosure could cause moderate damage.

Internal

Why wrong: Internal data is for internal use only; disclosure may cause minor damage.

Use the cloud provider's backup service to restore the bucket

Why wrong: Backup services may use versioning; the direct method is to use versioning.

Replicate data from the cross-region replica

Why wrong: If replication was configured, the replica may also be encrypted unless versioning is enabled there too.

Use the cloud provider's ransomware recovery service

Why wrong: Such a service may not exist; versioning is the standard recovery method.

IPsec with 3DES

Why wrong: IPsec with 3DES is deprecated for protecting data in transit because 3DES uses a 56-bit effective key length, which is insufficient against modern brute-force attacks and fails the AES-128 minimum mandated by current security frameworks. It is tempting because IPsec itself remains a valid VPN protocol for site-to-site tunnels, and 3DES was historically a common symmetric cipher; however, the correct choice would require AES encryption instead.

TLS 1.0

Why wrong: TLS 1.0 is considered weak and should not be used.

SSL 3.0

Why wrong: SSL 3.0 is deprecated and insecure.

Overwrite the objects with random data multiple times before deletion

Why wrong: Overwriting is not guaranteed in cloud storage; providers use different mechanisms.

Enable MFA delete and then delete the objects

Why wrong: MFA delete adds protection against accidental deletion but does not ensure irretrievable destruction.

Delete the objects and then delete the bucket

Why wrong: Deleting the bucket might not permanently erase data; residual copies may exist.

Eliminates the need for customer-managed keys

Why wrong: HSMs still require customer management of keys.

Reduced latency for encryption operations

Why wrong: HSM operations may have higher latency compared to software-based KMS.

Automatic key rotation without customer intervention

Why wrong: Key rotation can be automated but is not an exclusive benefit of HSM-backed KMS.

Setting data classification labels on the data

Why wrong: Classification labels are metadata, not a control for data in transit.

Encrypting data at rest using AES-256

Why wrong: Encryption at rest protects stored data, not data in transit.