Domain 2 Capstone Review: Cloud Data Security Integration

Domain 2 carries the highest exam weight at 20%. This capstone integrates concepts across all three sections: data fundamentals, data protection, and data governance. These scenarios require you to combine encryption decisions with governance requirements, DLP with legal hold, and classification with compliance. Master these, and you own the largest domain on the exam.

Scenario 1

A SaaS provider's terms grant them rights to use anonymized customer data for product improvement. An audit reveals the anonymization is reversible using publicly available data. What is the legal classification of this data?

1. A) Anonymized data — the provider's terms define the classification
2. B) The classification depends on the provider's intent
3. C) Pseudonymized data, which is exempt from GDPR
4. D) Personal data — if re-identification is possible using reasonably available means, the data is not truly anonymized and remains personal data under GDPR, meaning the provider's use may violate data protection regulations

Scenario 2

An organization uses tokenization for credit card data and encryption for health records, both stored in the same cloud database. A security assessor recommends also implementing DLP. Why is DLP needed when the data is already protected?

1. A) DLP is redundant with tokenization and encryption
2. B) DLP is only needed for unencrypted data
3. C) DLP should replace tokenization for simpler management
4. D) Tokenization and encryption protect data at rest. DLP monitors data in motion and in use — it detects attempts to exfiltrate data, copy it to unauthorized locations, or share it through unapproved channels. These are complementary, not overlapping controls

Scenario 3

A company implements IRM on confidential financial reports shared with board members. A board member screenshots a report and emails the image to a journalist. IRM did not prevent this. Does this mean IRM failed?

1. A) IRM has inherent limitations — it controls digital actions (copy, print, forward) but cannot prevent analog capture like screenshots or photography. IRM succeeded in preventing digital exfiltration but the analog gap required additional controls like policy, training, and monitoring
2. B) No — but IRM should be replaced with a technology that prevents screenshots
3. C) Yes — the IRM implementation was misconfigured
4. D) Yes — IRM should prevent all forms of data exfiltration

Scenario 4

During a legal hold, the IT team discovers that a cloud backup rotation policy deleted 14 days of email backups before the hold was implemented on backup systems. The legal team had notified IT of the hold 3 days before the deletion occurred. What happened?

1. A) The 14-day backup window is too short and should be extended
2. B) The cloud provider should have preserved the backups automatically upon legal hold
3. C) The backup rotation is a separate system and not subject to legal holds
4. D) Spoliation — IT received the hold notice but failed to suspend the automated backup rotation for held data within the required timeframe. The 3-day gap between notification and deletion was a process failure that destroyed potentially relevant evidence

Scenario 5

A data map created 18 months ago shows data in 20 cloud services. Since then, the organization added 5 new services, migrated 3 databases, and adopted 2 SaaS tools. The CISO uses the original data map for a compliance assessment. What is the consequence?

1. A) Data maps are not relevant to compliance assessments
2. B) The original map provides a valid baseline for the assessment
3. C) The stale data map means the compliance assessment will miss data in 10 additional services/locations. Findings based on the outdated map provide false assurance — compliance gaps in unmapped services will not be identified
4. D) The new services can be assessed separately without updating the map

Scenario 6

An organization uses client-side encryption with HYOK for maximum security. They later need the cloud provider's AI analytics service to generate insights from the encrypted data. The AI service cannot process the data. What is the fundamental issue?

1. A) Client-side encryption with HYOK means the provider never has access to plaintext data. Cloud-native services requiring data access (AI, analytics, search) cannot function. This is the inherent tradeoff between maximum security and cloud-native functionality
2. B) The organization should share their HYOK keys with the provider
3. C) The AI service needs a software update to support client-side encryption
4. D) The encryption algorithm is incompatible with AI processing

Scenario 7

Five administrators share a cloud root account. An attacker uses the root account to exfiltrate 500GB of customer data. Immutable audit logs show the root account performed the action but cannot identify which administrator (or the attacker) was responsible. What are the TWO failures?

1. A) The root account should have been disabled entirely, and the logs should have captured IP addresses
2. B) The audit logs failed by not capturing the individual's identity
3. C) Two failures: (1) shared accounts eliminate individual accountability — the action cannot be attributed to a specific person, and (2) lack of MFA on the root account may have allowed the attacker to use compromised credentials without a second factor
4. D) Only the shared account is a failure; the logs worked correctly

Scenario 8

A European company stores personal data with a cloud provider. The provider replicates to a US disaster recovery region without notifying the customer. No Standard Contractual Clauses or other transfer mechanisms are in place. The company discovers this during an audit. What is the compliance impact?

1. A) GDPR violation — personal data transferred to the US without proper legal mechanisms (SCCs, adequacy decisions, or other safeguards) violates cross-border transfer requirements regardless of the purpose. The company, as data controller, is accountable
2. B) The data is protected by the provider's encryption, making the transfer compliant
3. C) No impact — DR replication is exempt from transfer restrictions
4. D) Only the cloud provider faces regulatory consequences

Scenario 9

An organization classifies data at creation and applies labels. DLP enforces classification-based policies. IRM controls post-delivery access. Encryption protects data at rest and in transit. Audit logs provide traceability. What data state remains MOST vulnerable despite these controls?

1. A) Data in archive — long-term storage is always vulnerable
2. B) Data in use — when data is decrypted for processing, it exists in plaintext memory. Despite all other controls, data being actively processed is the most difficult state to protect and the most vulnerable to memory scraping, side-channel attacks, and insider access
3. C) Data at rest — encryption can be broken
4. D) Data in transit — TLS can be intercepted

Scenario 10

A forensic analyst needs to collect evidence from a cloud SaaS application. The SaaS provider says they cannot provide customer-specific data extracts due to multi-tenant architecture. No forensic cooperation clause exists in the contract. What is the consequence?

1. A) The analyst can compel the provider through a court order
2. B) Without a contractual forensic cooperation clause, the organization has no contractual mechanism to compel evidence collection. This should have been negotiated before contract signing. A court order is possible but slow, and the provider may still face technical limitations
3. C) The analyst should collect evidence from the organization's local systems instead
4. D) SaaS data cannot be used as forensic evidence regardless of contract terms

Scenario 11

A company uses envelope encryption with a cloud KMS. The KEK is rotated annually. After rotation, old data remains encrypted with DEKs that were encrypted by the old KEK. The old KEK is retained to decrypt old DEKs. A security assessor says this is acceptable. Is the assessor correct?

1. A) No — old KEKs should be destroyed immediately after rotation
2. B) No — all data must be re-encrypted with the new KEK immediately
3. C) Yes — but only if the old KEK is stored in an HSM
4. D) Yes — retaining old KEKs for decrypting old DEKs is standard practice for envelope encryption. Re-encrypting all DEKs with the new KEK is optional. New data uses new DEKs encrypted by the new KEK, and the old KEK is only used to decrypt, not encrypt

Scenario 12

A CSPM scan reveals 200 cloud storage resources. Of these, 15 have public access enabled. The security team wants to immediately make all 15 private. Three contain customer PII. Five are static website assets intentionally served publicly. Seven were created by a former employee for unknown purposes. What is the correct approach?

1. A) Make all 15 private immediately to eliminate the risk
2. B) Wait for the next change window to avoid disrupting services
3. C) Only address the 3 containing PII; the others are not a concern
4. D) Immediately restrict the 3 containing PII. Verify the 5 static website assets have appropriate content before confirming public access. Investigate the 7 unknown buckets before restricting, as they may support active services. Prioritize by data sensitivity

Scenario 13

An organization needs to comply with GDPR's right to erasure while also maintaining financial records for 7 years under banking regulations. A customer submits an erasure request. The customer has both personal profile data and financial transaction records. How should the organization respond?

1. A) Delete everything — GDPR takes precedence over banking regulations
2. B) Retain financial transaction data under the legal obligation exemption (GDPR Article 17(3)(b)). Delete personal profile data not required by banking regulations. Document the legal basis for retention and communicate the partial erasure to the customer
3. C) Retain everything for 7 years and deny the GDPR request entirely
4. D) Anonymize all data to satisfy both requirements simultaneously

Scenario 14

A cloud security assessment identifies that audit logs from production systems are stored in the same cloud account. An attacker who gains administrative access could delete the logs. The security team proposes encrypting the logs. Is encryption sufficient?

1. A) No — encryption protects confidentiality but not against deletion. Logs should be stored in a separate restricted account with immutable (write-once) storage, ensuring they cannot be modified or deleted even by administrators of the production account
2. B) No — but the current setup is acceptable if backups exist
3. C) Yes — encrypted logs cannot be deleted by an attacker
4. D) Yes — if the encryption keys are stored separately

Scenario 15

A development team stores API keys in environment variables within Docker container configurations committed to a private GitHub repository. A security scan flags this. The team argues the repository is private. Is the risk acceptable?

1. A) No — even private repositories have multiple access points (all developers, CI/CD systems, GitHub administrators). API keys should be stored in a dedicated secrets manager or KMS, not in any code repository, to enforce access control and enable rotation without code changes
2. B) Yes — as long as the keys are rotated monthly
3. C) Yes — private repositories are sufficiently secure for API keys
4. D) No — but only because Docker configurations might be shared

Scenario 16

An organization archives encrypted data with a 20-year retention requirement. The encryption keys are in the cloud provider's KMS. After 10 years, the provider announces the KMS service will be discontinued in 12 months. What is the immediate priority?

1. A) Export or migrate all encryption keys to an alternative KMS or on-premises HSM before the service is discontinued. If keys cannot be exported, re-encrypt all archived data with keys managed by a sustainable KMS solution within the 12-month window
2. B) The provider must maintain the KMS for the full retention period
3. C) Accept the risk — the provider will likely reverse their decision
4. D) Begin planning a migration to a new cloud provider

Scenario 17

A cloud data flow map shows that customer data flows from a web application through an API gateway, to microservices, then to a database, with copies going to a logging system, analytics pipeline, and disaster recovery site. DLP monitors only the API gateway. What is the coverage gap?

1. A) DLP at the API gateway misses data flows to the logging system, analytics pipeline, and DR site. Sensitive data may flow through these paths without DLP inspection. Comprehensive DLP requires monitoring at all data flow points, not just the primary entry point
2. B) The API gateway is the most critical monitoring point and is sufficient
3. C) DLP is not effective for microservices architectures
4. D) The database should be the primary DLP monitoring point instead

Scenario 18

A company discovers that data labeled 'Restricted' in their primary cloud storage loses its label when replicated to a disaster recovery region. DR copies are treated as unclassified by automated security controls. What is the impact?

1. A) DR copies do not need the same classification as primary data
2. B) The DR system should be configured to classify data independently
3. C) Restricted data in the DR region receives insufficient protection because automated controls rely on labels to enforce classification-based policies. Without labels, the DR copies may be accessible to unauthorized users and lack appropriate encryption, monitoring, and access controls
4. D) This is a minor operational issue with no security impact

Scenario 19

A user disputes a $50,000 cloud resource provisioning action. Audit logs show the action was digitally signed with the user's private key, from an authenticated session with MFA, at 2:14 PM from a corporate IP address. The user claims they were at lunch. What evidence supports non-repudiation?

1. A) Strong non-repudiation evidence: digital signature (binds action to private key), MFA-authenticated session (confirms possession of second factor), corporate IP (establishes network location), and immutable audit log (provides tamper-evident record). The user must prove key compromise to dispute
2. B) Only the digital signature, which could have been forged
3. C) Non-repudiation is impossible in digital systems
4. D) The timestamp alone is sufficient for non-repudiation

Scenario 20

An organization completes Domain 2 preparation and reviews their cloud data security posture. They have encryption at rest and in transit, DLP for storage and email, classification policies, and quarterly access reviews. What critical gaps remain?

1. A) DLP and encryption are sufficient; the other controls are optional
2. B) Multiple gaps: no DLP for SaaS data paths, no IRM for post-delivery control, no data flow map for complete visibility, no legal hold procedures, no data destruction verification process, and quarterly access reviews may be too infrequent for cloud environments
3. C) Only the lack of IRM is a significant gap
4. D) No gaps — this is a comprehensive data security posture

Domain 2 Readiness Checklist

Before moving to Domain 3, confirm you can confidently:

• Assign data roles (owner, custodian, controller, processor) in any cloud scenario
• Apply the data lifecycle phases and identify appropriate controls for each
• Map data flows across cloud services, regions, and providers
• Choose the right storage type for a given use case and secure it appropriately
• Select between encryption, tokenization, hashing, and masking for specific requirements
• Design DLP strategies that cover all data paths including SaaS and encrypted channels
• Implement classification, labeling, and mapping as an integrated system
• Apply IRM for persistent data protection beyond organizational boundaries
• Navigate conflicting retention, deletion, and legal hold requirements
• Establish auditability, traceability, and non-repudiation in cloud environments
• Maintain chain of custody for cloud-based digital evidence