Data Security CND Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A multinational company processes personal data of EU citizens. The data protection officer (DPO) requires that all personal data of EU citizens be stored in data centers within the EU. The company currently stores this data in a US-based cloud region. Which action should be taken to achieve compliance?

   • AMigrate the EU citizen data to a cloud region located in an EU member state and update the data processing records.
   • BAnonymize the data so it no longer qualifies as personal data under GDPR.
   • CSign a standard contractual clause with the cloud provider to allow data transfer to the US.
   • DEncrypt the data in the US region and argue that encryption makes it compliant with GDPR.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A company's DLP solution is blocking all outbound emails that contain credit card numbers. However, the finance department legitimately sends credit card numbers to a payment processor via email for reconciliation. The DLP is causing business disruption. Which configuration change should the security team make to allow this legitimate traffic while still preventing unauthorized exfiltration?

   • AEncrypt all outbound emails and rely on the recipient's ability to decrypt them.
   • BAdd the payment processor's email domain to the DLP allowlist and keep the DLP rule active for all other destinations.
   • CChange the DLP rule to only flag emails with more than 10 credit card numbers.
   • DDisable the DLP rule for all outbound emails to reduce business disruption.
   Reveal Solution Discussion Select an answer first
3. 53foundation · easy

   What does GDPR primarily aim to protect?

   • AThe confidentiality of corporate trade secrets
   • BThe personal data and privacy rights of individuals in the EU
   • CThe accuracy of financial reporting
   • DThe security of payment card transactions
   Reveal Solution Discussion Select an answer first