Describe Data Security Elements, AAA, and GRC DATA-PROTECTION-MANAGEMENT-FOUNDATIONS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of compliance in data protection?

   • ATo eliminate all security risks
   • BTo reduce the cost of data storage
   • CTo ensure that the organization adheres to legal, regulatory, and industry standards
   • DTo maximize the performance of data storage systems
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A government agency is implementing a data governance program. They need to establish clear policies for data classification, retention, and access, and assign accountability for data stewardship. They also want to ensure these policies align with legal requirements. Which concept is primarily being applied?

   • AGovernance
   • BAccounting
   • CCompliance
   • DRisk Management
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of authentication in a data protection environment?

   • ATo encrypt data at rest and in transit
   • BTo verify the identity of a user or system before granting access
   • CTo track and log user activities for auditing purposes
   • DTo determine what resources a user is allowed to access
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial firm is implementing a new access control system for its trading platform. They want to ensure that only employees with a valid security badge can log in, and once logged in, they can only access the trading functions their role permits. Additionally, the firm must keep a log of all login attempts and trades for regulatory audits. Which AAA components are being used in this scenario?

   • AAuthentication and accounting
   • BAuthorization and accounting
   • CAuthentication and authorization
   • DAuthentication, authorization, and accounting
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A global company is subject to GDPR and must comply with data subject access requests (DSARs). They also have a data retention policy that requires deleting customer data after 5 years. A customer submits a DSAR, and the company finds that the data is 4 years old. They must provide the data to the customer, but they are also required to delete it in 1 year. How should the company handle this situation?

   • AProvide the data and ask the customer to confirm the deletion date
   • BProvide the data to the customer and continue to retain it until the 5-year retention period expires
   • CDeny the DSAR because the data is scheduled for deletion in 1 year
   • DProvide the data and immediately delete it after fulfilling the request
   Reveal Solution Discussion Select an answer first