CCSE Cloud Data Protection & Encryption 4

Question 1

Which standard defines the security requirements for cryptographic modules used in cloud environments and is commonly referenced by FedRAMP and other compliance frameworks?

Accepted Answer

FIPS 140-2 / 140-3

Answer

FIPS 140-2 (and its successor 140-3) specifies security requirements for cryptographic modules; FedRAMP mandates FIPS 140-validated modules for federal cloud systems.

Question 2

A developer accidentally commits an AES-256 encryption key to a public GitHub repository. Which immediate remediation step is MOST critical?

Accepted Answer

Rotate the compromised key and re-encrypt all data protected by it

Answer

The exposed key must be considered compromised; rotating it and re-encrypting protected data is the critical security action before any cleanup or notification.

Question 3

An organization uses format-preserving encryption (FPE) to protect credit card numbers in a legacy database. What is the PRIMARY advantage of FPE over AES-CBC for this use case?

Accepted Answer

FPE produces ciphertext in the same format as the plaintext, avoiding schema changes

Answer

FPE preserves the format (length, character set) of the original data, so a 16-digit card number encrypts to a 16-digit ciphertext, requiring no database schema changes.

Question 4

Which key lifecycle phase occurs between 'active' and 'destroyed,' during which a key may still decrypt old data but must not encrypt new data?

Accepted Answer

Deactivated

Answer

A deactivated key has passed its cryptoperiod for new encryption but is retained to decrypt historical data until all such data has been migrated or is no longer needed.

Question 5

During a cloud security audit, an engineer discovers that database backups are encrypted with the same key as the live database, and both are managed by the same IAM role. What risk does this create?

Accepted Answer

Compromise of the IAM role exposes both live data and all backups simultaneously

Answer

Sharing keys and IAM roles between live and backup data means a single credential compromise gives an attacker access to all data across all time periods.

(CCSE) Certified Cloud Security Engineer Practice Test

(CCSE) Certified Cloud Security Engineer Practice Test

CCSE Cloud Data Protection & Encryption 4