Cloud Data Security

CCSP · 60 questions

• A manufacturer's data lifecycle mapping shows that engineering files are routinely sent from its cloud storage to external partners for review. Which set of controls is most closely aligned with this phase of the cloud secure data lifecycle?
• A provider's storage service splits each customer object into fragments, computes additional parity fragments, and writes all of them across many devices and facilities so that the object can be rebuilt even if several fragments are lost. What security benefit does this data dispersion technique mainly provide?
• A healthcare company plans to store regulated patient records in a provider's object storage service that disperses fragments of each object across facilities in several countries. Legal counsel raises a concern before approval. Which issue should the cloud security professional address first?
• An organization plans to connect its HR SaaS application to an internal payroll system and to an external benefits administrator. During design review, nobody can say where employee data moves between these parties or where it crosses from one trust domain into another. What should the security architect produce to identify where controls are needed?
• Reporting analysts query a cloud database whose records are encrypted at rest. To compute results, the reporting engine decrypts records and holds them in memory while processing. Which statement best describes the risk in this phase of the data lifecycle and an appropriate control?
• An IaaS workload runs a relational database on a virtual machine that needs a block device formatted with a file system. Nightly backups of that database must go to a highly scalable store that applications reach through HTTP-based APIs. Which storage pairing fits these requirements?
• A batch application writes sensitive intermediate files to the instance-local disk of a virtual machine, which the provider wipes when the instance stops. The team now also plans to keep the only copy of each job's results on that same disk. What is the main concern with this design?
• A company must keep financial records for ten years in a low-cost archival storage tier, encrypted with keys the company manages itself. Which set of threats should the long-term storage design specifically address?
• A security review finds an object storage container whose access policy grants read permission to any authenticated user of the cloud provider, not only to identities in the company's own tenant. What is the most accurate assessment of this finding?
• To troubleshoot a performance problem, an engineer shares a snapshot of a production volume that holds customer data with an external consultant's cloud account. Why is this a significant threat to volume storage?
• A provider encrypts all customer data at rest by default, using keys it creates and manages. A bank's threat model includes malicious provider insiders and compelled disclosure of data by the provider. Which change best addresses that threat?
• An architect explains that large data sets are encrypted locally with data encryption keys, and each data key is then encrypted by a key-encryption key that never leaves the key management service. What is the main reason for this envelope encryption design?
• A company uses envelope encryption for petabytes of object data and must rotate its master key every year without re-encrypting the stored data itself. How is this achieved?
• An organization downloads backup archives from cloud storage to an offline vault. Auditors require proof, at any later date, that each archive has not been altered since it was created. Which technique directly provides this assurance?
• A project team publishes the SHA-256 hash of each signed-off contract and claims this proves which partner sent each document. What should the cloud security professional point out?
• Developers need realistic test data copied from a production cloud database that contains customer PII. The test environment has weaker access controls and monitoring than production. Which approach best fits this requirement?
• An analytics team wants a data set derived from EU customer records that falls outside the scope of GDPR, because no individual can be identified from it by any means reasonably likely to be used. Which technique meets this goal?
• A merchant wants to remove primary account numbers from most of its cloud-hosted applications to shrink the scope of its payment card compliance assessment, while still being able to retrieve the real number when processing refunds. Which approach best fits?
• Monitoring shows employees uploading customer lists from company-managed laptops to personal cloud storage accounts through a web browser. Leadership wants this movement of sensitive data detected and blocked. Where should DLP enforcement be placed?
• A network DLP appliance at the company's internet edge reports no policy violations for the quarter, yet an audit finds that sensitive files were uploaded to an unsanctioned web service over HTTPS during that period. What is the most likely cause and remedy?
• A code scan finds database passwords hard-coded in an application's source, which had been pushed to a public repository. After the exposed credentials are revoked and rotated, what is the best long-term fix?
• A customer portal went offline because a TLS certificate expired without anyone noticing. Certificates across the company are requested and installed manually by different teams. What is the most effective control to prevent a repeat?
• Auditors ask which columns across a company's cloud-hosted relational databases contain national ID numbers. Which data discovery approach is most efficient for this type of data?
• A hospital has thousands of PDFs, scanned forms and text files in cloud object storage that may contain health information. There is no schema, and file names and folders follow no consistent convention. Which data discovery approach fits this situation?
• A company stores application logs as JSON documents in a cloud log service. Email addresses can appear in nested fields whose names differ from one microservice to the next. Which discovery technique is best suited to finding personal data in these logs?
• A data discovery scan reports that nightly backups of a database holding EU customer records are being replicated to a provider region outside the jurisdictions approved in the company's data residency policy. What is the most important implication of this finding?
• A company is migrating legacy file shares to cloud storage. The files carry no classification labels, and their metadata, such as owners, dates and folder names, is known to be unreliable. Which discovery method should be used to find sensitive content?
• A company wants to find sensitive data already stored in a sanctioned SaaS collaboration application, including files uploaded months before any monitoring was in place. Which approach best fits this requirement?
• Two business units disagree about how sensitive a customer analytics data set hosted in the cloud should be considered. The data set belongs to the marketing division, whose director is formally designated as its data owner. Who should assign the classification?
• A research group combines several individually public data sets in a cloud analytics platform: location check-ins, a public staff directory and published event schedules. The combined output reveals the movements of specific executives. What should happen to the classification of the combined data set?
• During a migration from an on-premises CRM to a SaaS application, field names change, for example a column named SSN becomes taxidref. Classification and DLP rules that keyed on the old field names no longer apply. What should the team establish to keep protection consistent?
• A policy states that every cloud storage resource holding confidential data must be encrypted with customer-managed keys. The cloud team wants the policy enforced automatically as resources are created, not discovered months later. Which approach best supports this?
• Files labeled Confidential in a cloud document repository lose that marking when users download or export them, so downstream systems treat the copies as unclassified. What is the best way to fix this?
• A company is drafting the data classification policy for a new cloud program and must decide what should determine the classification level assigned to each data set. Which set of criteria should drive those levels?
• An engineering firm emails CAD drawings to a supplier and needs the drawings to remain protected after they arrive, with the firm still controlling who can open them and what recipients can do. Which technology fits this requirement?
• A partner contract has ended. Design documents previously shared with the partner were protected with IRM, and copies remain on the partner's laptops and file servers. What should the company do to stop further access to those copies?
• A company deploys IRM for files shared with external partners. Partners report they cannot open the protected files because they have no identities in the company's directory. What is the best way to address this?
• Board members must be able to view a quarterly report stored in the cloud, but they must not be able to print it, copy text from it or forward it to anyone else. Which IRM capability satisfies this requirement?
• An IRM deployment allows offline access to protected files. A departing employee's certificate is revoked, yet a protected file cached on the employee's laptop still opens while the laptop stays disconnected from the network. Why does this happen, and how should the design be adjusted?
• A company must set retention periods for invoices, system logs and employee chat messages held in several cloud services. How should the retention period for each kind of record be determined?
• A company keeps every email, file and log in its cloud tenant indefinitely, on the theory that it might need them someday. What is the main risk the security manager should raise about this practice?
• A company must delete a data set from a public cloud provider, including replicas and backups managed by the provider that the customer cannot reach directly. Which method gives the customer the most assurance that the data is unrecoverable?
• At contract termination, a customer needs assurance that its SaaS provider has deleted the customer's data from production systems and backups. What should have been put in place to provide that assurance?
• Encrypted archives must remain readable for seven years. During that period the company expects to replace its encryption tooling and adopt new document formats. What must the archiving procedure ensure?
• Litigation counsel places several executives' mailboxes on legal hold. An automated lifecycle rule in the company's cloud email service is scheduled to delete all mail older than three years next week. What should happen?
• Counsel requires that data under legal hold in cloud object storage cannot be altered or deleted, even by administrators, and that only named members of the legal team can access it. Which combination of controls meets this requirement?
• During an investigation, the incident team can see that a sensitive record was read from a cloud database, but the logs cannot show who read it, from where, or exactly when. Which logging improvement addresses this gap?
• A SaaS application exposes only a limited set of audit logs to customers, omitting file-level access events that the company needs for compliance reporting. What is the best course of action?
• Investigators cannot place events from workloads in three cloud regions in the correct order, because each system logs in its own local time zone and several clocks have drifted. What should be implemented to fix this?
• A review of a company's IaaS environment finds that audit logs for object storage access are written to a bucket in the same account, and the account's administrators can delete that bucket. Leadership worries that an attacker who gains administrator rights could erase the evidence of their own activity. Which design best addresses this concern?
• A company stores engineering documents in a cloud file service. A post-incident review shows that an insider downloaded several gigabytes between 1 a.m. and 3 a.m. over two weeks; the access events were logged the whole time, but no one noticed. What should the security team implement to detect this pattern in the future?
• Log files from a cloud application will be presented as evidence in a lawsuit about unauthorized changes to customer accounts. Opposing counsel is expected to challenge whether the logs were altered after collection. What must the organization be able to demonstrate?
• A finance user denies having changed a payment record in a cloud ERP application. The audit log shows the change under a shared service account that five people use, and log entries are kept as ordinary editable text. Which change would most improve the organization's ability to prove who made such a change in the future?
• A retailer plans to train a recommendation model on a cloud ML platform using purchase histories that include customer names, email addresses and home addresses. The data science team needs only purchase patterns. The privacy officer worries that the model could memorize and later reveal personal details. What is the best first step?
• A health research group will let external analysts query aggregate statistics produced from a cloud-hosted patient data set and the models trained on it. The requirement is that results must not reveal whether any single individual's record is in the data, even to an analyst with outside knowledge. Which technique best meets this requirement?
• An attacker repeatedly submits carefully chosen inputs to a cloud-hosted fraud detection model and studies its confidence scores to determine whether a specific person's transaction record was part of the training data. What type of attack is this?
• A machine learning team wants to deploy a pre-trained model file downloaded from a shared internal model repository that many teams can write to. The security architect notes that model files can be tampered with and that some serialization formats can execute code when loaded. What control should be required before the model is deployed to production?
• After a new third-party data feed was added to a cloud training pipeline, a classification model's accuracy dropped and it began mislabeling one category of inputs. The team suspects some of the new records were deliberately manipulated. Which practice would best have allowed the team to detect and roll back this problem?
• A company exposes its proprietary pricing model through a public inference API. Monitoring shows one client account sending millions of systematically varied queries and storing every response. Which threat does this pattern most indicate, and which control most directly reduces it?
• In a cloud ML environment, data scientists, platform engineers and outside contractors all have write access to the training data store, the pipeline definitions and the production model registry. Which change best protects the integrity of the models that reach production?