Customer vs. Cloud Provider Managed Keys CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the defining characteristic of cloud provider-managed keys?

   • AThe customer manages the key lifecycle but the provider uses the key for encryption.
   • BThe provider gives the customer the key to store on-premises.
   • CThe cloud provider creates, stores, and manages the encryption keys on behalf of the customer.
   • DThe customer creates the keys but the provider stores them.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In cloud encryption, what is the role of cloud provider-managed keys?

   • ATo ensure that the provider cannot access the encrypted data.
   • BTo simplify encryption management by having the provider handle key operations.
   • CTo allow the customer to use their own hardware security module (HSM) for key storage.
   • DTo give the customer full control over key access and rotation.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A company uses a cloud database with customer-managed keys. The security team wants to implement a policy that requires two administrators to approve any key deletion. Which configuration should be used?

   • AUse provider-managed keys to avoid the need for approval workflows
   • BUse a multi-party approval workflow in the key management service
   • CUse customer-managed keys with automatic rotation
   • DUse a single IAM role with permission to delete keys
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A company uses a cloud storage service with customer-managed keys. The security team wants to implement a separation-of-duties policy where the administrator who manages the keys is different from the administrator who manages the storage buckets. Which configuration should be used?

   • AUse separate IAM roles for key management and bucket management
   • BUse customer-managed keys with a single administrator who has both permissions
   • CUse the same IAM role for both key and bucket management
   • DUse provider-managed keys to avoid the need for separation of duties
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When using customer-managed keys, which responsibility falls on the customer?

   • AManaging the key lifecycle, including rotation and deletion.
   • BProviding the encryption algorithm used to protect the data.
   • CEnsuring the key is stored in a tamper-proof hardware module.
   • DGranting the provider access to the key for decryption.
   Reveal Solution Discussion Select an answer first