CCSE Cloud Data Protection & Encryption 3 — Questions and Answers
Question 1: A financial firm requires that encryption keys used for payment data be generated and stored in tamper-resistant hardware. Which solution best satisfies this requirement?
- Software-based key store in the cloud provider's KMS
- Hardware Security Module (HSM) (Correct answer)
- Encrypted configuration file on a bastion host
- TPM chip on a virtual machine
Correct answer: Hardware Security Module (HSM)
An HSM is purpose-built tamper-resistant hardware that generates, stores, and manages cryptographic keys without exposing them to software-layer attacks.
Question 2: Which data masking technique permanently replaces sensitive values with realistic but fictitious data, making re-identification impossible without a lookup table?
- Pseudonymization
- Tokenization
- Data anonymization (Correct answer)
- Format-preserving encryption
Correct answer: Data anonymization
Data anonymization irreversibly removes or alters identifying information so that re-identification is statistically impossible, unlike tokenization or pseudonymization which are reversible.
Question 3: A cloud security engineer is implementing BYOK (Bring Your Own Key) for a SaaS provider. Which risk is MOST effectively mitigated by this approach?
- Risk of data loss due to hardware failure
- Risk that the provider can access customer data without authorization (Correct answer)
- Risk of DDoS attacks against the SaaS platform
- Risk of API rate limiting during peak usage
Correct answer: Risk that the provider can access customer data without authorization
BYOK ensures the customer controls the encryption keys, so even if the provider is compromised or compelled by legal order, they cannot decrypt customer data.
Question 4: Under GDPR, a cloud provider processes EU personal data on behalf of a customer. If the data is encrypted and the customer holds the sole decryption key, which GDPR role best describes the cloud provider's position regarding that encrypted data?
- Data controller
- Data processor with full access
- Data processor with no meaningful access (Correct answer)
- Joint controller
Correct answer: Data processor with no meaningful access
When the provider cannot decrypt the data, it acts as a processor without meaningful access to personal data, reducing its GDPR obligations related to that data.
Question 5: Which attack specifically targets the key management infrastructure by attempting to extract the master key from a poorly protected cloud KMS endpoint?
- Side-channel attack
- Key oracle attack (Correct answer)
- Cryptographic agility attack
- Birthday attack
Correct answer: Key oracle attack
A key oracle attack manipulates the KMS API to infer or expose key material by observing encrypt/decrypt responses to crafted inputs.
Question 6: An application encrypts each record with a unique DEK derived from a master key and a record-specific nonce. What security property does this design provide?
- Forward secrecy for past records if the master key is compromised
- Blast radius limitation — compromise of one DEK exposes only one record (Correct answer)
- Elimination of the need for a master key
- Faster decryption by parallelizing master key operations
Correct answer: Blast radius limitation — compromise of one DEK exposes only one record
Using per-record DEKs limits the blast radius so that compromising one record's key does not expose any other records.
Question 7: A cloud architect must ensure data confidentiality even when cloud administrators access physical storage media (e.g., disk replacement). Which control directly addresses this threat?
- Network-level encryption (TLS)
- Encryption at rest with keys outside the provider's control (Correct answer)
- Multi-factor authentication for admins
- VPC flow logs and monitoring
Correct answer: Encryption at rest with keys outside the provider's control
Encryption at rest with customer-managed keys ensures physical media access yields only unreadable ciphertext, since the provider's admins cannot access the keys.
CCSE Cloud Data Protection & Encryption 3
A financial firm requires that encryption keys used for payment data be generated and stored in tamper-resistant hardware.
Which solution best satisfies this requirement?