Encryption at Rest and in Transit CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary role of a cloud provider's key management service (KMS)?

   • ATo store data in an encrypted format
   • BTo encrypt all data automatically without user involvement
   • CTo replace the need for encryption altogether
   • DTo centrally manage encryption keys used by cloud services
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large enterprise uses envelope encryption for data at rest in a cloud object store. They currently use a single KEK for all DEKs. The security team wants to reduce the impact of a potential KEK compromise and also wants to be able to revoke access for a specific department without re-encrypting all data. Which change should they make?

   • AUse a separate DEK for each department but keep a single KEK
   • BUse a separate KEK per department and store all KEKs in the cloud KMS
   • CUse a single KEK but rotate it monthly
   • DStore KEKs in the application server's memory
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a hybrid cloud architecture where on-premises servers communicate with cloud resources over the internet. They need to ensure that all traffic is encrypted and that the connection is resilient to failures. They are considering IPsec VPN and TLS. Which factor should they prioritize in their decision?

   • ATLS provides better encryption strength than IPsec.
   • BIPsec VPN provides network-layer encryption for all traffic between sites, while TLS is application-specific and would require each application to support it.
   • CTLS is always faster than IPsec and should be used for all traffic.
   • DIPsec is easier to configure than TLS for individual applications.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A law firm has an on-premises file server and wants to allow remote employees to securely access files over the public internet. The firm must ensure that all traffic between the remote employees and the file server is encrypted. Which solution should they implement?

   • AUse FTP with SSL/TLS (FTPS) but only for file transfers
   • BSite-to-site VPN using IPsec between the office network and the cloud
   • CRemote access VPN using IPsec or TLS for each employee
   • DExpose the file server directly to the internet with a firewall
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A government contractor uses a cloud KMS to manage encryption keys for data at rest. Their security policy requires that keys be changed regularly and that old keys be securely destroyed after a defined period. Which key management practice should they implement?

   • ANever rotate keys to avoid disruption
   • BManual key rotation whenever an employee remembers to do it
   • CDelete old keys immediately after rotation
   • DAutomated key rotation with a defined retention period for old keys
   Reveal Solution Discussion Select an answer first