Data Security CCT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A retail company needs to provide a database to an external analytics firm for market research. The database contains customer names, addresses, and purchase history. The company wants to allow the analytics firm to perform statistical analysis without being able to identify individual customers. Which technique should be used?

   • AUse a DLP solution to monitor the analytics firm's access
   • BEncrypt the database and provide the decryption key
   • CRemove all purchase history to reduce sensitivity
   • DApply data masking to replace names and addresses with fictitious values
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational company stores personal data of EU citizens in a cloud database. The company is subject to GDPR and must ensure that personal data is not retained longer than necessary. Which practice should the company adopt?

   • AAnonymize all personal data after collection
   • BMove the data to a different cloud region
   • CEncrypt all personal data in the database
   • DImplement a data retention policy that defines specific retention periods and automated deletion after those periods
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is decommissioning old laptops that were used by executives. The laptops contain confidential client contracts and some personal data. The company's retention policy requires that data be permanently destroyed before disposal. Which method should be used to ensure the data cannot be recovered?

   • AReformat the hard drive using the operating system's quick format option.
   • BDelete all files and empty the Recycle Bin on each laptop.
   • CPerform a full disk encryption wipe by overwriting the entire hard drive with random data multiple times.
   • DUse a software tool to erase only the free space on the drive.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company needs to securely share a large encrypted file with an external partner. The partner does not have a pre-shared key. Which approach should be used to securely exchange the symmetric encryption key?

   • AEncrypt the file with the partner's private key.
   • BSend the symmetric key in a separate email without encryption.
   • CUse asymmetric encryption to encrypt the symmetric key with the partner's public key and send it.
   • DUse the same symmetric key for all partners and share it via a phone call.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services company is designing a data protection policy. They must comply with GDPR, which requires stronger protection for personal data. The company has several data categories: customer names with account balances, employee performance reviews, marketing brochures, and public financial reports. Which approach best aligns protection controls with regulatory requirements?

   • AClassify employee performance reviews as 'Public' because they are internal documents.
   • BClassify customer names with account balances as 'Confidential' and apply encryption and strict access controls; treat other data as 'Public'.
   • CApply the same access controls to all data to simplify management and avoid classification errors.
   • DEncrypt all data equally because GDPR requires the same level of protection for all data types.
   Reveal Solution Discussion Select an answer first