CCSE Cloud Data Protection & Encryption 5 — Questions and Answers
Question 1: A cloud security engineer configures a secret manager to automatically rotate database credentials every 30 days. Which additional control ensures applications are not disrupted during rotation?
- Disable rotation and use manual key updates
- Implement a rotation lambda that updates both the secret and the database simultaneously (Correct answer)
- Store credentials in environment variables as a fallback
- Use the same password for all rotation cycles
Correct answer: Implement a rotation lambda that updates both the secret and the database simultaneously
An automated rotation function that atomically updates both the secret store and the target database (or supports a two-phase window with old+new credentials valid briefly) prevents application downtime.
Question 2: Which cryptographic concept ensures that even if a long-term private key is compromised in the future, past session keys cannot be derived and past communications remain confidential?
- Key stretching
- Perfect Forward Secrecy (PFS) (Correct answer)
- Non-repudiation
- Key confirmation
Correct answer: Perfect Forward Secrecy (PFS)
PFS uses ephemeral key exchange (e.g., ECDHE) so each session generates a unique key that is discarded afterward, meaning future key compromise cannot decrypt past sessions.
Question 3: An attacker gains access to ciphertext from a cloud storage bucket and attempts to determine if two different ciphertexts were encrypted from the same plaintext. Which encryption property prevents this analysis?
- Semantic security / IND-CPA (Correct answer)
- Message authentication codes (MAC)
- Key derivation functions
- Digital certificates
Correct answer: Semantic security / IND-CPA
Semantic security (IND-CPA) ensures that encrypting the same plaintext twice produces different ciphertexts (via random IVs/nonces), preventing pattern analysis.
Question 4: A CCSE candidate reviews a design where data is encrypted client-side before being uploaded to cloud storage, and the provider never receives plaintext. What term describes this architecture?
- End-to-end encryption (E2EE) (Correct answer)
- Transport layer encryption
- Server-side encryption with managed keys
- In-transit encryption only
Correct answer: End-to-end encryption (E2EE)
End-to-end encryption means only the endpoints (client and authorized recipient) can read the data; the cloud provider is an untrusted intermediary that only sees ciphertext.
Question 5: Which OWASP or cloud security guideline recommends encrypting sensitive fields individually within a database record, rather than encrypting the entire database file?
- Cell-level encryption (Correct answer)
- Transparent Data Encryption (TDE)
- Full-disk encryption
- Volume-level encryption
Correct answer: Cell-level encryption
Cell-level (field-level) encryption encrypts individual sensitive columns/attributes so that even authorized database users cannot read sensitive fields without the specific decryption key.
Question 6: A healthcare cloud application must protect PHI and allow authorized clinicians to search encrypted records by patient name. Which technique enables exact-match search on encrypted data without full decryption?
- Randomized encryption
- Deterministic encryption (Correct answer)
- Homomorphic encryption
- Order-preserving encryption
Correct answer: Deterministic encryption
Deterministic encryption always produces the same ciphertext for the same plaintext, enabling equality searches on encrypted fields, though it leaks frequency information.
Question 7: When implementing TLS mutual authentication (mTLS) between microservices in a cloud-native environment, what does each service must possess to complete the handshake?
- A shared symmetric key negotiated at deployment
- Its own X.509 certificate and private key, plus trust of the peer's CA (Correct answer)
- Only the server certificate; clients authenticate via OAuth tokens
- A pre-shared key (PSK) stored in the cloud secrets manager
Correct answer: Its own X.509 certificate and private key, plus trust of the peer's CA
In mTLS, both client and server present X.509 certificates signed by a trusted CA, and each verifies the other's certificate, providing bidirectional authentication.
CCSE Cloud Data Protection & Encryption 5
A cloud security engineer configures a secret manager to automatically rotate database credentials every 30 days.
Which additional control ensures applications are not disrupted during rotation?