2.13 Apply the Concepts of Data Loss, Data Leakage, Data in Motion, Data in Use, and Data at Rest Based on Common Standards 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A global company processes credit card data for customers in the EU and the US. They must comply with both PCI DSS and GDPR. They store cardholder data in a database and transmit it to a payment processor. Which control is required by BOTH standards?

   • AObtain explicit consent for data processing.
   • BImplement multi-factor authentication for all system access.
   • CEncrypt cardholder data at rest.
   • DConduct a Data Protection Impact Assessment (DPIA).
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A security analyst discovers that a database backup file was accidentally deleted from a storage array, and the organization has no recoverable copy. Which term best describes this incident?

   • AData corruption
   • BData exfiltration
   • CData leakage
   • DData loss
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is implementing protections for customer PII stored in a database and accessed by internal applications. The database is on a private network, and the applications connect over the internal network. Which control is most appropriate to protect the data while it is being read by the applications?

   • AEncrypt the database files with AES-256
   • BApply row-level security to the database
   • CUse TLS for application-to-database connections
   • DEnable database audit logging
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An employee at a financial firm is working on a spreadsheet containing customer account numbers. The file is stored on an encrypted corporate share, and the employee is currently editing it on their workstation. While editing, the employee accidentally sends the file as an email attachment to a personal address. Which data state was the file in when it was sent?

   • AData at rest
   • BData in motion
   • CData in use
   • DData leakage
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A financial services company must protect customer data in a database that is accessed by internal applications and also replicated to a disaster recovery site over a WAN link. The company must comply with PCI DSS. The database is encrypted at rest, but the replication traffic is not encrypted. Which additional control is required to meet PCI DSS requirements?

   • AImplement stronger access controls on the database
   • BEncrypt the replication traffic using TLS or IPsec
   • CEnable database audit logging
   • DUse a dedicated WAN link instead of the internet
   Reveal Solution Discussion Select an answer first