CCSP Practice Question: Which TWO of the following are effective…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using the same encryption key for all data to simplify key management.

  Why it's wrong here

  Reusing one key across all datasets means a single compromise exposes everything and prevents per-tenant or per-classification cryptoperiods, violating key-uniqueness principles. It tempts because centralised key management genuinely reduces operational overhead, and a single key would be defensible for one isolated dataset with no other data sharing its protection boundary.

• ✗

  Storing encryption keys in the same storage bucket as the encrypted data.

  Why it's wrong here

  Co-locating keys with ciphertext means anyone who obtains bucket read access also obtains the decryption material, so encryption provides no separation of duties. It tempts because keeping keys beside data simplifies retrieval and backup, and would suit a local keystore only where the bucket itself is never the compromise vector.

• ✗

  Consolidating all sensitive data into a single storage bucket for easier management.

  Why it's wrong here

  A single bucket creates one blast radius: any misconfigured bucket policy, ACL or credential leak exposes the entire sensitive estate at once. It tempts because consolidation genuinely simplifies inventory and lifecycle management, and would be right for non-sensitive, uniformly classified data needing one retention rule.

• ✓

  Data masking to obscure sensitive fields in non-production environments.

  Why this is correct

  Masking substitutes realistic but fictitious values for sensitive fields, so non-production environments retain usable data for testing while the actual confidential values never leave the protected production boundary, satisfying the requirement to protect sensitive data in public cloud.

• ✓

  Tokenization to replace sensitive data with non-sensitive placeholders.

  Why this is correct

  Tokenisation replaces sensitive values with non-sensitive surrogates mapped to a secured vault, so the public cloud stores only meaningless placeholders. Even if that environment is breached, the original data remains inaccessible without the separately held mapping.