Exam SY0-601 topic 1 question 186 discussion

It seems like every question that is regarding cloud security has CASB as the answer

TLS cannot protect stored data, CASB can

TLS is used to protect data in transit, not at rest. VPN would provide a secure tunnel between 2 endpoints by encrypting data but this wouldn't prevent the cloud provider from viewing the credit card information once the data arrives at the destination point. Plus a VPN doesn't provide any sort of obfuscation or masking of sensitive data. WAF is used to filter traffic, it has nothing to do with tokenization. CASB (cloud access security broker) is the correct answer. In the context of CASB, tokenization refers to a method of data protection used to safeguard sensitive information stored in cloud applications by generating tokens that replace the original data with meaningless data for the attacker. The tokens are then mapped to a lookup table for data retrieval.

A CASB can help the company tokenize credit card data before sending it to the cloud provider, and also prevent unauthorized access or leakage of the tokenized data.

B Options A (WAF - Web Application Firewall), C (VPN - Virtual Private Network), and D (TLS - Transport Layer Security) are important security measures but are not specifically designed to tokenize or control access to credit card data in a cloud environment. CASB is a more appropriate choice for addressing the specific requirements mentioned in the scenario.

B. CASB

https://www.netskope.com/security-defined/what-is-casb What are the Top Three Uses for CASBs? Protect and prevent the loss of sensitive data across all of the cloud services in your environment, not just the ones you sanction. Take advantage of advanced, enterprise DLP to discover and protect sensitive data in sanctioned cloud services and en route to or from any cloud service, sanctioned or unsanctioned, whether users are on-premises or remote, on a mobile device or accessing from a web browser, or entering from a mobile app or sync client. Combat loss of data with encryption, tokenization, or upload prevention.

Just by process of elimination (knowing why incorrect answers are incorrect) A,C, & D deal with data in transit. So the obvious, lesser of all evils answer, is B.

You're overthinking it all. Keyword is WEBSITE = HTTPS = TLS "A company is moving its retail website to a public cloud provider. The company wants to tokenize credit card data but not allow the cloud provider to see the stored credit card information." D / TLS which is the S in HTTPS, prevents anyone from seeing data in the clear. The database with the information wouldn't be on the website, it would be tokenized and in the database for the company and retailers anyway.

A CASB is a security solution that sits between an organization's on-premises infrastructure and the cloud provider's infrastructure. It acts as a gatekeeper, providing security and visibility into cloud-based applications and services. CASBs can enforce security policies, monitor cloud usage, and provide data protection capabilities. The specific capability that would meet the objective of tokenizing credit card data while keeping it secure from the cloud provider is called "Tokenization." Tokenization is a data security technique where sensitive data, such as credit card numbers, is replaced with randomly generated tokens. These tokens have no meaningful value and are useless to anyone who does not have access to the tokenization system's mapping table. The tokenization process occurs before the data is sent to the cloud provider, ensuring that the provider only deals with meaningless tokens and not the actual credit card data.

Can I just ask who comes up with the "official answers" for these questions? The difference between those and the opinion of majority of this communicty attacks 50%...

A CASB uses encryption for data-at-rest and data-in-transit to stay compliant and secure data.

Why is everyone selecting CASB? The retailer is moving the data to the cloud and TLS would encrypt that data in transit. If the data was already in place, CASB seems appropriate.

B. CASB (Cloud Access Security Broker) would BEST meet the objectives of tokenizing credit card data and not allowing the cloud provider to see the stored credit card information. CASBs are security software that sits between an organization's on-premises infrastructure and a cloud provider's infrastructure, providing security policies and controls for cloud-based resources. By implementing a CASB, the company can tokenize credit card data before it is stored in the public cloud provider's environment. The CASB can encrypt the data before it is uploaded to the cloud, so the cloud provider cannot see the original data. The CASB can also enforce data loss prevention (DLP) policies, preventing unauthorized access to sensitive data, such as credit card information.

A. A WAF is used to secure web applications by monitoring and blocking malicious traffic. However, it does not offer a secure solution for storing sensitive data like credit card information. B. A CASB is a security solution that sits between a cloud provider and an organization, providing security and visibility into cloud usage. However, it does not specifically address the requirement of tokenizing credit card data and not allowing the cloud provider to see the information. C. A VPN provides a secure connection to the cloud provider, but it does not solve the issue of credit card data security. D. TLS (Transport Layer Security) - TLS is a protocol used to encrypt network traffic and ensure that the data is secure during transmission. This solution is useful for ensuring the security of data in transit, but it does not provide a secure solution for storing sensitive information like credit card data.

I think people here miss the mark by a long shot. For tokenization you need to have the database where tokens are reffered to the actual CC information. While the retail store can be hosted on the cloud, the CC-Token database should not be on the cloud. I think the only reasonable solution that would provide confidentiality from the Client, trough the cloud and then to the company itself, where the check can be made is trough TLS. TBH I'm not entirely sure, since this is a confusing question, but I do not believe CASB to be the correct answer.

CASBs have become a vital part of enterprise security, allowing businesses to safely use the cloud while protecting sensitive corporate data. https://www.skyhighsecurity.com/en-us/cybersecurity-defined/what-is-a-casb.html