Data Security in Cloud CCSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a fine-grained access control mechanism in cloud storage?

   • AEnabling versioning on the bucket
   • BEncrypting the bucket with AES-256
   • CBucket policies that grant read-only access to a specific user
   • DSetting up a load balancer for the bucket
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses a cloud KMS to encrypt data. A security audit requires that encryption keys be rotated every 30 days and that keys used to encrypt data that has been deleted be destroyed. The company also needs to retain the ability to decrypt archived data that may be older than the key rotation period. Which key management strategy satisfies all requirements?

   • AUse a customer-managed key and disable it after 30 days, then create a new key
   • BUse envelope encryption with a master key and data encryption keys; rotate the master key every 30 days and keep old master keys for decryption
   • CUse a single customer-managed key and rotate it every 30 days, re-encrypting all data with the new key
   • DUse a single service-managed key and rely on the provider to rotate it
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's RPO (recovery point objective) is 15 minutes and RTO (recovery time objective) is 1 hour for its critical database. The database is currently backed up once daily. The company wants to improve recovery capabilities without significantly increasing costs. Which strategy should be implemented?

   • AUse continuous database replication to a standby instance in another region and automate failover.
   • BTake a snapshot every hour and store it in a different region.
   • CUse daily backups and rely on the database's transaction log for point-in-time recovery.
   • DIncrease backup frequency to every 15 minutes and store backups in the same region.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary benefit of data tokenization compared to encryption?

   • ATokens are always shorter than the original data
   • BTokens can be used for analytics without any restrictions
   • CTokens eliminate the need for access controls
   • DTokens are not mathematically reversible without access to the token vault
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A cloud security engineer is designing a data classification scheme for a new cloud environment. Which of the following is the primary purpose of classifying data?

   • ATo encrypt all data regardless of its sensitivity level
   • BTo assign ownership of data to the cloud provider
   • CTo determine the appropriate security controls based on the data's sensitivity and criticality
   • DTo reduce storage costs by identifying duplicate data
   Reveal Solution Discussion Select an answer first