CCSK Cloud Data Security and Governance 2

Question 1

What is 'tokenization' and how does it differ from encryption in cloud data protection?

Accepted Answer

Tokenization replaces sensitive data with a non-sensitive placeholder; encryption transforms data using a mathematical algorithm and key

Answer

Tokenization scrambles data; encryption replaces it with a token

Answer

Tokenization is used only for network traffic; encryption is used only for storage

Answer

Tokenization and encryption are identical techniques

Question 2

Which CCSK concept describes ensuring data integrity throughout its lifecycle in the cloud?

Accepted Answer

Data lineage

Answer

Chain of custody

Answer

Non-repudiation controls

Answer

Immutable logging

Question 3

What is a 'cloud access security broker' (CASB) primarily used for?

Accepted Answer

Enforcing security policies between cloud users and cloud services

Answer

Managing cloud provider contracts and SLAs

Answer

Hosting encryption keys for cloud workloads

Answer

Scanning cloud provider networks for vulnerabilities

Question 4

According to CCSK, what should organizations do before terminating a cloud provider contract to address data security?

Accepted Answer

Ensure all data is exported, verify deletion by the provider, and obtain written confirmation

Answer

Notify the provider 90 days in advance and request a full audit

Answer

Transfer all data to another cloud provider without notifying the current provider

Answer

Archive all data locally and leave copies with the provider

Question 5

What is the role of metadata in cloud data governance according to CCSK?

Accepted Answer

Metadata describes data attributes enabling classification, discovery, and access control decisions

Answer

Metadata is irrelevant to security and governance

Answer

Metadata contains the actual sensitive data in encrypted form

Answer

Metadata is only used for billing and cost allocation

Question 6

Which approach does CCSK recommend for managing encryption keys in a multi-cloud environment?

Accepted Answer

Use a centralized, customer-controlled key management system (KMS) or HSM

Answer

Use each provider's native key management with default settings

Answer

Store keys in the same location as the encrypted data

Answer

Rotate keys only when a breach is suspected