Data Security ECSS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's backup strategy currently uses full backups every Sunday and differential backups on other days. The company needs to reduce the time required to restore the database after a failure. Which change would most effectively reduce restore time?

   • APerform full backups more frequently, such as daily.
   • BStore backups on tape and rotate them monthly.
   • CUse a cloud backup service with higher latency.
   • DSwitch to incremental backups instead of differential backups.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial firm's backup administrator notices that a recent backup restore test produced files that failed checksum verification. The backups were taken nightly and stored in a remote data center. What is the most likely cause of the checksum failure, and what should the administrator do to prevent recurrence?

   • AThe remote data center is too far away; move backups to a local storage device
   • BThe backup software is not encrypting the data; enable encryption on all backup jobs
   • CThe backup window is too short; extend the backup window to allow full backups
   • DThe backup media may have corrupted during storage; implement regular integrity checks and periodic restore tests
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A multinational company must comply with a new data protection regulation that requires personal data to be deleted when it is no longer needed for the purpose it was collected. The company also has a legal obligation to retain financial records for seven years. Which policy should the company implement?

   • ADelete all personal data immediately and keep only anonymized data for financial records
   • BKeep all data indefinitely to avoid accidental deletion of records that might be needed later
   • CStore all data in a single archive and rely on manual deletion when a request is received
   • DDefine retention periods based on data classification and legal requirements, and automate deletion when the retention period expires
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global company is subject to GDPR and the California Consumer Privacy Act (CCPA). They receive a request from a user to delete their personal data. The company also has a legal obligation to retain certain transaction records for tax purposes. How should the company respond to the deletion request?

   • ADelete all data related to the user immediately, including transaction records
   • BDelete the user's personal data where it is not required for legal retention, and retain only the data that must be kept for tax compliance
   • CRefuse the deletion request entirely because of the tax retention requirement
   • DAnonymize the user's personal data and keep it for analytics purposes
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A multinational corporation is designing a secure file transfer system between its headquarters and branch offices. The data includes intellectual property that must be protected both during transmission and while stored on the receiving server. The company also needs to verify that the files have not been altered during transit. Which set of controls best addresses all three requirements?

   • AUse TLS for transmission, encrypt the files at rest on the receiving server, and generate a hash of each file before and after transfer
   • BUse SFTP for transmission and store the files in a folder with restricted access
   • CEncrypt the files before transmission and store them encrypted, but do not use hashing
   • DUse a VPN for transmission and rely on the VPN's encryption for both transit and storage
   Reveal Solution Discussion Select an answer first