In a cloud environment using envelope encryption, what is the role of a data encryption key (DEK)?

It is a master key that remains in the KMS and never leaves the hardware security module

It encrypts the actual data, and is itself encrypted by a key encryption key (KEK)

It encrypts the key encryption key (KEK) to protect it from unauthorized access

It is used only for signing data, not for encryption

In a cloud IAM context, what is the primary purpose of a key management service (KMS)?

To authenticate users and authorize their access to cloud resources based on policies

To store user passwords and other secrets in a hardened, tamper-resistant vault

To encrypt all data in transit between the cloud provider and the customer's on-premises network

To centrally generate, store, rotate, and control the use of cryptographic keys used to protect data and services

What is the primary reason to renew a certificate before its expiration date?

To reduce the size of the certificate so it is transmitted faster

To move the certificate to a different certificate authority

To avoid a lapse in trust for clients that rely on the certificate

To change the certificate's public key without changing the private key

An application needs to store an API key used to call a third-party service. Which practice aligns with secure secrets management?

Share the API key with all developers via a shared document for easy access.

Encrypt the API key with a hard-coded key in the application source code.

Store the API key in a dedicated secrets vault and rotate it on a defined schedule.

Embed the API key in the application's configuration file and restrict file permissions.

Certified Cloud Security Professional

Domain 4Objective 7

Design Appropriate Identity and Access Management (IAM) Solutions CCSP Practice Questions (Page 2)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 12 practice questions to prepare you well beyond it. (estimate)

12questions here

3free pages

8concepts

16%of the exam

Questions 6–10

6foundation · easy
In a cloud environment using envelope encryption, what is the role of a data encryption key (DEK)?
Select an answer first
7foundation · easy
In a cloud IAM context, what is the primary purpose of a key management service (KMS)?
Select an answer first
8foundation · easy
What is the primary reason to renew a certificate before its expiration date?
Select an answer first
9foundation · easy
Which component in a public key infrastructure (PKI) is responsible for issuing and digitally signing certificates?
Select an answer first
10foundation · medium
An application needs to store an API key used to call a third-party service. Which practice aligns with secure secrets management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.