Data Security CND Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A hospital is required by law to retain patient medical records for 10 years after the last treatment. After that period, the records must be securely destroyed. The hospital stores records in an electronic health record (EHR) system and also has backup tapes. Which disposal method is most appropriate for the backup tapes?

   • ADelete the records from the EHR system and assume the backup tapes are no longer needed.
   • BStore the tapes in a locked cabinet and mark them as 'do not destroy'.
   • CReformat the tapes using a standard tape drive format command.
   • DDegauss the tapes using a bulk eraser before recycling them.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company's DLP solution is generating a high number of false positives, causing employees to ignore DLP alerts. The security team wants to reduce false positives without significantly increasing the risk of data exfiltration. Which approach is most effective?

   • ADisable the DLP alerts for all users to reduce noise.
   • BRefine the DLP policies to use more specific data patterns and context, such as file types and recipient domains.
   • CIncrease the severity threshold so only very large data transfers trigger alerts.
   • DSwitch the DLP to alert-only mode and review alerts weekly.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company's backup strategy uses a 3-2-1 rule: three copies of data, on two different media types, with one copy offsite. The company currently has the primary data on a SAN, a backup on tape, and a backup in a cloud storage bucket. Which additional control is most important to ensure the backups are usable in a disaster?

   • ARegularly test the restoration process from the tape and cloud backups.
   • BEncrypt the backups to protect them from unauthorized access.
   • CStore the cloud backup in a different region than the primary data.
   • DUse a single backup software vendor to manage all backups.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which regulation specifically governs the protection of health information in the United States?

   • AHIPAA
   • BPCI DSS
   • CGDPR
   • DSOX
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of a data retention policy?

   • ATo encrypt data so that it cannot be read by unauthorized users
   • BTo define how long data must be kept and when it should be securely disposed of
   • CTo ensure data is kept for as long as possible for future analysis
   • DTo make data available to the public upon request
   Reveal Solution Discussion Select an answer first