CCSE Cloud Data Protection & Encryption 2 — Questions and Answers
Question 1: A company stores sensitive data in AWS S3. Which encryption option ensures the customer retains full control of the encryption keys outside of AWS?
- SSE-S3
- SSE-KMS
- SSE-C (Correct answer)
- Client-side encryption with AWS KMS
Correct answer: SSE-C
SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to supply their own keys with each request, keeping key material entirely outside AWS.
Question 2: Which cryptographic mode of operation is recommended for encrypting large data files in cloud storage because it supports parallel processing and random access?
- CBC (Cipher Block Chaining)
- ECB (Electronic Codebook)
- CTR (Counter Mode) (Correct answer)
- CFB (Cipher Feedback)
Correct answer: CTR (Counter Mode)
CTR mode converts a block cipher into a stream cipher and allows random access and parallel encryption/decryption, making it ideal for large files.
Question 3: An organization wants to search encrypted data stored in a cloud database without decrypting it first. Which advanced cryptographic technique enables this?
- Homomorphic encryption (Correct answer)
- Tokenization
- Format-preserving encryption
- Deterministic encryption
Correct answer: Homomorphic encryption
Homomorphic encryption allows computations to be performed directly on ciphertext, producing results that match operations performed on the plaintext.
Question 4: When rotating encryption keys for data already stored in cloud object storage, what process must occur to maintain data accessibility?
- Delete and re-upload all objects
- Re-encrypt all existing data with the new key (Correct answer)
- Update the key alias only without re-encrypting
- Disable the old key immediately after rotation
Correct answer: Re-encrypt all existing data with the new key
Data re-encryption (re-wrapping) with the new key is required so existing objects remain accessible; the old key can then be retired.
Question 5: A CCSE candidate is reviewing a cloud deployment where data in transit is protected only by TLS 1.0. What is the primary risk?
- TLS 1.0 lacks certificate validation
- TLS 1.0 is vulnerable to POODLE and BEAST attacks (Correct answer)
- TLS 1.0 does not support symmetric encryption
- TLS 1.0 prevents the use of digital signatures
Correct answer: TLS 1.0 is vulnerable to POODLE and BEAST attacks
TLS 1.0 is susceptible to known attacks like POODLE and BEAST due to weak cipher suites and protocol flaws; TLS 1.2+ should be used instead.
Question 6: Which key management concept separates the role responsible for creating and managing encryption keys from the role that uses those keys to encrypt business data?
- Key escrow
- Separation of duties (Correct answer)
- Key derivation
- Dual control
Correct answer: Separation of duties
Separation of duties ensures that no single person or system has both key management authority and data encryption access, reducing insider threat risk.
Question 7: An enterprise uses envelope encryption in a cloud KMS. What does the 'data encryption key' (DEK) encrypt, and what encrypts the DEK itself?
- DEK encrypts the KEK; the master key encrypts the DEK
- DEK encrypts the plaintext data; the Key Encryption Key (KEK) encrypts the DEK (Correct answer)
- DEK encrypts the KEK; the HSM stores the DEK in plaintext
- DEK encrypts metadata; the KEK encrypts the actual data
Correct answer: DEK encrypts the plaintext data; the Key Encryption Key (KEK) encrypts the DEK
In envelope encryption, the DEK encrypts the plaintext data, and the KEK (often a CMK in KMS) wraps/encrypts the DEK, so the KEK never directly touches the data.
CCSE Cloud Data Protection & Encryption 2
A company stores sensitive data in AWS S3.
Which encryption option ensures the customer retains full control of the encryption keys outside of AWS?