Cloud Data Protection & Encryption Flashcards

Which standard defines the security requirements for cryptographic modules used in cloud environments and is commonly referenced by FedRAMP and other compliance frameworks?

Answer: FIPS 140-2 / 140-3

FIPS 140-2 (and its successor 140-3) specifies security requirements for cryptographic modules; FedRAMP mandates FIPS 140-validated modules for federal cloud systems.

A developer accidentally commits an AES-256 encryption key to a public GitHub repository. Which immediate remediation step is MOST critical?

Answer: Rotate the compromised key and re-encrypt all data protected by it

The exposed key must be considered compromised; rotating it and re-encrypting protected data is the critical security action before any cleanup or notification.

An organization uses format-preserving encryption (FPE) to protect credit card numbers in a legacy database. What is the PRIMARY advantage of FPE over AES-CBC for this use case?

Answer: FPE produces ciphertext in the same format as the plaintext, avoiding schema changes

FPE preserves the format (length, character set) of the original data, so a 16-digit card number encrypts to a 16-digit ciphertext, requiring no database schema changes.

Which key lifecycle phase occurs between 'active' and 'destroyed,' during which a key may still decrypt old data but must not encrypt new data?

Answer: Deactivated

A deactivated key has passed its cryptoperiod for new encryption but is retained to decrypt historical data until all such data has been migrated or is no longer needed.

During a cloud security audit, an engineer discovers that database backups are encrypted with the same key as the live database, and both are managed by the same IAM role. What risk does this create?

Answer: Compromise of the IAM role exposes both live data and all backups simultaneously

Sharing keys and IAM roles between live and backup data means a single credential compromise gives an attacker access to all data across all time periods.

A CCSE exam scenario describes data stored in a multi-tenant cloud database where each tenant's data is encrypted with a unique tenant-derived key. What cryptographic pattern is being described?

Answer: Tenant-level key isolation using key derivation

Tenant-level key isolation via key derivation (e.g., HKDF from a master key and tenant ID) ensures one tenant's key cannot decrypt another tenant's data.

Which post-quantum cryptography algorithm family has been standardized by NIST (FIPS 203/204/205) to replace RSA and ECC in cloud key exchange and signatures?

Answer: Lattice-based cryptography (CRYSTALS-Kyber / ML-KEM, CRYSTALS-Dilithium / ML-DSA)

NIST standardized ML-KEM (Kyber) for key encapsulation and ML-DSA (Dilithium) for digital signatures as its primary post-quantum algorithms in FIPS 203/204.