Encryption at Rest and in Transit CSE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A bank is migrating customer financial data to a public cloud. The compliance team states that encryption is required for data at rest and in transit. Which combination of controls should the bank implement?

   • AEncrypt storage volumes and databases at rest, and use TLS for all network communication
   • BEncrypt storage at rest but allow internal network traffic to be plaintext
   • CEncrypt only the database backups and use a VPN for administrative access
   • DUse TLS for all communication but leave storage unencrypted
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company stores files in a cloud file storage service (e.g., Azure Files). They want to encrypt the data at rest using keys that they manage, and they want the encryption to be transparent to the applications accessing the files. Which approach should they use?

   • AUse client-side encryption in each application that accesses the files.
   • BEncrypt the files manually before uploading and decrypt after downloading.
   • CEnable server-side encryption for the file share and configure the service to use a customer-managed key from the provider's KMS.
   • DUse a VPN to protect access to the file share.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A healthcare organization must ensure that data stored in a cloud object storage bucket is encrypted before it leaves the client application. They also want to retain control over the encryption keys and avoid sending plaintext data to the cloud provider. Which approach should they implement?

   • AServer-side encryption with a customer-managed key stored in the provider's KMS.
   • BUse TLS to encrypt the upload and rely on the provider's default encryption at rest.
   • CServer-side encryption with a provider-managed key.
   • DClient-side encryption: encrypt the data in the application using a customer-managed key before uploading it to the bucket.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which regulation commonly requires encryption of personal data?

   • AISO 27001
   • BGDPR
   • CCOBIT
   • DITIL
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A financial institution is required by regulation to maintain control over the encryption keys used to protect data stored in a public cloud. They want to use the cloud provider's encryption services but keep the keys under their own management. Which model should they adopt?

   • AUse server-side encryption with a provider-managed key and request a copy of the key for audit purposes.
   • BBring Your Own Key (BYOK) by importing a key generated in their on-premises HSM into the provider's KMS.
   • CUse client-side encryption with a key stored only in the application's configuration file.
   • DUse provider-managed keys and rely on the provider's compliance certifications.
   Reveal Solution Discussion Select an answer first