What is the principle of 'data minimization' in the context of Privacy by Design?

Collecting only the data that is necessary for the intended purpose

Sharing data only with authorized third parties

Storing data for the shortest possible time

Encrypting all data at rest and in transit

A company's web application uses a third-party API to process payments. The API is accessed over the internet. The company wants to ensure that the payment data is protected from man-in-the-middle attacks. The API provider supports both TLS and IPsec. Which option should the company choose?

Use both TLS and IPsec simultaneously.

Use TLS for the API communication.

Use a custom encryption scheme in the application layer.

Use IPsec for the API communication.

Which practice is essential for the security of encryption keys used to protect data at rest?

Storing keys separately from the encrypted data

Using the same key for all data

Storing keys in the same database as the encrypted data

Sharing keys with all authorized users

A small business stores customer data in a spreadsheet on a shared network drive. The spreadsheet contains customer names, addresses, and credit card numbers. The business wants to reduce the risk of unauthorized access to this data. Which action would be most effective?

Password-protect the spreadsheet and share the password with all employees.

Encrypt the spreadsheet with a strong password and store the password in a shared document.

Move the data to a database with role-based access controls and encryption at rest.

Store the spreadsheet in a cloud storage service with a shared link.

A developer is building a web application that allows users to upload sensitive documents. The application runs on a server that uses HTTP. The developer wants to ensure that the documents are protected during transmission from the client to the server. What should the developer configure?

Use a VPN between the client and the server.

Encrypt the documents with a password before upload.

Use a secure file transfer protocol like SFTP.

Enable TLS on the web server and use HTTPS for all uploads.

CiscoCertified DevNet Professional

Domain 4Objective 7

Explain Data Privacy Concerns Related to Storage and Transmission of Data 350-901 Practice Questions (Page 4)

Part of the 4.0 Application Deployment and Security domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

20%of the exam

Questions 16–20

16foundation · easy
What is the principle of 'data minimization' in the context of Privacy by Design?
Select an answer first
17expert · hard
A company's web application uses a third-party API to process payments. The API is accessed over the internet. The company wants to ensure that the payment data is protected from man-in-the-middle attacks. The API provider supports both TLS and IPsec. Which option should the company choose?
Select an answer first
18foundation · easy
Which practice is essential for the security of encryption keys used to protect data at rest?
Select an answer first
19application · medium
A small business stores customer data in a spreadsheet on a shared network drive. The spreadsheet contains customer names, addresses, and credit card numbers. The business wants to reduce the risk of unauthorized access to this data. Which action would be most effective?
Select an answer first
20application · medium
A developer is building a web application that allows users to upload sensitive documents. The application runs on a server that uses HTTP. The developer wants to ensure that the documents are protected during transmission from the client to the server. What should the developer configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.