Cloud Data Security

An organisation wants to move a dataset outside the scope of data protection law by processing it so that no individual can be re-identified, even by combining it with other data the organisation holds. Which outcome distinguishes this approach from pseudonymisation?

• AAnonymisation encrypts the identifying fields with a customer-managed key, so the data can be restored by anyone holding that key
• BAnonymisation irreversibly removes the link to any individual, so the data is no longer personal data; pseudonymisation only replaces identifiers while a re-identification key still existscheck_circle Correct
• CAnonymisation replaces direct identifiers with consistent tokens so records can still be joined across datasets on the token
• DAnonymisation masks the data only in non-production copies while production retains the original values

Why A is wrong: This describes a reversible, key-based transformation, which is closer to encryption or pseudonymisation; genuine anonymisation leaves no key that can restore identity.

Why B is correct: True anonymisation destroys the ability to re-identify, taking the data out of scope, whereas pseudonymised data remains personal data because a separately held key can restore the link, which is the defining difference.

Why C is wrong: Consistent tokens that allow joining preserve a re-identification path through linkage, which is pseudonymisation, not anonymisation, so this fails the no-re-identification test.

Why D is wrong: Environment-specific masking of copies is a de-identification control for test data, not a property of anonymisation, and it leaves fully identifiable production data in scope.

Under a bring your own key (BYOK) arrangement with a cloud provider, which statement best describes where control and residual risk sit?

• AThe customer generates and retains the only copy of the key, so the provider can never load it into its key management service for cryptographic operations
• BThe provider generates the key and the customer merely receives a copy for their records, so the customer holds no lifecycle control
• CKey material stays entirely on the customer's premises and every encryption call is proxied back to the customer data centre in real time
• DThe customer supplies the key material to the provider's managed key service, gaining control over key lifecycle while accepting that the provider's platform still performs the cryptographic operationscheck_circle Correct

Why A is wrong: This describes hold your own key or fully external key custody; standard BYOK imports the customer key material into the provider service, so the claim that the provider can never use it is incorrect.

Why B is wrong: This is provider-managed encryption, the model BYOK exists to move away from; the defining feature of BYOK is that the customer originates the key material, not that they receive a copy.

Why C is wrong: Continuously proxying each operation to on-premises infrastructure describes an external key store pattern, not BYOK, and it misstates where the cryptographic work happens in a normal BYOK setup.

Why D is correct: BYOK lets the customer originate and govern the key material and its lifecycle, but the provider's KMS uses that key to encrypt and decrypt, so residual trust in the platform remains, which accurately frames the control and risk split.

A finance team wants a cloud provider to run aggregate calculations directly on encrypted salary figures and return an encrypted total, without the provider ever decrypting the individual values. Which technology is designed to make this possible?

• ATransparent data encryption on the database volume, so the figures are protected at rest
• BTokenisation of each salary figure before the provider performs the sum on the tokens
• CHomomorphic encryption, which permits defined computations on ciphertext and yields an encrypted result that decrypts to the correct answercheck_circle Correct
• DA hardware security module that stores the encryption keys separately from the data

Why A is wrong: Transparent data encryption protects data at rest but the engine decrypts values in memory before any computation, so the provider would still see cleartext during processing.

Why B is wrong: Tokens carry no arithmetic relationship to the originals, so summing them produces a meaningless result; tokenisation supports substitution, not computation on protected values.

Why C is correct: Homomorphic encryption is specifically constructed so that operations performed on ciphertext correspond to operations on the plaintext, letting the provider compute an encrypted total it can never read, which is exactly the requirement.

Why D is wrong: An HSM safeguards keys but does not let arithmetic run on ciphertext; the data would still have to be decrypted somewhere before the total could be computed.

A SaaS provider stores customer records in a multi-tenant managed database where the underlying storage hardware is fully controlled by the cloud provider and cannot be physically accessed or degaussed by the customer. When a retention period expires and the data must be rendered unrecoverable, which technique is the most appropriate for assured destruction in this environment?

• ACrypto-shredding by destroying the encryption keys that protect the target datacheck_circle Correct
• BPhysical degaussing of the underlying drives that hold the tenant's records
• CA single-pass overwrite of the logical database rows containing the records
• DApplying data masking to the fields so the values are no longer readable

Why A is correct: With no physical media access, destroying the keys makes the ciphertext permanently unrecoverable, which is the recognised cloud method for assured destruction.

Why B is wrong: Degaussing is a valid media-sanitisation method on owned hardware, but in shared managed storage the customer has no physical access, so it cannot be performed.

Why C is wrong: Overwriting seems thorough, but on abstracted multi-tenant storage the customer cannot guarantee the physical blocks are reached, and copies may remain in replicas or snapshots.

Why D is wrong: Masking obscures values for use or display but leaves the underlying data intact, so it does not satisfy a requirement to render the data unrecoverable.

A security architect wants to distinguish Information Rights Management (IRM) from ordinary data loss prevention (DLP) when protecting sensitive documents. Which characteristic is distinctive of IRM rather than DLP?

• AIt enforces granular usage rights such as view, edit, print and forward on the document itself, continuing to apply them after distribution.check_circle Correct
• BIt inspects traffic at network egress points and blocks files that match sensitive content patterns before they leave the perimeter.
• CIt classifies data by scanning repositories and tagging files according to sensitivity so that policies can later be applied.
• DIt encrypts an entire storage volume so that data at rest is unreadable if the underlying disks are stolen.

Why A is correct: Fine-grained usage rights embedded in and enforced by the document after it is shared are the hallmark of IRM, which controls what an authorised recipient may do, not merely whether the file moves.

Why B is wrong: Content inspection at egress is the classic DLP function; it acts at a boundary and does not control the file once it has passed, so it is not the IRM-distinctive trait.

Why C is wrong: Discovery and classification are precursors used by many controls including DLP; tagging alone does not enforce ongoing usage rights, so it does not define IRM.

Why D is wrong: Full-volume encryption protects data at rest against physical theft but grants no per-user usage control once a file is opened, so it is not what makes IRM distinctive.