Data Classification and Resource Tagging GCAD Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   A company has a cloud environment with resources that are not tagged. The security team wants to implement a tagging strategy to support data classification and cost management. The operations team wants to ensure that all resources are tagged consistently. What is the first step the company should take?

   • AApply tags to all existing resources immediately.
   • BDefine a tagging schema that includes tags for data classification, cost center, and application.
   • CPurchase a third-party tagging tool.
   • DTrain employees on how to tag resources.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large enterprise has a complex cloud environment with thousands of resources. They have implemented data classification and resource tagging, but they are finding that some resources have conflicting tags (e.g., a resource tagged 'Public' but containing 'Confidential' data). What is the most effective way to resolve this issue?

   • AImplement a policy that denies access to any resource with conflicting tags.
   • BUse a data discovery tool to scan resources and automatically correct the tags based on the actual data.
   • CManually review and correct the tags on all resources.
   • DRequire all resources to be tagged with the highest possible classification level.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses a multi-account cloud environment. The security team wants to automatically identify all storage buckets that contain personally identifiable information (PII) so they can apply stricter access controls. The data is already labeled with classification tags at the object level. What is the most effective way to achieve this?

   • AApply a restrictive access policy to all buckets and then remove the policy from buckets that do not contain PII.
   • BUse a cloud-native discovery service that scans object metadata for classification labels and automatically applies the corresponding resource tag to the bucket.
   • CManually review each bucket's contents and apply the appropriate classification tag based on the most sensitive data found.
   • DCreate a resource tagging policy that requires all buckets to have a classification tag, and use a compliance scanner to report buckets missing the tag.
   Reveal Solution Discussion Select an answer first
5. 29application · easy

   A multinational corporation is implementing a data classification policy. The legal department has determined that certain contracts are 'Restricted' due to regulatory requirements. The IT department is responsible for storing these contracts in a cloud document management system. Who should be responsible for assigning the 'Restricted' label to these contracts?

   • AThe IT department, because they manage the storage system.
   • BThe cloud provider, because they host the document management system.
   • CThe security team, because they enforce the classification policy.
   • DThe legal department, because they are the data owners and understand the regulatory requirements.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services firm is implementing a data classification program. The compliance team has defined four levels: Public, Internal, Confidential, and Restricted. The data owner for a customer database has labeled the data as 'Confidential'. The security team wants to ensure that any new storage resource created to hold this data is automatically tagged with the correct classification. What is the most effective way to enforce this?

   • ACreate a new resource group for the database and add a description noting it contains confidential data.
   • BAsk the cloud provider to enable a default tag on all storage accounts in the organization.
   • CRequire the data owner to manually tag each new storage resource after creation.
   • DUse a cloud policy that automatically applies the 'Confidential' tag to any storage resource created in the subscription designated for this application.
   Reveal Solution Discussion Select an answer first