Explain Data Privacy Concerns Related to Storage and Transmission of Data 350-901 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A global company processes credit card payments for customers in multiple countries. The company stores cardholder data in a database and transmits it to a payment processor. The company must comply with PCI DSS. The security team is designing the data flow and storage architecture. Which combination of measures is required for PCI DSS compliance?

   • ATokenize cardholder data and store the tokens in the database, but keep the original data in a separate, unencrypted file.
   • BEncrypt cardholder data only during transmission, but store it in plaintext to reduce complexity.
   • CEncrypt cardholder data at rest and in transit, and restrict access to cardholder data on a need-to-know basis.
   • DUse a firewall to protect the database and rely on the payment processor to secure the data.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which triad of principles forms the foundation of data privacy and security for application data?

   • AConfidentiality, integrity, and availability
   • BEncryption, hashing, and masking
   • CAuthentication, authorization, and accounting
   • DPrevention, detection, and response
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team is building a new customer relationship management (CRM) system. The product owner wants to collect extensive personal data, including social security numbers, to personalize the user experience. The company operates in a jurisdiction with strict data protection regulations. The development team wants to follow privacy by design principles. What should they do?

   • ADefer privacy decisions until after the system is deployed.
   • BObtain explicit consent from users for collecting all data.
   • CCollect all requested data and encrypt it to ensure compliance.
   • DCollect only the personal data that is necessary for the core functionality of the CRM.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the main purpose of data masking in non-production environments?

   • ATo ensure data is available during transmission
   • BTo reduce storage costs
   • CTo encrypt data at rest
   • DTo protect sensitive data while allowing realistic testing
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company stores customer data in a cloud object storage service. The data is encrypted at rest using server-side encryption. The security team discovers that a former employee's access key is still valid and can read the data. The company wants to prevent unauthorized access while maintaining the ability to audit access. What should they do?

   • AChange the encryption key for the storage service.
   • BRevoke the former employee's access key and enable access logging on the storage service.
   • CDisable the storage service temporarily and then re-enable it.
   • DMove the data to a different storage service.
   Reveal Solution Discussion Select an answer first