Data Security in Cloud CCSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial firm uses a cloud storage service for customer statements. The security team suspects that an employee is downloading large volumes of files to a personal device. Which control should be implemented FIRST to detect and stop the exfiltration?

   • AEnable versioning on the storage bucket
   • BRotate the storage account access keys immediately
   • CEnable server-side encryption on the storage bucket
   • DConfigure a data loss prevention policy that blocks downloads of sensitive files to unmanaged devices
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team needs to test an application that displays customer names and addresses. The test environment is shared with external contractors. The company wants to protect customer privacy while still allowing the team to verify the application's functionality. What should the team do?

   • AMask the customer names and addresses with realistic fake data before loading into the test environment.
   • BTokenize the customer names and addresses and store the tokens in the test database.
   • CUse the production database but restrict access to the contractors.
   • DEncrypt the customer names and addresses and give the contractors the decryption key.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of a data retention policy in the cloud?

   • ATo define how long data must be kept to meet legal and business requirements
   • BTo speed up data access
   • CTo encrypt data at rest
   • DTo reduce the number of users
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's cloud storage bucket contains critical data. The company wants to protect against accidental deletion and ransomware, but also needs to comply with a regulation that requires data to be permanently deleted after 5 years. Which configuration meets all requirements?

   • AEnable versioning and retention locks with a 5-year period
   • BDisable versioning and rely on the recycle bin
   • CUse a single backup stored in the same bucket
   • DEnable versioning and set a lifecycle rule to permanently delete objects after 5 years
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A financial services company uses a cloud KMS to encrypt data in a database. Auditors require that the company be able to permanently revoke access to encrypted data within minutes if a key is compromised. The current setup uses a single customer-managed key with automatic rotation every 90 days. What should the security team implement to meet the audit requirement?

   • AUse a key hierarchy with a customer-managed key encryption key and data encryption keys, and disable the key encryption key upon compromise.
   • BEnable automatic key rotation and rely on the cloud provider's key deletion process.
   • CRe-encrypt all data with a new key and delete the old key after 30 days.
   • DStore the encryption key in a hardware security module (HSM) and rotate it monthly.
   Reveal Solution Discussion Select an answer first