Why do compliance regulations often mandate encryption?

To protect sensitive data from unauthorized access

To make data accessible to anyone

To eliminate the need for access controls

A company must comply with a regulation that requires encryption keys to be stored separately from the encrypted data. They are using a cloud object storage service. They also want to minimize the risk of data exposure if the storage account is compromised. Which approach should they choose?

Use server-side encryption with a customer-managed key stored in the same cloud KMS, and grant the storage account access to the KMS.

Use client-side encryption with keys stored in a separate cloud KMS, and ensure the storage account does not have access to the KMS.

Use a VPN to protect access to the storage account and store data in plaintext.

Use server-side encryption with a provider-managed key.

A company uses a cloud KMS to manage encryption keys. The security team wants to ensure that if a key is compromised, the impact is limited and the key can be replaced without re-encrypting all data. Which practice should they implement?

Use envelope encryption and rotate the key encryption key (KEK) regularly.

Disable key rotation to avoid complexity.

Use a single long-lived symmetric key for all data.

Store the key in the same cloud storage bucket as the encrypted data.

What is the purpose of a key encryption key (KEK) in envelope encryption?

To encrypt the data encryption key (DEK)

What is the primary purpose of a VPN for data in transit?

To encrypt data at rest on a hard drive

To create a secure, encrypted tunnel over a public network

To authenticate users without encrypting traffic

To compress data for faster transmission

EC-CouncilCloud Security Essentials

Domain 3Objective 2

Encryption at Rest and in Transit CSE Practice Questions (Page 7)

Part of the Data Protection and Encryption in the Cloud domain, which makes up ~12% of our current practice bank.

55questions here

11free pages

15concepts

15 Concepts in This Objective

Encryption at rest overview
Encryption in transit overview
Symmetric encryption
Asymmetric encryption
Key management fundamentals
Cloud provider key management services
Encryption for data at rest in cloud storage
Encryption for data at rest in databases
TLS/SSL for data in transit
VPN and IPsec for data in transit
Encryption for API and service communication
Envelope encryption
Bring Your Own Key (BYOK)
Server-side vs client-side encryption
Compliance and regulatory considerations

Questions 31–35

31foundation · easy
Why do compliance regulations often mandate encryption?
Select an answer first
32expert · hard
A company must comply with a regulation that requires encryption keys to be stored separately from the encrypted data. They are using a cloud object storage service. They also want to minimize the risk of data exposure if the storage account is compromised. Which approach should they choose?
Select an answer first
33application · medium
A company uses a cloud KMS to manage encryption keys. The security team wants to ensure that if a key is compromised, the impact is limited and the key can be replaced without re-encrypting all data. Which practice should they implement?
Select an answer first
34foundation · easy
What is the purpose of a key encryption key (KEK) in envelope encryption?
Select an answer first
35foundation · easy
What is the primary purpose of a VPN for data in transit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.