CCSE Cloud Data Protection & Encryption 2

Question 1

A company stores sensitive data in AWS S3. Which encryption option ensures the customer retains full control of the encryption keys outside of AWS?

Accepted Answer

SSE-C

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys) allows customers to supply their own keys with each request, keeping key material entirely outside AWS.

Question 2

Which cryptographic mode of operation is recommended for encrypting large data files in cloud storage because it supports parallel processing and random access?

Accepted Answer

CTR (Counter Mode)

Answer

CTR mode converts a block cipher into a stream cipher and allows random access and parallel encryption/decryption, making it ideal for large files.

Question 3

An organization wants to search encrypted data stored in a cloud database without decrypting it first. Which advanced cryptographic technique enables this?

Accepted Answer

Homomorphic encryption

Answer

Homomorphic encryption allows computations to be performed directly on ciphertext, producing results that match operations performed on the plaintext.

Question 4

When rotating encryption keys for data already stored in cloud object storage, what process must occur to maintain data accessibility?

Accepted Answer

Re-encrypt all existing data with the new key

Answer

Data re-encryption (re-wrapping) with the new key is required so existing objects remain accessible; the old key can then be retired.

Question 5

A CCSE candidate is reviewing a cloud deployment where data in transit is protected only by TLS 1.0. What is the primary risk?

Accepted Answer

TLS 1.0 is vulnerable to POODLE and BEAST attacks

Answer

TLS 1.0 is susceptible to known attacks like POODLE and BEAST due to weak cipher suites and protocol flaws; TLS 1.2+ should be used instead.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Data Protection & Encryption 2