Data Security ECSS Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company must comply with a regulation that requires retaining customer transaction data for five years. The company also has a data minimization policy that requires deleting data that is no longer needed. After five years, what should the company do with the transaction data?

   • AAnonymize the data and keep it indefinitely for analytics.
   • BSecurely delete the data and document the deletion.
   • CKeep the data for another five years to be safe.
   • DMove the data to an archive and restrict access.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a typical capability of a Data Loss Prevention (DLP) solution?

   • AEncrypting all data at rest using AES-256
   • BPerforming regular backups of data to a remote site
   • CMonitoring and blocking the sending of sensitive data via email
   • DProviding a virtual private network (VPN) for remote access
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the main purpose of a data retention policy?

   • ATo encrypt all data at rest
   • BTo ensure that all data is deleted immediately after use
   • CTo maximize the amount of data stored to avoid losing any information
   • DTo ensure that data is kept for as long as necessary to meet legal, regulatory, and business requirements
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization stores patient records in an on-premises SQL database and also transmits them to a cloud-based analytics platform for research. The compliance team requires that patient data remain unreadable if the database file is stolen, and that the data be protected while moving to the cloud. Which combination of controls should the security team implement?

   • ADatabase backup encryption and a private WAN link to the cloud
   • BColumn-level encryption for patient names and a VPN tunnel to the cloud provider
   • CTransparent Data Encryption (TDE) on the database and TLS 1.2+ for the cloud transmission
   • DFull-disk encryption on the database server and an SFTP transfer to the cloud
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A global company processes personal data of users in multiple jurisdictions. The company wants to implement a single data protection policy that satisfies the strictest requirements. What is the most effective approach?

   • AApply the strictest privacy requirements from any jurisdiction to all data processing.
   • BApply the requirements of the jurisdiction where the data is stored.
   • CApply the requirements of the jurisdiction where the company is headquartered.
   • DApply a generic policy that is not based on any specific regulation.
   Reveal Solution Discussion Select an answer first