Scenario practice questions

A company is moving its customer database to a public cloud provider. The database contains personally identifiable information (PII) of European Union citizens. Which legal framework imposes requirements on the cloud customer regarding data protection and privacy in this scenario?

Trap 1: Sarbanes-Oxley Act (SOX)

SOX addresses financial reporting and corporate governance.

Trap 2: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA applies to protected health information in the US.

Trap 3: Payment Card Industry Data Security Standard (PCI DSS)

PCI DSS applies to payment card data, not general PII.

A
Sarbanes-Oxley Act (SOX)
Why wrong: SOX addresses financial reporting and corporate governance.
B
General Data Protection Regulation (GDPR)
GDPR governs processing of personal data of EU individuals.
C
Health Insurance Portability and Accountability Act (HIPAA)
Why wrong: HIPAA applies to protected health information in the US.
D
Payment Card Industry Data Security Standard (PCI DSS)
Why wrong: PCI DSS applies to payment card data, not general PII.

Question 2easymultiple choice

A company uses a cloud storage service to store sensitive customer data. They need to ensure that data is encrypted at rest using keys managed by the cloud provider. Which encryption model should they use?

Trap 1: Server-Side Encryption with AWS KMS (SSE-KMS)

SSE-KMS uses AWS KMS which is a managed service but the customer creates and manages the CMK.

Trap 2: Client-Side Encryption (CSE)

CSE is performed by the client, not the cloud provider.

Trap 3: Server-Side Encryption with Customer-Provided Keys (SSE-C)

SSE-C has the customer provide keys, not the cloud provider.

A
Server-Side Encryption with S3-Managed Keys (SSE-S3)
SSE-S3 uses cloud provider-managed keys.
B
Server-Side Encryption with AWS KMS (SSE-KMS)
Why wrong: SSE-KMS uses AWS KMS which is a managed service but the customer creates and manages the CMK.
C
Client-Side Encryption (CSE)
Why wrong: CSE is performed by the client, not the cloud provider.
D
Server-Side Encryption with Customer-Provided Keys (SSE-C)
Why wrong: SSE-C has the customer provide keys, not the cloud provider.

Question 3easymultiple choice

A cloud administrator is designing a backup strategy for a critical database. Which of the following is the BEST approach to ensure data recoverability in case of a regional outage?

Trap 1: Use tape backups stored in a physical safe in the same building.

Tape is outdated and still vulnerable to regional disaster if stored near the origin.

Trap 2: Perform only daily backups without replication.

Daily backups alone do not protect against regional outages.

Trap 3: Store backups in a different availability zone within the same…

Regional outage affects all zones, so cross-zone is insufficient.

A
Regularly copy backups to a different geographic region.
Cross-region replication ensures data survives a regional outage.
B
Use tape backups stored in a physical safe in the same building.
Why wrong: Tape is outdated and still vulnerable to regional disaster if stored near the origin.
C
Perform only daily backups without replication.
Why wrong: Daily backups alone do not protect against regional outages.
D
Store backups in a different availability zone within the same region.
Why wrong: Regional outage affects all zones, so cross-zone is insufficient.

Question 4mediummultiple choice

A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?

Trap 1: JWT

JWT is typically used for API authorization, but for SSO, SAML is the standard.

Trap 2: Kerberos ticket

Kerberos is a network authentication protocol, less common in cloud SSO scenarios.

Trap 3: OAuth access token

OAuth access tokens are for granting access, not directly validating identity.

A
SAML assertion
SAML assertions are used in SSO to convey user identity and attributes.
B
JWT
Why wrong: JWT is typically used for API authorization, but for SSO, SAML is the standard.
C
Kerberos ticket
Why wrong: Kerberos is a network authentication protocol, less common in cloud SSO scenarios.
D
OAuth access token
Why wrong: OAuth access tokens are for granting access, not directly validating identity.

Question 5easymultiple choice

A development team is working with production-like data in a non-production cloud environment. To comply with data privacy regulations, sensitive fields must be obscured without being retrievable. Which technique should they apply?

Trap 1: Format-preserving encryption

Encryption is reversible with the key.

Trap 2: Reversible masking

Reversible masking allows original data to be retrieved.

Trap 3: Tokenization

Tokenization is reversible via the token vault.

A
Format-preserving encryption
Why wrong: Encryption is reversible with the key.
B
Reversible masking
Why wrong: Reversible masking allows original data to be retrieved.
C
Irreversible masking
Irreversible masking prevents reconstruction.
D
Tokenization
Why wrong: Tokenization is reversible via the token vault.

Question 6hardmultiple choice

A cloud customer is subject to the EU General Data Protection Regulation (GDPR) and uses a cloud provider that subcontracts data processing to a third party without notification. Which GDPR requirement is violated?

Trap 1: Data protection by design

Data protection by design is a broader principle, not specific to subcontracting notification.

Trap 2: Data breach notification

Data breach notification applies to actual breaches, not subcontracting without notification.

Trap 3: Right to erasure

The right to erasure (right to be forgotten) is not directly related to subcontracting.

A
Data protection by design
Why wrong: Data protection by design is a broader principle, not specific to subcontracting notification.
B
Data breach notification
Why wrong: Data breach notification applies to actual breaches, not subcontracting without notification.
C
Sub-processor authorization
GDPR Article 28 requires explicit authorization for sub-processors.
D
Right to erasure
Why wrong: The right to erasure (right to be forgotten) is not directly related to subcontracting.

Question 7easymultiple choice

A US-based company uses a cloud provider with data centers in the US and Europe. To transfer personal data of EU citizens to the US, which mechanism is most appropriate under GDPR?

Trap 1: Explicit consent

Consent can be used but is not the most practical for routine data transfers.

Trap 2: Binding Corporate Rules (BCRs)

BCRs are for transfers within a corporate group, not for transfers to a third-party cloud provider.

Trap 3: Adequacy decision

The US does not have an adequacy decision under GDPR.

A
Explicit consent
Why wrong: Consent can be used but is not the most practical for routine data transfers.
B
Standard Contractual Clauses (SCCs)
Correct. SCCs are a recognized transfer mechanism for data transfers to third countries.
C
Binding Corporate Rules (BCRs)
Why wrong: BCRs are for transfers within a corporate group, not for transfers to a third-party cloud provider.
D
Adequacy decision
Why wrong: The US does not have an adequacy decision under GDPR.

Question 8hardmultiple choice

A cloud security analyst is investigating a potential data breach. They discover that an employee's credentials were used to access a cloud storage bucket containing sensitive files. The access logs show the employee accessed the bucket from an IP address in a different country during the time of the incident. Which of the following is the MOST likely attack vector?

Trap 1: The employee intentionally accessed the data from that country

Insider threat is possible but less likely without evidence.

Trap 2: A distributed denial-of-service (DDoS) attack overwhelmed access…

DDoS does not steal credentials.

Trap 3: The cloud storage bucket was misconfigured as public

Misconfiguration would not require stolen credentials.

A
The employee intentionally accessed the data from that country
Why wrong: Insider threat is possible but less likely without evidence.
B
A distributed denial-of-service (DDoS) attack overwhelmed access controls
Why wrong: DDoS does not steal credentials.
C
The cloud storage bucket was misconfigured as public
Why wrong: Misconfiguration would not require stolen credentials.
D
The employee's credentials were stolen via a phishing attack
Phishing could compromise credentials used from a foreign IP.