Cloud Data Protection & Encryption Flashcards

A cloud security engineer configures a secret manager to automatically rotate database credentials every 30 days. Which additional control ensures applications are not disrupted during rotation?

Answer: Implement a rotation lambda that updates both the secret and the database simultaneously

An automated rotation function that atomically updates both the secret store and the target database (or supports a two-phase window with old+new credentials valid briefly) prevents application downtime.

Which cryptographic concept ensures that even if a long-term private key is compromised in the future, past session keys cannot be derived and past communications remain confidential?

Answer: Perfect Forward Secrecy (PFS)

PFS uses ephemeral key exchange (e.g., ECDHE) so each session generates a unique key that is discarded afterward, meaning future key compromise cannot decrypt past sessions.

An attacker gains access to ciphertext from a cloud storage bucket and attempts to determine if two different ciphertexts were encrypted from the same plaintext. Which encryption property prevents this analysis?

Answer: Semantic security / IND-CPA

Semantic security (IND-CPA) ensures that encrypting the same plaintext twice produces different ciphertexts (via random IVs/nonces), preventing pattern analysis.

A CCSE candidate reviews a design where data is encrypted client-side before being uploaded to cloud storage, and the provider never receives plaintext. What term describes this architecture?

Answer: End-to-end encryption (E2EE)

End-to-end encryption means only the endpoints (client and authorized recipient) can read the data; the cloud provider is an untrusted intermediary that only sees ciphertext.

Which OWASP or cloud security guideline recommends encrypting sensitive fields individually within a database record, rather than encrypting the entire database file?

Answer: Cell-level encryption

Cell-level (field-level) encryption encrypts individual sensitive columns/attributes so that even authorized database users cannot read sensitive fields without the specific decryption key.

A healthcare cloud application must protect PHI and allow authorized clinicians to search encrypted records by patient name. Which technique enables exact-match search on encrypted data without full decryption?

Answer: Deterministic encryption

Deterministic encryption always produces the same ciphertext for the same plaintext, enabling equality searches on encrypted fields, though it leaks frequency information.

When implementing TLS mutual authentication (mTLS) between microservices in a cloud-native environment, what does each service must possess to complete the handshake?

Answer: Its own X.509 certificate and private key, plus trust of the peer's CA

In mTLS, both client and server present X.509 certificates signed by a trusted CA, and each verifies the other's certificate, providing bidirectional authentication.