Data Security CND Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is deploying a new application in a virtualized environment. The application will store sensitive customer data. The security team must ensure data is encrypted at rest and that access to the encryption keys is controlled. Which approach is most appropriate?

   • AUse a hardware security module (HSM) to store the encryption keys and enforce strict access policies.
   • BStore the encryption keys in the application's configuration file for simplicity.
   • CUse the same encryption key for all virtual machines to simplify management.
   • DDisable encryption on the virtual disks to improve performance.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is migrating its on-premises data center to a public cloud. The data includes sensitive customer records. The security team must ensure that the data is protected during the migration and while at rest in the cloud. Additionally, the company wants to maintain control over the encryption keys. Which approach is most appropriate?

   • AUse client-side encryption before uploading the data to the cloud, and manage the keys on-premises.
   • BUse the cloud provider's default encryption for storage and rely on the provider's security controls.
   • CTransfer the data over a private connection and use a third-party key management service in the cloud.
   • DEncrypt the data using a VPN during transfer and use cloud-managed keys for encryption at rest.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   A company is classifying its data assets. Which data type would typically be classified as 'restricted' or 'highly confidential'?

   • ACustomer credit card numbers
   • BOffice building floor plans
   • CEmployee internal training schedules
   • DPublic marketing brochures
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A university is implementing a data classification policy. The IT department handles student transcripts (highly sensitive), course catalogs (public), and internal research notes (confidential). The DLP team needs to configure rules to block the transmission of sensitive data. Which classification approach should be used to ensure the DLP rules are effective?

   • AApply labels based on the data's sensitivity and criticality, and configure DLP rules to monitor and block transmission of 'highly sensitive' and 'confidential' data.
   • BUse a single classification level for all data and rely on user training to prevent data leaks.
   • CClassify data based on the storage location rather than content, and block all transfers from the student records server.
   • DClassify all data as 'internal' to simplify the DLP policy and avoid missing any sensitive data.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How does tokenization differ from encryption?

   • ATokenization uses a reversible algorithm to transform data, while encryption does not
   • BTokenization is used only for data at rest, while encryption is used only for data in transit
   • CTokenization replaces sensitive data with a non-sensitive placeholder, while encryption transforms data using an algorithm and key
   • DTokenization is stronger than encryption and should always be used instead
   Reveal Solution Discussion Select an answer first