Customer vs. Cloud Provider Managed Keys CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is using a cloud storage service for archival data. They want to ensure that if they decide to terminate their relationship with the cloud provider, they can cryptographically render the data unreadable to the provider. They also want to maintain their own backup of the key material. Which approach should they use?

   • AUse provider-managed keys and trust the provider to delete data
   • BUse customer-managed keys and back up the key material externally
   • CUse customer-supplied keys and store them only in the application
   • DUse provider-managed keys and delete the data before termination
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In which scenario would customer-managed keys be most appropriate?

   • AA startup that wants to minimize operational overhead and has no specific compliance needs.
   • BAn organization with strict compliance requirements that mandate customer control over encryption keys.
   • CA company that wants to encrypt data at rest with minimal configuration.
   • DA team that needs to quickly enable encryption without managing key lifecycle.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare startup is migrating patient records to a cloud object storage service. Their compliance team requires that the organization be able to revoke the cloud provider's ability to decrypt data at rest at any time, and they want to retain the ability to rotate keys independently of the provider's schedule. Which key management approach should the startup choose?

   • AUse cloud provider-managed keys for all storage encryption
   • BUse customer-supplied keys that are never stored by the provider
   • CUse customer-managed keys stored in the provider's key management service
   • DUse provider-managed keys but enable automatic rotation
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A government contractor stores classified project files in a cloud object storage service. The contract requires that the contractor retain the ability to cryptographically erase the data if the contract is terminated. Which key management approach should the contractor use?

   • AProvider-managed keys with a short retention policy
   • BCustomer-managed keys stored in the provider's KMS with automatic rotation
   • CCustomer-managed keys that the contractor can disable or delete
   • DProvider-managed keys with automatic rotation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses a cloud database that supports encryption with customer-managed keys. The security team wants to ensure that the company can revoke access to the data immediately if a security incident occurs. Which action should the security team take?

   • ADisable the customer-managed key in the key management service
   • BDelete the database instance
   • CChange the database password
   • DRotate the customer-managed key to a new version
   Reveal Solution Discussion Select an answer first