Cloud Data Security practice questions

In the cloud data lifecycle, Create includes modifying existing content, not only generating new content.

The CSA definition of Create is the generation of new digital content or the alteration, updating or modifying of existing content. Use deliberately excludes modification. The tempting answer is Use, because the analyst is working with an existing file, but once the content changes the activity is Create, and the new version then needs the same classification and handling decisions as any new data.

1. Separate the actions: opening and reading versus changing values.
2. Recall that Use excludes modification.
3. Map alteration of content to Create.

Exam tip: Changing content is Create, not Use: modified data is new data.

Store, committing data to a storage repository, typically happens almost at the same time as Create.

Most data is written to a database, file or object store as soon as it exists. That is why protections for data at rest, such as encryption and access policies, must already be in force when the data is generated rather than added later. Archive is also storage, but it is the long-term phase after active use.

1. Picture where new data goes the instant it exists.
2. Recognize that is a repository: the Store phase.
3. Distinguish Store from Archive, which follows active use.

Exam tip: Create and Store are nearly simultaneous, so at-rest protection must exist before the first record.

Data acquired from outside the organization enters the receiving organization's lifecycle in the Create phase.

Create covers data that is generated, acquired or modified. Each organization has its own lifecycle for the data it holds: the broker shared the dataset, but for the retailer it is newly created data that needs an owner and a classification when it arrives. Only then can Store, Use and Share controls be matched to its sensitivity. Following the licence terms is necessary but does not replace the retailer's own handling decisions.

1. Ask whose lifecycle is being mapped: the retailer's.
2. Recall that acquiring data counts as Create.
3. Identify what Create requires: ownership and classification.
4. Note that Store and Use controls depend on those decisions.

Exam tip: Bought or received data starts at Create in your own lifecycle: own it and classify it on arrival.

Use is the phase in which data is viewed or processed without being modified.

The managers read records inside the application they are authorized for, without altering or passing them on. That is the Use phase. Controls typical of Use include access control and activity monitoring. Share would apply if the records were made available to an outside party, and Create if their content changed.

1. Check whether the content changes: it does not, so not Create.
2. Check whether anyone new is given the data: no, so not Share.
3. Reading or processing without change is Use.

Exam tip: Reading and processing without change is Use.

Share means making data accessible to other parties, whether or not the data physically moves.

The tempting answer is Use, because no data leaves the tenant. But the lifecycle defines Share by who can reach the data, not by where it sits: opening records to another organization's staff is sharing. That brings Share-phase controls into play, such as a data sharing agreement, least-privilege scope, monitoring of partner activity and prompt revocation when the relationship ends.

1. Identify who gains access: staff of another organization.
2. Recall that Share is about making data accessible to others.
3. Ignore the fact that the data stays in place: access, not location, decides.

Exam tip: Giving another party access is Share, even if the data never leaves your tenant.

Data sent to an external party is in the Share phase, which needs controls on the transfer and the recipient.

Use-phase controls such as role-based access and monitoring govern people working with data inside the platform. Once data is sent to another organization, it is shared: the matrix must cover the transfer (encryption and authentication of the API), the recipient (contract terms, permitted use, onward sharing) and data minimization. Mapping the feed as Use leaves exactly those controls out.

1. Notice the data leaves for an external administrator.
2. Map that to Share, not Use.
3. List what Share needs that Use does not: transfer and recipient controls.

Exam tip: Mis-mapping a phase drops its controls: an outbound feed is Share and needs transfer and recipient controls.