Cloud Data Protection & Encryption Flashcards

A company stores sensitive data in AWS S3. Which encryption option ensures the customer retains full control of the encryption keys outside of AWS?

Answer: SSE-C

SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to supply their own keys with each request, keeping key material entirely outside AWS.

Which cryptographic mode of operation is recommended for encrypting large data files in cloud storage because it supports parallel processing and random access?

Answer: CTR (Counter Mode)

CTR mode converts a block cipher into a stream cipher and allows random access and parallel encryption/decryption, making it ideal for large files.

An organization wants to search encrypted data stored in a cloud database without decrypting it first. Which advanced cryptographic technique enables this?

Answer: Homomorphic encryption

Homomorphic encryption allows computations to be performed directly on ciphertext, producing results that match operations performed on the plaintext.

When rotating encryption keys for data already stored in cloud object storage, what process must occur to maintain data accessibility?

Answer: Re-encrypt all existing data with the new key

Data re-encryption (re-wrapping) with the new key is required so existing objects remain accessible; the old key can then be retired.

A CCSE candidate is reviewing a cloud deployment where data in transit is protected only by TLS 1.0. What is the primary risk?

Answer: TLS 1.0 is vulnerable to POODLE and BEAST attacks

TLS 1.0 is susceptible to known attacks like POODLE and BEAST due to weak cipher suites and protocol flaws; TLS 1.2+ should be used instead.

Which key management concept separates the role responsible for creating and managing encryption keys from the role that uses those keys to encrypt business data?

Answer: Separation of duties

Separation of duties ensures that no single person or system has both key management authority and data encryption access, reducing insider threat risk.

An enterprise uses envelope encryption in a cloud KMS. What does the 'data encryption key' (DEK) encrypt, and what encrypts the DEK itself?

Answer: DEK encrypts the plaintext data; the Key Encryption Key (KEK) encrypts the DEK

In envelope encryption, the DEK encrypts the plaintext data, and the KEK (often a CMK in KMS) wraps/encrypts the DEK, so the KEK never directly touches the data.