Cloud Data Protection & Encryption Flashcards

A financial firm requires that encryption keys used for payment data be generated and stored in tamper-resistant hardware. Which solution best satisfies this requirement?

Answer: Hardware Security Module (HSM)

An HSM is purpose-built tamper-resistant hardware that generates, stores, and manages cryptographic keys without exposing them to software-layer attacks.

Which data masking technique permanently replaces sensitive values with realistic but fictitious data, making re-identification impossible without a lookup table?

Answer: Data anonymization

Data anonymization irreversibly removes or alters identifying information so that re-identification is statistically impossible, unlike tokenization or pseudonymization which are reversible.

A cloud security engineer is implementing BYOK (Bring Your Own Key) for a SaaS provider. Which risk is MOST effectively mitigated by this approach?

Answer: Risk that the provider can access customer data without authorization

BYOK ensures the customer controls the encryption keys, so even if the provider is compromised or compelled by legal order, they cannot decrypt customer data.

Under GDPR, a cloud provider processes EU personal data on behalf of a customer. If the data is encrypted and the customer holds the sole decryption key, which GDPR role best describes the cloud provider's position regarding that encrypted data?

Answer: Data processor with no meaningful access

When the provider cannot decrypt the data, it acts as a processor without meaningful access to personal data, reducing its GDPR obligations related to that data.

Which attack specifically targets the key management infrastructure by attempting to extract the master key from a poorly protected cloud KMS endpoint?

Answer: Key oracle attack

A key oracle attack manipulates the KMS API to infer or expose key material by observing encrypt/decrypt responses to crafted inputs.

An application encrypts each record with a unique DEK derived from a master key and a record-specific nonce. What security property does this design provide?

Answer: Blast radius limitation — compromise of one DEK exposes only one record

Using per-record DEKs limits the blast radius so that compromising one record's key does not expose any other records.

A cloud architect must ensure data confidentiality even when cloud administrators access physical storage media (e.g., disk replacement). Which control directly addresses this threat?

Answer: Encryption at rest with keys outside the provider's control

Encryption at rest with customer-managed keys ensures physical media access yields only unreadable ciphertext, since the provider's admins cannot access the keys.