Question bank
Certificate of Cloud Security Knowledge v5
47 Certificate of Cloud Security Knowledge v5 questions with the correct answer and a written explanation, organised across 12 exam domains.
- 47 questions
- 12 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Application Security
4 questions in this domain
- Question 1Single Choice
Which cryptographic technique is specifically designed to protect data at rest by encrypting entire disks or files using a symmetric algorithm?
- AUsing symmetric encryption such as AES to encrypt disks, partitions, or filesCorrect answer
- BUsing hashing algorithms such as SHA-256 to make files unreadable
- CUsing asymmetric encryption for all large data volumes
- DUsing TLS and IPsec to encrypt the storage network
Why this is the answer
Data at rest is protected by symmetric encryption like AES, which is fast and suitable for large stored data volumes. Hashing is one-way and inappropriate; asymmetric encryption is mostly for key exchange and signatures; TLS/IPsec protect data in transit.
- Question 2Multiple Select
Which of the following are recognized phases in the cryptographic key management lifecycle? (Select all that apply.)
- AGenerationCorrect answer
- BDistributionCorrect answer
- CCompression
- DRotationCorrect answer
Why this is the answer
The key management lifecycle includes generation, storage, distribution, rotation, revocation, and destruction. Compression is unrelated to cryptographic key management.
- Question 3Interactive
Refer to the mapping in the code block. Based on the classifications shown, which statement is accurate?
- AAES uses one shared key for both encryption and decryptionCorrect answer
- BRSA is a hash function used for integrity checks
- CSHA-256 is designed to be reversible with the correct key
- DTLS is mostly used to encrypt data at rest
Why this is the answer
AES is symmetric, so the same key is used to encrypt and decrypt data. RSA is asymmetric, SHA-256 is a one-way hash function, and TLS protects data in transit rather than at rest.
- Question 4Single Choice
What does cryptographic agility enable an organization to do?
- AQuickly adopt new algorithms or key lengths without a massive infrastructure redesignCorrect answer
- BAutomatically recover lost encryption keys
- CEncrypt data in multiple formats at the same time
- DEliminate the need for key rotation
Why this is the answer
Cryptographic agility allows rapid transitions between cryptographic algorithms or key lengths in response to cryptanalysis advances or emerging standards, without large-scale infrastructure overhauls.
Cloud Computing Concepts & Architectures
3 questions in this domain
- Question 5Single Choice
Which type of cryptographic algorithm is primarily recommended for protecting data at rest in cloud storage volumes?
- ASymmetric encryption such as AESCorrect answer
- BAsymmetric encryption using RSA key pairs
- CHashing with SHA-256
- DTransport Layer Security (TLS) only
Why this is the answer
Data at rest protection relies on symmetric algorithms such as AES to encrypt entire disks, partitions, or files. TLS and IPsec protect data in transit, and hashing is a one-way integrity function, not a confidentiality mechanism.
- Question 6Multiple Select
According to the Cloud Security Alliance, which of the following are essential elements of a robust key management lifecycle and cloud key architecture? (Select all that apply.)
- AGeneration, storage, distribution, rotation, revocation, and destructionCorrect answer
- BSeparation of keys from encrypted dataCorrect answer
- COne long-lived key for all data
- DStoring keys with encrypted data
Why this is the answer
A robust lifecycle includes generation, storage, distribution, rotation, revocation, and destruction. Also, keys should be separated from encrypted data in the cloud architecture to avoid a single point of compromise. Long-lived shared keys and co-location of keys and data are discouraged.
- Question 7Interactive
A cloud security engineer reviews the storage resource configuration shown in the code block. According to the CSA, which missing element is critical for an effective data loss prevention (DLP) strategy?
- AData discovery and classificationCorrect answer
- BNetwork perimeter firewall
- CSymmetric key exchange
- DStorage capacity planning
Why this is the answer
The snippet already includes encryption (AES-256), access control, and integrity (HMAC). DLP also requires discovery and classification of sensitive data, which is the foundation for applying the right controls. According to the CSA, DLP is a holistic strategy spanning discovery, classification, and monitoring of data at rest, in motion, and in use.
Cloud Governance
4 questions in this domain
- Question 8Single Choice
Which type of encryption algorithm is most appropriate for protecting data at rest in cloud storage?
- ASymmetric algorithms such as AESCorrect answer
- BAsymmetric algorithms such as RSA
- CHashing algorithms such as SHA-256
- DKey exchange protocols such as Diffie-Hellman
Why this is the answer
Data at rest is usually protected with symmetric encryption like AES, because it is fast and suitable for large volumes of stored data.
- Question 9Multiple Select
Which of the following are recognized phases in a robust key management lifecycle? (Select all that apply)
- AGeneration and storageCorrect answer
- BRotation and revocationCorrect answer
- CDistribution and destructionCorrect answer
- DEncryption and hashing
Why this is the answer
A robust key lifecycle includes generation, storage, distribution, rotation, revocation, and destruction; encryption and hashing are separate cryptographic operations.
- Question 10Interactive
Analyze the code block and identify the data state that this security control is designed to protect.
- AData in Transit
- BData at Rest (Storage DLP)Correct answer
- CData in Use (Endpoint/Application DLP)
- DKey Management Lifecycle
Why this is the answer
The snippet scans persistent objects in a cloud bucket and applies encryption when sensitive content is found, which is a Data at Rest Storage DLP control.
- Question 11Single Choice
In cloud security discussions, confusing encryption with which one-way function is a common trap?
- AHashingCorrect answer
- BCompression
- CTokenization
- DLogging
Why this is the answer
Hashing is a one-way function for integrity, whereas encryption is two-way for confidentiality; confusing them is a common exam trap.
Cloud Workload Security
4 questions in this domain
- Question 12Single Choice
Which encryption type is primarily recommended for protecting data stored in non-volatile storage systems in the cloud?
- ASymmetric encryption such as AESCorrect answer
- BAsymmetric encryption with public/private key pairs
- COne-way hashing with SHA-256
- DTokenization using random values
Why this is the answer
Data at rest is protected with symmetric algorithms like AES because of their speed and suitability for encrypting entire volumes or files. Asymmetric encryption is mainly for key exchange and signatures, while hashing is for integrity, not confidentiality.
- Question 13Multiple Select
According to the DLP framework, in which states should sensitive data be monitored? Select all that apply.
- AData at RestCorrect answer
- BData in MotionCorrect answer
- CData in UseCorrect answer
- DData in Backup
Why this is the answer
DLP is a holistic strategy covering data at rest, in motion, and in use. Backup is a storage location rather than a separate data state in the DLP model.
- Question 14Interactive
Review the code block. What security objective does the operation shown accomplish?
- AConfidentiality
- BIntegrityCorrect answer
- CAvailability
- DNon-repudiation
Why this is the answer
The code applies a SHA-256 hash, which is a one-way function used for integrity verification. It does not provide confidentiality because the original input cannot be recovered, and it does not alone provide non-repudiation or availability.
- Question 15Single Choice
Why is separating encryption keys from the encrypted data a critical architectural requirement in cloud computing?
- AIt prevents a single point of compromise where one breach exposes both keys and dataCorrect answer
- BIt allows the cloud provider to access customer data when required by law
- CIt eliminates the need for key rotation
- DIt increases encryption speed by reducing CPU overhead
Why this is the answer
Separating keys from encrypted data prevents a single point of compromise. If storage is breached, the attacker still does not have the keys. Separation does not eliminate rotation, grant legal access, or improve CPU performance.
Data Security
5 questions in this domain
- Question 16Single Choice
Which symmetric encryption algorithm is named for protecting data at rest in cloud storage?
- AAESCorrect answer
- BRSA
- CTLS
- DIPsec
Why this is the answer
The playbook states that symmetric algorithms such as AES are used to encrypt entire disks, partitions, or files to prevent exposure if storage is compromised.
- Question 17Multiple Select
Which statements about protecting data in transit are correct?
- ATLS or IPsec is used to protect data across untrusted networks.Correct answer
- BIt prevents packets from being sniffed or altered during transmission.Correct answer
- CIt is only used inside the cloud provider's private backbone.
- DIt relies on a single shared key for all network sessions.
Why this is the answer
The playbook says data in transit is protected with TLS or IPsec, ensuring packets cannot be sniffed or altered across untrusted network segments.
- Question 18Interactive
Analyze the function in the code block. What label is returned when the input value is 'PII'?
- ARestrictedCorrect answer
- BPrivate
- CPublic
- DError
Why this is the answer
The function returns 'Restricted' for PII, which aligns with assigning higher security controls to sensitive data based on classification.
- Question 19Single Choice
What is the primary purpose of data discovery and classification?
- ATo identify sensitive information and apply controls based on its valueCorrect answer
- BTo automatically encrypt every file in cloud storage
- CTo replace the key management lifecycle
- DTo monitor all inbound network traffic
Why this is the answer
The playbook states that data discovery and classification identify sensitive information and apply appropriate security controls based on the data's value and sensitivity.
- Question 20Multiple Select
Which statements about the key management lifecycle are correct?
- AIt includes generation, storage, distribution, rotation, revocation, and destruction.Correct answer
- BSeparating keys from the encrypted data is a critical architectural requirement.Correct answer
- CKeys and encrypted data should be stored together for easy access.
- DKey rotation is unnecessary if the symmetric algorithm is strong.
Why this is the answer
The playbook emphasizes a complete key lifecycle and states that separating keys from encrypted data is critical to avoid single points of compromise.
Identity & Access Management
4 questions in this domain
- Question 21Single Choice
Which type of encryption uses a single shared key for both encryption and decryption, making it well suited for protecting data at rest?
- ASymmetric encryptionCorrect answer
- BAsymmetric encryption
- CHashing
- DDigital signature
Why this is the answer
Symmetric encryption uses a single key for both encryption and decryption, providing high speed for large data volumes, which is ideal for data at rest. Asymmetric encryption uses a key pair, while hashing is one-way and not designed for confidentiality.
- Question 22Multiple Select
Which phases are part of the key management lifecycle described in the playbook?
- AGeneration, storage, and distributionCorrect answer
- BRotation, revocation, and destructionCorrect answer
- CCompression and optimization
- DIndexing and caching
Why this is the answer
The key management lifecycle includes generation, storage, distribution, rotation, revocation, and destruction. Compression, optimization, indexing, and caching are not lifecycle phases.
- Question 23Interactive
Review the code snippet provided in the interactive pane. What data protection state is this function designed to secure?
- AData in transitCorrect answer
- BData at rest
- CData classification
- DKey destruction
Why this is the answer
The code wraps data in a TLS session, which protects data in transit from sniffing and alteration over untrusted networks. TLS does not primarily protect stored data, classify data, or destroy keys.
- Question 24Single Choice
What is the fundamental difference between hashing and encryption?
- AHashing is a one-way function used for integrity, while encryption is a two-way function used for confidentialityCorrect answer
- BHashing is reversible and encryption is one-way
- CBoth are reversible with the correct key
- DEncryption detects accidental corruption while hashing protects confidentiality
Why this is the answer
Hashing is a one-way function that provides integrity verification, whereas encryption is two-way and protects confidentiality. Confusing them is a common exam trap.
Incident Response & Resilience
4 questions in this domain
- Question 25Single Choice
Which type of encryption is primarily used to protect data at rest in non-volatile storage?
- ASymmetric encryptionCorrect answer
- BAsymmetric encryption
- CHashing
- DDigital signatures
Why this is the answer
Data at rest protection uses symmetric algorithms such as AES to encrypt disks, partitions, or objects, preventing exposure if storage is compromised.
- Question 26Multiple Select
Which statements about encryption, hashing, and integrity are correct? Select all that apply.
- AEncryption alone guarantees data integrity
- BHashing is a one-way integrity checkCorrect answer
- CEncryption should pair with HMAC for integrityCorrect answer
- DCiphertext can be altered without integrity controlsCorrect answer
Why this is the answer
Encryption provides confidentiality, not automatic integrity. Hashing is a one-way integrity function, and HMAC can detect tampering of encrypted ciphertext.
- Question 27Interactive
Review the code block. What security control is applied to files classified as 'Restricted'?
- ASymmetric encryptionCorrect answer
- BAsymmetric encryption
- CHashing
- DDLP scanning
Why this is the answer
The code block calls an encrypt function on restricted files, indicating symmetric encryption is used to protect confidentiality; audit logging records the action.
- Question 28Single Choice
Which DLP state specifically addresses data while it is being processed by applications or users, such as copy/paste and print actions?
- AData at Rest
- BData in Motion
- CData in UseCorrect answer
- DData Discovery
Why this is the answer
Data in Use, or endpoint/application DLP, safeguards data during active processing and includes monitoring clipboard actions, screen captures, and printing.
Infrastructure & Networking
4 questions in this domain
- Question 29Single Choice
What foundational process identifies sensitive data in cloud storage and databases before security controls are applied?
- AData discovery and classificationCorrect answer
- BSymmetric key encryption
- CKey management lifecycle
- DHashing
Why this is the answer
Data discovery and classification is the foundational DLP step because it reveals where sensitive information resides and guides which controls to apply.
- Question 30Multiple Select
In the context of cloud storage security, which of the following statements accurately describe data at rest protection? Select all that apply.
- AUses symmetric algorithms to encrypt disks or filesCorrect answer
- BPrimarily defends data while it moves across networks
- CPrevents data exposure if storage is compromisedCorrect answer
- DProvides integrity by using one-way hashing
Why this is the answer
Data at rest protection uses symmetric encryption to secure persistent storage and limits the impact of a compromised volume; it does not focus on transit or hashing.
- Question 31Interactive
Review the provided Python snippet and identify which cryptographic operation is being performed on the sample data.
- AHashingCorrect answer
- BSymmetric encryption
- CAsymmetric encryption
- DDigital signature
Why this is the answer
The snippet uses hashlib.sha256, which creates a one-way digest, so it demonstrates hashing rather than reversible encryption or signing.
- Question 32Single Choice
Which choice best explains why cryptographic agility is important for responding to cryptanalysis advancements in cloud environments?
- AEnable algorithm or key-length changes without massive overhaulsCorrect answer
- BUse a single key for both encryption and decryption
- CScan cloud storage to locate sensitive data
- DSeparate encryption keys from the encrypted data
Why this is the answer
Cryptographic agility allows quick transitions to alternate algorithms or key lengths in response to cryptanalysis or quantum advances without major infrastructure rebuilds.
Organization Management
4 questions in this domain
- Question 33Single Choice
What is the primary purpose of encrypting data at rest in cloud storage?
- ATo prevent data exposure if the underlying hardware or storage volume is compromisedCorrect answer
- BTo verify the integrity of data during transmission
- CTo accelerate data retrieval from cloud buckets
- DTo replace hashing for all data integrity checks
Why this is the answer
Encryption of data at rest protects confidentiality by ensuring that stored data is unreadable if the hardware or storage volume is compromised. It does not provide integrity, speed, or replace hashing.
- Question 34Multiple Select
Which statements accurately describe symmetric and asymmetric encryption?
- ASymmetric encryption uses a single key for both encryption and decryptionCorrect answer
- BAsymmetric encryption uses a public/private key pairCorrect answer
- CSymmetric encryption is well suited for encrypting large volumes of data at restCorrect answer
- DAsymmetric encryption is faster than symmetric encryption for bulk data encryption
Why this is the answer
Symmetric encryption uses one shared key and is fast for large data volumes, making it ideal for data at rest. Asymmetric encryption uses a public/private key pair and is typically used for key exchange and digital signatures, not for bulk data encryption.
- Question 35Interactive
Review the code block. The design allows the security team to change the cryptographic algorithm and key length at runtime without rewriting the encryption workflow. Which cloud security principle does this architectural pattern exemplify?
- ACryptographic agilityCorrect answer
- BKey management lifecycle
- CData at rest protection
- DData loss prevention
Why this is the answer
Cryptographic agility is the ability of a security architecture to transition between algorithms or key lengths without massive overhauls. The code reflects this by making the algorithm and key length configurable at runtime.
- Question 36Single Choice
What is the fundamental difference between encryption and hashing?
- AHashing is a one-way function used for integrity, while encryption is two-way and used for confidentialityCorrect answer
- BEncryption is a one-way function used for integrity, while hashing is two-way and used for confidentiality
- CHashing uses a public/private key pair, while encryption uses a shared secret
- DThere is no difference; encryption and hashing are interchangeable terms
Why this is the answer
Hashing is a one-way function that verifies data integrity, while encryption is a two-way function that protects confidentiality by allowing decryption with the appropriate key. Confusing the two is a common and serious mistake.
Related Technologies & Strategies
3 questions in this domain
- Question 37Single Choice
What is the primary purpose of symmetric encryption when protecting data at rest?
- ATo provide integrity through a one-way hash function
- BTo encrypt entire disks, partitions, or files using a single key for confidentialityCorrect answer
- CTo exchange keys between parties using a public/private pair
- DTo detect and block sensitive data leaving the network
Why this is the answer
Symmetric encryption uses a single key for both encryption and decryption and is well-suited for protecting data at rest, such as disks, partitions, and files.
- Question 38Multiple Select
Which of the following are benefits of cryptographic agility in a cloud security architecture? (Select all that apply)
- AIt enables rapid transition from one cryptographic algorithm to another without large infrastructure changesCorrect answer
- BIt helps an organization respond to cryptanalytic advances and quantum-computing threatsCorrect answer
- CIt requires the use of a single shared key for both encryption and decryption
- DIt guarantees that keys are automatically destroyed when data is reclassified
Why this is the answer
Cryptographic agility allows architectures to quickly shift algorithms or key lengths in response to threats. It does not require a single shared key and does not automatically destroy keys upon reclassification.
- Question 39Interactive
An analyst is inspecting a Python function that labels a dataset based on attributes. According to the classification logic, what label should be returned for a record with 'contains_pii' set to True?
- ARestrictedCorrect answer
- BPrivate
- CPublic
- DUnclassified
Why this is the answer
Because the record has 'contains_pii' set to True, the function returns 'Restricted', the highest sensitivity label shown in the code.
Risk, Audit, & Compliance
4 questions in this domain
- Question 40Single Choice
What is the primary purpose of using symmetric encryption algorithms like AES for data at rest?
- ATo prevent data exposure if the underlying storage is compromisedCorrect answer
- BTo ensure that data cannot be altered during transmission
- CTo eliminate the need for key management
- DTo increase the speed of network data transfers
Why this is the answer
Symmetric encryption at rest protects confidentiality by encrypting disks, partitions, or files so that even if the hardware or storage volume is compromised, the data remains unreadable without the key.
- Question 41Multiple Select
Which of the following are stages in a robust key management lifecycle? (Select all that apply.)
- AGenerationCorrect answer
- BStorageCorrect answer
- CCompression
- DDeduplication
Why this is the answer
A robust key management lifecycle includes generation, storage, distribution, rotation, revocation, and destruction. Compression and deduplication are storage optimization techniques, not key lifecycle stages.
- Question 42Interactive
Review the code snippet below. What security protocol is being implemented to protect data moving between a client and a cloud service?
- ATLSCorrect answer
- BAES
- CIPsec
- DHMAC
Why this is the answer
The code creates an SSL context, loads trusted CA certificates, and wraps a socket using a TLS client context. This is characteristic of TLS, which protects data in transit between endpoints.
- Question 43Single Choice
Under the shared responsibility model, who is responsible for defining and applying DLP policies to customer data stored in the cloud?
- AThe cloud customerCorrect answer
- BThe cloud service provider
- CBoth the provider and customer equally
- DThe regulatory authority
Why this is the answer
The CSP secures the underlying infrastructure, but the customer is responsible for the data stored in the cloud and for the DLP policies applied to that data.
Security Monitoring
4 questions in this domain
- Question 44Single Choice
What is the primary goal of data at rest protection?
- APrevent data exposure if the storage volume is compromisedCorrect answer
- BEnsure data packets cannot be sniffed during transmission
- CVerify the identity of cloud service consumers
- DReplace the need for key management services
Why this is the answer
Data at rest protection uses symmetric encryption to secure stored data so that exposure is prevented if the hardware or storage volume is compromised.
- Question 45Multiple Select
Which of the following are stages in the key management lifecycle?
- AGeneration, rotation, and destructionCorrect answer
- BStorage, distribution, and revocationCorrect answer
- CEncryption, hashing, and tokenization
- DArchival and retention
Why this is the answer
The key management lifecycle includes generation, storage, distribution, rotation, revocation, and destruction. Hashing and tokenization are not lifecycle stages; archival is not listed.
- Question 46Interactive
Analyze the provided code snippet. Which data state is this DLP control addressing?
- AData in MotionCorrect answer
- BData at Rest
- CData in Use
- DData Discovery
Why this is the answer
The code inspects outbound payloads and blocks suspicious patterns, which is Network DLP monitoring data in motion as it leaves the cloud perimeter.
- Question 47Single Choice
What is the key difference between encryption and hashing?
- AEncryption is two-way; hashing is one-wayCorrect answer
- BEncryption is one-way; hashing is two-way
- CEncryption preserves integrity; hashing preserves confidentiality
- DThey are interchangeable terms
Why this is the answer
Encryption is a two-way function used for confidentiality, while hashing is a one-way function used for integrity. They cannot be used interchangeably.
Frequently asked questions
Everything about the Certificate of Cloud Security Knowledge v5 question bank and how to use it.