4.3 - Immutability and object lock
Cloud+ CV0-004 objective 4.3 covers immutability for protecting records and backups from tampering or ransomware. An object lock keeps a compliance record unchangeable and undeletable until a fixed retention date, making the object immutable. Setting a bucket so objects cannot be overwritten or deleted for a period, such as seven years, meets a regulatory retention requirement. Object lock has two modes. In governance mode, users with a special privilege can override or shorten the lock, giving flexibility. In compliance mode, no one - not even the root account - can delete or alter the object before the retention period ends; so if a compliance-mode lock is set for five years and an admin tries to delete after two years, the delete is denied. Expect scenario questions that describe a retention requirement or an attempted deletion and ask which mode or concept applies.
Record locked, unchangeable/undeletable until a date = object lock (immutable). Privileged users can override = governance mode. No one can delete before retention ends (root included) = compliance mode.
Practice questions
1. Encrypting stored volumes so data is unreadable if the media is stolen provides:
- Encryption in transit
- Encryption at rest (correct answer)
- Data masking
- Load balancing
Encryption at rest protects stored data (disks, snapshots, buckets) against physical theft. Encryption in transit (TLS) protects data moving over the network.
2. A managed service that generates, stores and rotates encryption keys for cloud resources is a:
- WAF
- CASB
- KMS (correct answer)
- IDS
A KMS (Key Management Service) creates, stores and rotates keys, integrating with services for encryption at rest. An HSM is the hardware that can back a KMS with tamper resistance.
3. Periodically replacing an encryption key with a new one while keeping data readable is called:
- Key escrow
- Key rotation (correct answer)
- Key pinning
- Key splitting
Key rotation regularly replaces keys to limit exposure if one is compromised, re-encrypting or re-wrapping data as needed. Key escrow stores a copy for recovery, a different control.
4. A digital certificate presented during a TLS handshake mainly lets the client:
- Compress the outbound traffic
- Verify the server's identity (correct answer)
- Cache the origin response
- Balance backend load
During TLS the server's certificate, signed by a trusted CA, proves the server's identity and carries its public key to set up encryption. It does not compress or cache traffic.
5. A tamper-resistant hardware device that generates and guards cryptographic keys is a:
- CASB
- WAF
- HSM (correct answer)
- IDS
An HSM (hardware security module) generates, stores and uses keys inside tamper-resistant hardware so the private key never leaves it, meeting strict compliance. A CASB brokers SaaS access.
6. Encrypting data with a data key that is itself encrypted by a master key describes:
- Envelope encryption (correct answer)
- Certificate pinning
- Perfect forward secrecy
- Password hashing
Envelope encryption encrypts data with a data key, then encrypts that data key with a master key in a KMS, so only the small master key needs tight protection and rotation. Pinning is unrelated.