Design Data Centric Zero Trust ZERO-TRUST-DESIGN Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In an attribute-based access control (ABAC) policy, what does 'context' typically include?

   • AThe user's job title and department
   • BThe data classification level
   • CThe time of day, location, and device posture
   • DThe user's password and authentication method
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A law firm must retain client case files for seven years after case closure due to regulatory requirements, but must ensure that no data is retained beyond that period. They are implementing a data-centric Zero Trust strategy. Which lifecycle policy should they implement?

   • AStore all case files in an immutable storage account and never delete them to avoid any risk of premature deletion.
   • BManually review and delete case files every year to ensure compliance, with no automated policies.
   • CEncrypt all case files and rely on the encryption key expiration to effectively delete the data after seven years.
   • DApply a retention label to all case files that automatically deletes them after seven years, and use a legal hold to preserve files involved in active litigation.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is implementing Zero Trust data lifecycle management. They have a requirement to retain financial records for 10 years, but they want to minimize the storage cost and ensure that data is not retained longer than necessary. Which approach should they take?

   • AStore all financial records in a hot storage tier for the entire 10-year period to ensure fast access.
   • BEncrypt the financial records and store them in an immutable storage account to prevent any modification or deletion.
   • CUse a tiered storage strategy that moves data to cooler storage as it ages, and apply a retention policy that automatically deletes the data after 10 years.
   • DManually review and delete financial records every year to ensure compliance.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is designing Zero Trust for data at rest. They have a mix of structured data in databases and unstructured data in file shares. They need to protect both types of data, but they also need to maintain the ability to search and index the data for business purposes. Which approach should they take?

   • AUse transparent data encryption (TDE) for databases and BitLocker for file servers, and rely on application-level access controls for search and indexing.
   • BUse a data loss prevention (DLP) solution to monitor access to the data, but do not encrypt it.
   • CTokenize all data in both databases and file shares, and use the tokens for search and indexing.
   • DEncrypt the entire file servers with a full-disk encryption tool, but leave databases unencrypted to maintain performance.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which data protection control is most appropriate for protecting data while it is being transmitted over a network?

   • AData loss prevention (DLP) policies
   • BEncryption in transit (e.g., TLS)
   • CEncryption at rest (e.g., disk encryption)
   • DTokenization
   Reveal Solution Discussion Select an answer first