Governance and Compliance DS0-001 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a core requirement of the General Data Protection Regulation (GDPR) for organizations that process personal data?

   • AObtaining explicit consent from data subjects before processing their personal data.
   • BAppointing a Data Protection Officer (DPO) for every organization that processes personal data.
   • CStoring all personal data on servers located within the European Union.
   • DEncrypting all personal data with a minimum of 256-bit AES encryption.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A payment processor is required to retain transaction logs for fraud investigation. However, the logs contain cardholder data. What is the best approach to balance retention and PCI DSS compliance?

   • ARetain the logs indefinitely for future investigations.
   • BStore the logs in a separate database that is not connected to the network.
   • CRetain the logs for as long as needed for fraud investigation, but encrypt them.
   • DRemove cardholder data from the logs and retain only the transaction metadata.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of a data retention policy in an organization?

   • ATo maximize storage capacity by keeping all data indefinitely.
   • BTo ensure data is kept only as long as necessary for legal, regulatory, and operational needs.
   • CTo define the encryption algorithms used for data at rest.
   • DTo provide real-time replication of data to a secondary site.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An e-commerce company processes orders from EU customers. Their current policy retains customer order data indefinitely. The data protection officer (DPO) has flagged that this conflicts with GDPR requirements. Which action best aligns the retention practice with GDPR?

   • ARetain order data for a defined period required by tax law, then anonymize or delete it.
   • BMove all customer data to a backup server that is not accessible to the application.
   • CDelete all customer data after 30 days regardless of order status.
   • DContinue indefinite retention but restrict access to the data to the DPO only.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company processes credit card payments and stores cardholder data in a database for analytics. To reduce the scope of PCI DSS compliance, which approach should they adopt?

   • ARestrict database access to only the payment processing team.
   • BTokenize cardholder data and store only the token, with the actual card data held by a third-party processor.
   • CEncrypt the cardholder data in the database using strong encryption.
   • DUse a firewall to isolate the database from the rest of the network.
   Reveal Solution Discussion Select an answer first