Data Security in Cloud CCSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A software company needs to provide a development team with a copy of the production database for testing. The database contains personally identifiable information (PII). The development team needs to test functionality that depends on the format of the PII, such as email addresses and phone numbers, but they do not need to see the actual values. Which data protection technique should be used?

   • AMask the PII fields by replacing them with realistic but fake values
   • BRemove the PII fields from the database
   • CEncrypt the PII fields with a key that the development team has
   • DTokenize the PII fields and provide the token mapping to the development team
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company stores financial reports in a cloud storage bucket. The security team wants to ensure that only the finance team can read the files and that any access attempt is logged. Which configuration should be applied?

   • AMake the bucket public and rely on the storage service's access logs
   • BUse a shared access signature with a long expiry for all finance users
   • CSet the bucket to private and assign an IAM role to the finance group that grants read access
   • DEnable encryption on the bucket and provide the encryption key to the finance team
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company stores HR documents in a cloud storage bucket. The HR manager should have full access, HR assistants should have read-only access, and no other employees should have access. Which access control model should be used?

   • AMake the bucket public and rely on the HR application to restrict access
   • BCreate two IAM roles: one with read-write and one with read-only, and assign them to the respective groups
   • CUse a single IAM user with full access and share the credentials with HR staff
   • DUse a shared access key for all HR staff
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a tokenization system, where is the mapping between the original sensitive data and the token stored?

   • AIn the application's configuration file
   • BIn the token itself
   • CIn a secure token vault
   • DIn the cloud provider's public key infrastructure
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following encryption types is used to protect data while it is being processed in memory or during computation?

   • AEncryption in use
   • BHashing
   • CEncryption at rest
   • DEncryption in transit
   Reveal Solution Discussion Select an answer first