CCSK Cloud Data Security and Governance 2 — Questions and Answers
Question 1: What is 'tokenization' and how does it differ from encryption in cloud data protection?
- Tokenization scrambles data; encryption replaces it with a token
- Tokenization replaces sensitive data with a non-sensitive placeholder; encryption transforms data using a mathematical algorithm and key (Correct answer)
- Tokenization is used only for network traffic; encryption is used only for storage
- Tokenization and encryption are identical techniques
Correct answer: Tokenization replaces sensitive data with a non-sensitive placeholder; encryption transforms data using a mathematical algorithm and key
Tokenization substitutes sensitive data with a token that has no intrinsic value, while encryption transforms data mathematically and can be reversed with the key.
Question 2: Which CCSK concept describes ensuring data integrity throughout its lifecycle in the cloud?
- Chain of custody
- Data lineage (Correct answer)
- Non-repudiation controls
- Immutable logging
Correct answer: Data lineage
Data lineage tracks how data moves, transforms, and is used throughout its lifecycle, ensuring accountability and integrity verification.
Question 3: What is a 'cloud access security broker' (CASB) primarily used for?
- Managing cloud provider contracts and SLAs
- Enforcing security policies between cloud users and cloud services (Correct answer)
- Hosting encryption keys for cloud workloads
- Scanning cloud provider networks for vulnerabilities
Correct answer: Enforcing security policies between cloud users and cloud services
A CASB sits between users and cloud services to enforce security policies including visibility, compliance, data security, and threat protection.
Question 4: According to CCSK, what should organizations do before terminating a cloud provider contract to address data security?
- Notify the provider 90 days in advance and request a full audit
- Ensure all data is exported, verify deletion by the provider, and obtain written confirmation (Correct answer)
- Transfer all data to another cloud provider without notifying the current provider
- Archive all data locally and leave copies with the provider
Correct answer: Ensure all data is exported, verify deletion by the provider, and obtain written confirmation
Before contract termination, organizations should export all data, confirm its deletion from provider systems, and obtain written assurance of secure disposal.
Question 5: What is the role of metadata in cloud data governance according to CCSK?
- Metadata is irrelevant to security and governance
- Metadata describes data attributes enabling classification, discovery, and access control decisions (Correct answer)
- Metadata contains the actual sensitive data in encrypted form
- Metadata is only used for billing and cost allocation
Correct answer: Metadata describes data attributes enabling classification, discovery, and access control decisions
Metadata describes data characteristics (type, owner, sensitivity) and enables automated classification, discovery, and enforcement of governance policies.
Question 6: Which approach does CCSK recommend for managing encryption keys in a multi-cloud environment?
- Use each provider's native key management with default settings
- Use a centralized, customer-controlled key management system (KMS) or HSM (Correct answer)
- Store keys in the same location as the encrypted data
- Rotate keys only when a breach is suspected
Correct answer: Use a centralized, customer-controlled key management system (KMS) or HSM
A centralized customer-controlled KMS or hardware security module (HSM) ensures consistent key governance across multiple cloud providers.
CCSK Cloud Data Security and Governance 2
What is 'tokenization' and how does it differ from encryption in cloud data protection?