CCSP Cloud Data Security 2 — Questions and Answers
Question 1: Which phase of the Cloud Data Lifecycle involves permanently destroying data so it cannot be recovered?
- Archive
- Share
- Destroy (Correct answer)
- Use
Correct answer: Destroy
The Destroy phase of the cloud data lifecycle ensures data is rendered irretrievable using methods like cryptographic erasure or physical destruction.
Question 2: Cryptographic erasure (crypto-shredding) destroys data by doing what?
- Overwriting data 7 times with random bits
- Deleting the encryption key so encrypted data becomes permanently inaccessible (Correct answer)
- Physically shredding the hard drive
- Applying degaussing to the storage medium
Correct answer: Deleting the encryption key so encrypted data becomes permanently inaccessible
Crypto-shredding deletes the encryption key, making encrypted data permanently unreadable without needing to overwrite or physically destroy the media.
Question 3: A cloud customer wants to ensure their data is never stored outside a specific geographic region. Which control best addresses this requirement?
- Data Loss Prevention (DLP) policy
- Contractual data residency clause with the CSP (Correct answer)
- Multi-factor authentication
- Intrusion Detection System (IDS)
Correct answer: Contractual data residency clause with the CSP
A contractual data residency clause legally obligates the cloud service provider to keep customer data within the specified geographic boundary.
Question 4: What is the primary risk of using the same encryption key for a long period without rotation?
- The key becomes too large to store
- Increased probability of key compromise and greater exposure of encrypted data (Correct answer)
- The algorithm weakens over time
- Storage costs increase
Correct answer: Increased probability of key compromise and greater exposure of encrypted data
Prolonged use of a single key increases both the window of exposure and the volume of data at risk if the key is ever compromised.
Question 5: Which data masking technique permanently alters production data for use in non-production environments?
- Dynamic masking
- Static masking (Correct answer)
- Tokenization
- Pseudonymization
Correct answer: Static masking
Static data masking creates a sanitized copy of the data at rest, permanently replacing sensitive values for use in development or testing.
Question 6: Under GDPR, what is the right of erasure also commonly called?
- Right to portability
- Right to be forgotten (Correct answer)
- Right to rectification
- Right to restrict processing
Correct answer: Right to be forgotten
GDPR Article 17 grants individuals the 'right to be forgotten,' requiring organizations to delete personal data upon request under certain conditions.
CCSP Cloud Data Security 2
Which phase of the Cloud Data Lifecycle involves permanently destroying data so it cannot be recovered?