Encryption at Rest and in Transit CSE Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   How is encryption typically applied to cloud object storage, such as Amazon S3?

   • ABy encrypting each object before it is stored
   • BBy using a single key for all objects without any management
   • CBy encrypting data only when it is accessed
   • DBy encrypting the entire storage device only
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security team is designing a key management strategy for a multi-cloud environment. They need to ensure that keys are available across different cloud providers and that key rotation is coordinated. Which approach should they use?

   • AUse a centralized key management system that supports multiple cloud providers and provides a unified API for key creation, rotation, and destruction.
   • BUse each cloud provider's native KMS independently and manually synchronize keys.
   • CUse client-side encryption with keys embedded in each application.
   • DStore keys in a shared cloud storage bucket and use the same key for all providers.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A company stores sensitive documents in a cloud object storage bucket. The security team wants to encrypt the data with a customer-managed key that can be rotated without re-encrypting the stored objects. Which approach should they use?

   • AUse envelope encryption: generate a unique data encryption key (DEK) for each object, encrypt the object with the DEK, and encrypt the DEK with a key encryption key (KEK) stored in the provider's key management service.
   • BUse asymmetric encryption: encrypt each object with the provider's public key and store the private key in the customer's on-premises hardware security module.
   • CEncrypt each object with a single shared symmetric key and store that key in the provider's key management service.
   • DApply server-side encryption with a provider-managed key and rely on the provider to rotate keys automatically.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   What is the main purpose of encryption in transit?

   • ATo encrypt data before it is written to memory
   • BTo protect data stored on a hard drive
   • CTo ensure data is not modified while at rest
   • DTo protect data from being intercepted while it travels over a network
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A company is using a cloud KMS to manage keys for envelope encryption. They need to ensure that key material is protected against unauthorized access, and they want to meet a compliance requirement that keys be stored in a hardware security module (HSM). Which KMS feature should they use?

   • AUse a customer-provided key imported into the KMS, but do not require HSM storage.
   • BUse software-based keys stored in the KMS database.
   • CUse a KMS that offers HSM-backed keys, where the key material is generated and stored within FIPS 140-2 validated HSMs.
   • DStore keys in a cloud storage bucket and reference them from the KMS.
   Reveal Solution Discussion Select an answer first