Data Security, Privacy, and Protection in Cloud Environments
What this domain tests
Data Security, Privacy, and Protection in Cloud Environments tests classification, encryption, key management, privacy obligations, and data lifecycle. Expect scenarios on residency, deletion, tokenization, DLP, and who controls cryptographic keys.
Core rules and concepts
- Classify data first; controls follow sensitivity, regulatory scope, and contractual commitments. Labeling enables access policy, DLP, retention, and incident prioritization.
- Encrypt in transit with TLS and at rest with provider or customer-managed keys. Encryption is not access control: a user with read permission and key access can still exfiltrate data.
- Key custody matters. Provider-managed keys reduce operational burden; customer-managed keys (BYOK) improve separation and revocation; HYOK keeps key material outside the provider but complicates availability and search.
- Privacy principles include purpose limitation, minimization, lawful basis, subject rights, and cross-border transfer mechanisms. Data residency is where data is stored; jurisdiction is which laws apply, and they are not identical.
- Deletion must cover backups, replicas, caches, and logs. Crypto-shredding destroys keys to make ciphertext unrecoverable, but only if key deletion is complete and auditable.
Worked example
A SaaS provider serves EU tenants and requires tenant-specific revocation. Encrypt each tenant's data with a per-tenant customer-managed key in a regional KMS. Store key policy so only that tenant's workload role and the security admin can use it. On offboarding, disable the key, verify backups and replicas use the same key hierarchy, then schedule destruction under retention policy. The reasoning is that separation of keys limits blast radius and supports verifiable deletion, but the provider must still enforce application-level authorization.
Traps that cost marks
- Assuming encryption satisfies access-control or privacy requirements by itself.
- Forgetting backups, snapshots, analytics copies, and logs in scope.
- Confusing data location with legal jurisdiction.
- Letting one key protect all tenants or all environments.
- Promising deletion without addressing replicas and immutable backups.