A company encrypts data in a cloud database using a customer-managed key in the cloud provider's KMS. The security team is designing a key rotation strategy. The team must balance the need to limit the amount of data encrypted with a single key against the operational cost of re-encrypting large volumes of data. Which strategy best achieves this balance?

Disable key rotation and rely on the cloud provider's default encryption

Use envelope encryption with a key-encryption key (KEK) that is rotated, and re-encrypt only the data-encryption keys (DEKs)

Rotate the key monthly but do not re-encrypt existing data; use the new key only for new data

Rotate the key annually and re-encrypt all data with the new key

A DevOps team stores database credentials and API keys in plaintext configuration files that are committed to a source code repository. A security review requires that secrets be stored securely and that access be auditable. Which solution should the team adopt?

Apply a DLP policy that scans the repository for secrets and alerts on exposure

Move the secrets to a separate file and restrict access to that file using filesystem permissions

Encrypt the configuration files with a hardcoded key in the application code

Store the secrets in a dedicated secrets management service with access policies and audit logging

Which of the following is a best practice for managing secrets in cloud applications?

Storing secrets in environment variables

Hardcoding secrets in the application source code

Using a dedicated secrets vault with access controls and rotation

Sharing secrets among all team members for convenience

When integrating a DLP tool with a cloud email service, what is a typical automated response to a policy violation?

Blocking the email and notifying the security team

Encrypting the email with a public key

Deleting the email from the server

Certified Cloud Security Professional

Domain 2Objective 3

Design and Apply Data Security Technologies and Strategies CCSP Practice Questions (Page 2)

Part of the Cloud Data Security domain, which accounts for 20% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 2–3 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

12concepts

20%of the exam

Questions 6–10

6expert · hard
A company encrypts data in a cloud database using a customer-managed key in the cloud provider's KMS. The security team is designing a key rotation strategy. The team must balance the need to limit the amount of data encrypted with a single key against the operational cost of re-encrypting large volumes of data. Which strategy best achieves this balance?
Select an answer first
7application · medium
A DevOps team stores database credentials and API keys in plaintext configuration files that are committed to a source code repository. A security review requires that secrets be stored securely and that access be auditable. Which solution should the team adopt?
Select an answer first
8foundation · easy
Which of the following is a best practice for managing secrets in cloud applications?
Select an answer first
9foundation · easy
When integrating a DLP tool with a cloud email service, what is a typical automated response to a policy violation?
Select an answer first
10foundation · easy
A cloud analytics platform needs to process customer data for statistical analysis without the ability to re-identify individuals. Which technique should be applied to the data before analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.

Design and Apply Data Security Technologies and Strategies CCSP Practice Questions (Page 2)

Questions 6–10

A DevOps team stores database credentials and API keys in plaintext configuration files that are committed to a source code repository. A security review requires that secrets be stored securely and that access be auditable. Which solution should the team adopt?

Which of the following is a best practice for managing secrets in cloud applications?

When integrating a DLP tool with a cloud email service, what is a typical automated response to a policy violation?

A cloud analytics platform needs to process customer data for statistical analysis without the ability to re-identify individuals. Which technique should be applied to the data before analysis?

Keep studying — Cloud Data Security