Data Security CND Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is subject to a regulation that requires retaining customer transaction records for 5 years. The company also has a legal hold notice for a specific customer's records due to an ongoing lawsuit. The retention policy is set to delete records older than 5 years. What should the administrator do?

   • AAnonymize the customer's records and then delete them after 5 years.
   • BPlace the customer's records on legal hold, which overrides the retention policy until the hold is lifted.
   • CExtend the retention period for all customers to 10 years to avoid future legal holds.
   • DDelete the records after 5 years as the retention policy requires, regardless of the legal hold.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which method is considered a secure way to dispose of data on a magnetic hard drive?

   • ADeleting the files and emptying the recycle bin
   • BReformatting the drive
   • CQuick formatting the drive
   • DDegaussing the drive
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A law firm must retain client case files for 7 years after case closure per its retention policy. After that period, the files must be destroyed. The firm stores files on a network share and also has physical copies in a storage room. Which disposal method is most appropriate for the digital files to ensure they cannot be recovered?

   • ADelete the files from the network share and then empty the Recycle Bin.
   • BMove the files to an archive folder and restrict access to the IT department only.
   • CUse a secure file deletion tool that overwrites the data with random patterns multiple times.
   • DReformat the network share's hard drive and reinstall the operating system.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is implementing a DLP solution to prevent data exfiltration. The DLP is deployed at the network perimeter and monitors outbound traffic. However, the security team discovers that sensitive data is being exfiltrated via encrypted HTTPS traffic to a cloud storage service. Which additional control is most effective in detecting this type of exfiltration?

   • AUse a firewall rule to block traffic to the specific cloud storage IP addresses.
   • BBlock all outbound HTTPS traffic to cloud storage services.
   • CDeploy a TLS inspection proxy that decrypts outbound HTTPS traffic for DLP inspection.
   • DRely on the DLP's ability to inspect encrypted traffic without decryption.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A payment processing company needs to test its new fraud detection algorithm using historical transaction data. The data includes credit card numbers, which are sensitive. The testing environment is not as secure as production. The company wants to maintain the ability to link transactions to the same card for analysis, but does not need the actual card number. Which technique should be used?

   • ADelete the card numbers and use the transaction ID as the only identifier.
   • BEncrypt the card numbers and store the encryption key in the testing environment.
   • CUse data masking to replace the first 12 digits of the card number with 'X' and keep the last 4 digits.
   • DUse tokenization to replace each credit card number with a unique token, and use the same token for the same card across all records.
   Reveal Solution Discussion Select an answer first