Data Security in Cloud CCSE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has a DLP solution that monitors outbound email. An employee is suspected of sending customer data to a personal email account. The DLP policy blocks emails containing credit card numbers, but the employee sends the data as an image attachment. What should the DLP administrator do to detect this exfiltration?

   • AIncrease the sensitivity of the DLP policy to block all image attachments
   • BDisable the DLP policy for image attachments
   • CEnable optical character recognition (OCR) on the DLP policy
   • DRequire employees to encrypt all outbound emails
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company stores sensitive documents in a cloud object storage bucket. The security team wants to ensure that only authenticated users from the corporate network can access the bucket, and that data is encrypted both in transit and at rest. Which configuration should be implemented?

   • AStore the bucket in a private VPC and allow all VPC users access without additional authentication.
   • BUse pre-signed URLs for all access and disable encryption.
   • CEnable public read access and rely on encryption to protect the data.
   • DUse a bucket policy that allows access only from the corporate IP range and enable HTTPS and server-side encryption.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of data masking in a non-production environment?

   • ATo ensure data is backed up regularly
   • BTo encrypt data at rest
   • CTo reduce the size of the database
   • DTo obfuscate sensitive data so it can be used for testing without exposing real values
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is investigating a potential data breach. They have enabled access logging on the cloud storage bucket, but the logs show that an attacker used a valid user's credentials to access sensitive files. The team needs to determine whether the attacker also exfiltrated data. Which additional data source would be MOST useful?

   • AStorage bucket versioning history
   • BNetwork flow logs from the virtual network
   • CIdentity provider sign-in logs
   • DKey management service audit logs
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A European company must ensure that personal data of EU citizens is stored only within the EU. The company uses a cloud provider with regions in multiple countries. What should the company configure to meet this requirement?

   • ASelect a cloud region located within the EU and configure storage and database services to use that region.
   • BUse a private cloud hosted on-premises in the EU for all data.
   • CEncrypt all data with a key stored in the EU and allow storage in any region.
   • DStore data in a region outside the EU but ensure the cloud provider is certified for GDPR.
   Reveal Solution Discussion Select an answer first