Task 4.5: Understand Data Privacy and Governance DEA-C01 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · medium

   A customer asks for a copy of their personal data in a structured, machine-readable format so they can transfer it to another service provider. Which data subject right is being exercised?

   • ARight to portability
   • BRight to rectification
   • CRight to access
   • DRight to erasure
   Reveal Solution Discussion Select an answer first
2. 22foundation · medium

   Which access control model allows permissions to be granted based on attributes such as job role, project, or data classification?

   • ARole-based access control (RBAC)
   • BMandatory access control (MAC)
   • CDiscretionary access control (DAC)
   • DAttribute-based access control (ABAC)
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A software company needs to provide realistic test data to developers for a new feature. The test environment should not contain real customer PII. Which technique should they use to create the test data?

   • AUse AWS Glue to copy the production data to the test environment and rely on IAM policies to restrict access.
   • BTokenize the production data and provide the tokenization key to the developers.
   • CGenerate synthetic data that mimics the statistical properties of the production data without using actual customer records.
   • DEncrypt the production data with AWS KMS and copy the encrypted data to the test environment.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   Which data classification level is typically used for data that, if disclosed, could cause serious harm to an organization or individuals, such as health records or financial account numbers?

   • AConfidential
   • BPublic
   • CRestricted
   • DInternal
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A data engineering team is planning to build a new data pipeline that will process customer data from a new marketing campaign. Before implementation, the team must identify potential privacy risks and document how they will mitigate them. Which activity should the team perform?

   • AImplement data masking on all customer data before loading it into the pipeline.
   • BCreate a data classification policy that labels all customer data as 'Confidential'.
   • CSet up AWS CloudTrail to log all access to the pipeline resources.
   • DConduct a privacy impact assessment (PIA) to evaluate the data processing activities and document risks and mitigations.
   Reveal Solution Discussion Select an answer first