Cloud Data Protection GPCS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which cloud storage service feature is specifically designed to protect data at rest by encrypting objects before they are written to disk?

   • AClient-side encryption
   • BAccess control lists (ACLs)
   • CServer-side encryption
   • DVersioning
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary reason an organization might choose a specific cloud region for data storage?

   • ATo improve the performance of the application
   • BTo comply with data residency requirements that mandate data be stored within a specific geographic boundary
   • CTo reduce the cost of data storage
   • DTo enable the use of a specific encryption algorithm
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In cloud environments, why is asymmetric encryption commonly used for key exchange rather than for encrypting large volumes of data?

   • AAsymmetric encryption is computationally slower and less efficient for large data volumes
   • BAsymmetric encryption requires a trusted third party for every operation
   • CAsymmetric encryption cannot be used with cloud services
   • DAsymmetric encryption is less secure than symmetric encryption
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare SaaS company stores patient records in an S3 bucket encrypted with AWS-managed SSE-S3. A new compliance mandate requires that the company maintain exclusive control over the encryption keys and be able to rotate them independently of AWS. The security team also needs to ensure that the key material never leaves their on-premises hardware security module (HSM). Which approach should they implement?

   • AUse client-side encryption with a key stored in AWS Secrets Manager, and disable server-side encryption.
   • BEnable default encryption with SSE-S3 and rely on AWS to rotate the keys automatically every year.
   • CApply an S3 bucket policy that denies all access unless the request includes a specific encryption header.
   • DSwitch the bucket to SSE-KMS with a customer-managed key, and import the key material from their on-premises HSM into AWS KMS.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A software development team needs to use production-like data for testing, but the data contains personally identifiable information (PII). The team wants to use the data without exposing the PII. Which technique should be used?

   • AUse a subset of the production data that does not contain PII.
   • BEncrypt the PII fields and provide the decryption key to the development team.
   • CTokenize the PII fields and store the tokens in the test database.
   • DMask the PII fields in the test data by replacing them with realistic but fake values.
   Reveal Solution Discussion Select an answer first