Domain 2 – Section A Review: Data Fundamentals

This section review tests your ability to apply concepts from the preceding modules to realistic exam scenarios. Work through each question, commit to an answer, then reveal the reasoning. Focus on understanding WHY the correct answer is right and why the distractors are wrong.

Scenario 1

A SaaS provider's terms of service claim ownership of all data uploaded to their platform. The customer's legal team discovers this during a contract review. What is the fundamental issue?

1. A) SaaS providers typically own all uploaded data per industry standard
2. B) Data ownership belongs to the data creator/collector (the customer). Terms claiming provider ownership conflict with the fundamental principle that data ownership does not transfer when data is processed in the cloud
3. C) The terms only apply to metadata, not actual customer data
4. D) Ownership terms are unenforceable in cloud contracts

Scenario 2

A cloud provider replicates customer data across three regions for availability. The customer requests data deletion and receives confirmation that the primary region data is deleted. What remains unaddressed?

1. A) The other regions will auto-delete through eventual consistency
2. B) Data copies in the other two regions, plus backup snapshots, CDN caches, and log files across all regions remain unaddressed. Complete deletion requires confirming all copies are removed or rendered unrecoverable
3. C) Only regulated data needs deletion from backup copies
4. D) Nothing — primary deletion is sufficient for compliance

Scenario 3

A company migrates 10TB of medical imaging to cloud storage. They select high-performance block storage for the archive. An architect suggests object storage with an archive tier instead. Who is correct?

1. A) The original choice — block storage ensures the fastest retrieval
2. B) Both are equivalent for this use case
3. C) Neither — file storage with NFS is most appropriate for medical images
4. D) The architect — medical imaging archives are write-once, rarely accessed, unstructured data that is ideally suited for object storage with archive/cold tier, providing massive cost savings over block storage

Scenario 4

During data flow mapping, a security team discovers that internal microservices communicate over unencrypted HTTP within a cloud VPC. The team lead argues encryption is unnecessary inside the VPC. A breach through a compromised microservice later exposes inter-service traffic. What lesson does this illustrate?

1. A) Only traffic crossing VPC boundaries needs encryption
2. B) Internal cloud traffic must be encrypted because VPCs share physical infrastructure. A compromised service can capture unencrypted traffic from other services within the same VPC. Defense in depth requires encryption everywhere
3. C) The breach was caused by the compromised microservice, not the lack of encryption
4. D) VPCs are inherently insecure and should not be used

Scenario 5

A GDPR data controller uses a cloud processor. The processor subcontracts to a sub-processor in a country without an EU adequacy decision. No Standard Contractual Clauses are in place. What is the compliance status?

1. A) Compliant — the processor handles all GDPR obligations
2. B) Non-compliant — personal data is being transferred to a third country without a legal transfer mechanism. The controller is accountable for ensuring all processors and sub-processors have appropriate safeguards
3. C) Non-compliant — but only the sub-processor faces regulatory consequences
4. D) Compliant — sub-processors are not covered by GDPR transfer restrictions

Scenario 6

API credentials for a cloud storage service are found in a public GitHub repository. The credentials were committed 3 hours ago and the commit has since been deleted. What is the immediate response?

1. A) Immediately rotate the compromised credentials. Automated scrapers continuously monitor public repositories and may have captured the credentials within seconds of the commit. Git history deletion does not guarantee the credentials were not harvested
2. B) No action needed — the commit was deleted
3. C) Monitor the cloud account for unusual activity before taking action
4. D) Contact GitHub to permanently purge the commit from their servers

Scenario 7

A company classifies data into four levels but stores all levels in the same cloud storage bucket with the same access controls and encryption settings. What is the fundamental problem?

1. A) Classification without differentiated controls is meaningless. If all data receives the same protection regardless of classification, there is no practical benefit from classifying. Controls must be tiered to match classification levels
2. B) Uniform storage simplifies management and reduces costs
3. C) The four-level classification scheme is too complex
4. D) Cloud storage does not support differentiated access controls

Scenario 8

A cloud architect discovers that the CDN caching their web application is storing personalized content containing user preferences and account details in edge nodes across 40 countries. This was not in the original data flow assessment. What is the impact?

1. A) Edge nodes automatically comply with local data protection laws
2. B) The data flow assessment is incomplete. Personalized content in CDN edge nodes creates data residency exposure in 40 countries, potentially violating privacy regulations. The CDN caching policy must be reviewed and the data map updated
3. C) CDNs are exempt from data residency requirements
4. D) Only the origin server data is subject to privacy regulations

Scenario 9

An organization discovers that cloud storage buckets have been publicly accessible for 8 months. The buckets were created by a developer for a short-term project and forgotten. Three of the buckets contain customer PII. What controls should prevent this?

1. A) Preventive controls: organization-wide policies blocking public access by default. Detective controls: CSPM tools scanning for misconfigurations. Governance controls: resource tagging requirements and regular access reviews
2. B) Encrypting all bucket contents, which makes public access irrelevant
3. C) Requiring developers to use private buckets manually
4. D) Better developer training on security best practices

Scenario 10

A company uses provider-managed encryption for cloud storage. A security assessor warns about provider insider threats. The company argues that the provider's background checks are sufficient. What is the gap?

1. A) Adding network encryption addresses the insider threat
2. B) Background checks adequately address insider threats for cloud providers
3. C) Provider-managed keys mean provider employees can theoretically access decryption capabilities. Customer-managed or customer-provided keys ensure only the customer can decrypt data, providing technical protection against provider insider threats rather than relying solely on personnel controls
4. D) Provider insider threats are theoretical and do not warrant additional controls