CCSE Cloud Data Protection & Encryption 4 — Questions and Answers
Question 1: Which standard defines the security requirements for cryptographic modules used in cloud environments and is commonly referenced by FedRAMP and other compliance frameworks?
- ISO/IEC 27001
- FIPS 140-2 / 140-3 (Correct answer)
- SOC 2 Type II
- PCI DSS v4.0
Correct answer: FIPS 140-2 / 140-3
FIPS 140-2 (and its successor 140-3) specifies security requirements for cryptographic modules; FedRAMP mandates FIPS 140-validated modules for federal cloud systems.
Question 2: A developer accidentally commits an AES-256 encryption key to a public GitHub repository. Which immediate remediation step is MOST critical?
- Remove the commit from git history using git rebase
- Rotate the compromised key and re-encrypt all data protected by it (Correct answer)
- Add the key file to .gitignore and push a new commit
- Notify users that their data may have been exposed
Correct answer: Rotate the compromised key and re-encrypt all data protected by it
The exposed key must be considered compromised; rotating it and re-encrypting protected data is the critical security action before any cleanup or notification.
Question 3: An organization uses format-preserving encryption (FPE) to protect credit card numbers in a legacy database. What is the PRIMARY advantage of FPE over AES-CBC for this use case?
- FPE is computationally faster than AES-CBC
- FPE produces ciphertext in the same format as the plaintext, avoiding schema changes (Correct answer)
- FPE provides stronger security guarantees than AES-CBC
- FPE automatically manages key rotation schedules
Correct answer: FPE produces ciphertext in the same format as the plaintext, avoiding schema changes
FPE preserves the format (length, character set) of the original data, so a 16-digit card number encrypts to a 16-digit ciphertext, requiring no database schema changes.
Question 4: Which key lifecycle phase occurs between 'active' and 'destroyed,' during which a key may still decrypt old data but must not encrypt new data?
- Pre-activation
- Compromised
- Deactivated (Correct answer)
- Suspended
Correct answer: Deactivated
A deactivated key has passed its cryptoperiod for new encryption but is retained to decrypt historical data until all such data has been migrated or is no longer needed.
Question 5: During a cloud security audit, an engineer discovers that database backups are encrypted with the same key as the live database, and both are managed by the same IAM role. What risk does this create?
- Backup restoration will fail due to key mismatch
- Compromise of the IAM role exposes both live data and all backups simultaneously (Correct answer)
- Backup encryption will be slower than live encryption
- The cloud provider may reject the key for backup use
Correct answer: Compromise of the IAM role exposes both live data and all backups simultaneously
Sharing keys and IAM roles between live and backup data means a single credential compromise gives an attacker access to all data across all time periods.
Question 6: A CCSE exam scenario describes data stored in a multi-tenant cloud database where each tenant's data is encrypted with a unique tenant-derived key. What cryptographic pattern is being described?
- Data masking with salt
- Tenant-level key isolation using key derivation (Correct answer)
- Convergent encryption
- Probabilistic encryption
Correct answer: Tenant-level key isolation using key derivation
Tenant-level key isolation via key derivation (e.g., HKDF from a master key and tenant ID) ensures one tenant's key cannot decrypt another tenant's data.
Question 7: Which post-quantum cryptography algorithm family has been standardized by NIST (FIPS 203/204/205) to replace RSA and ECC in cloud key exchange and signatures?
- McEliece code-based cryptography
- Lattice-based cryptography (CRYSTALS-Kyber / ML-KEM, CRYSTALS-Dilithium / ML-DSA) (Correct answer)
- Hash-based signatures (XMSS only)
- Elliptic curve cryptography with 521-bit keys
Correct answer: Lattice-based cryptography (CRYSTALS-Kyber / ML-KEM, CRYSTALS-Dilithium / ML-DSA)
NIST standardized ML-KEM (Kyber) for key encapsulation and ML-DSA (Dilithium) for digital signatures as its primary post-quantum algorithms in FIPS 203/204.
CCSE Cloud Data Protection & Encryption 4
Which standard defines the security requirements for cryptographic modules used in cloud environments and is commonly referenced by FedRAMP and other compliance frameworks?