Governance and Compliance DS0-001 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company that processes credit card transactions must ensure that cardholder data is not retained longer than necessary. Which practice aligns with PCI DSS requirements?

   • AStore cardholder data in an encrypted format and retain it indefinitely.
   • BArchive cardholder data to tape and store it offsite.
   • CDefine a retention period for cardholder data and securely delete it after that period.
   • DRetain cardholder data for as long as the customer remains a client.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company that operates in the EU and the US stores customer data in a database. The EU customers have the right to request deletion of their data. However, the US legal team requires that certain data be retained for potential litigation. What is the best approach to reconcile these requirements?

   • AMove all EU customer data to a separate database and delete it after one year.
   • BRetain all data indefinitely to avoid any legal risk.
   • CDelete all EU customer data immediately upon request, regardless of legal holds.
   • DImplement a legal hold process that preserves data subject to litigation while honoring deletion requests for other data.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company stores EU citizens' personal data in a database hosted in the United States. To comply with GDPR, what must the company ensure?

   • AThe data must be stored only in EU data centers.
   • BThe company must obtain consent from each data subject for the transfer.
   • CThe company must have a legal basis for the transfer, such as Standard Contractual Clauses (SCCs).
   • DThe data must be encrypted at rest and in transit.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A European marketing firm collects customer email addresses for newsletters. A customer requests that their data be deleted. The firm has a legal obligation to retain the email address for tax purposes for six years. What should the firm do?

   • ASuppress the email address for marketing purposes but retain it for the required tax period.
   • BDelete the email address immediately and document the request.
   • CAnonymize the email address immediately and keep the rest of the customer record.
   • DRefuse the deletion request because the data is needed for marketing.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A database administrator is tasked with implementing a data loss prevention strategy for a database that contains sensitive customer data. The company has a retention policy that requires data to be kept for five years. The DBA must ensure that data is not accidentally deleted before the retention period ends, but also that it is securely deleted after five years. Which approach best meets both requirements?

   • AImplement a data retention policy that uses database features to archive data after five years and then purge it.
   • BImplement a backup strategy that retains backups for five years and then deletes them.
   • CUse database triggers to prevent any DELETE operations on the sensitive tables.
   • DGrant all users write access to the database so they can manage data as needed.
   Reveal Solution Discussion Select an answer first