A company's DLP solution is generating a high number of false positives, flagging internal documents that contain the word 'confidential' in the header but do not actually contain sensitive data. The security team wants to reduce false positives while still detecting actual sensitive data, such as credit card numbers and social security numbers. Which approach should they take?

Use data masking to hide the word 'confidential' in all documents before they are scanned by the DLP.

Increase the sensitivity threshold of the DLP to only flag documents that contain at least 10 instances of sensitive data patterns.

Disable the DLP policy for internal documents and only monitor outbound emails.

Refine the DLP policies to use data classification labels and content inspection rules that look for specific patterns (e.g., credit card number format) rather than relying solely on keywords like 'confidential'.

A company needs to ensure that a contract file has not been tampered with during transmission from a law firm to its cloud storage. Which mechanism provides the strongest assurance of integrity?

Use a digital signature on the file.

Compute a cryptographic hash of the file and send the hash separately to the recipient.

Encrypt the file with a shared secret key before transmission.

Compress the file and send it via a secure file transfer protocol.

A company wants to prevent employees from uploading sensitive files to personal cloud storage accounts. They have a DLP solution that can inspect outbound web traffic. Which configuration is most effective?

Encrypt all outbound traffic to personal cloud storage domains.

Block uploads to known personal cloud storage domains when the content matches sensitive data patterns.

Monitor and log uploads to personal cloud storage domains without blocking.

Block all access to personal cloud storage domains regardless of content.

A legal firm must prove in court that a specific contract document was not altered after it was signed and that the signer cannot deny their signature. The firm stores the document in a cloud storage bucket. Which combination of controls provides the strongest evidence of integrity and non-repudiation?

Compute a SHA-256 hash of the document, store the hash in a write-once audit log, and sign the hash with the signer's private key.

Encrypt the document with a symmetric key and store the key in a hardware security module (HSM).

Enable versioning on the storage bucket and keep all versions of the document.

Store the document in a bucket with object lock enabled for legal hold.

GIAC Cloud Security Architecture and Design

Domain 3Objective 1

Data Security GCAD Practice Questions (Page 2)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 6–10

6expert · hard
A company's DLP solution is generating a high number of false positives, flagging internal documents that contain the word 'confidential' in the header but do not actually contain sensitive data. The security team wants to reduce false positives while still detecting actual sensitive data, such as credit card numbers and social security numbers. Which approach should they take?
Select an answer first
7application · medium
A company needs to ensure that a contract file has not been tampered with during transmission from a law firm to its cloud storage. Which mechanism provides the strongest assurance of integrity?
Select an answer first
8application · medium
A company wants to prevent employees from uploading sensitive files to personal cloud storage accounts. They have a DLP solution that can inspect outbound web traffic. Which configuration is most effective?
Select an answer first
9application · medium
A legal firm must prove in court that a specific contract document was not altered after it was signed and that the signer cannot deny their signature. The firm stores the document in a cloud storage bucket. Which combination of controls provides the strongest evidence of integrity and non-repudiation?
Select an answer first
10foundation · easy
Which DLP technique is used to inspect network traffic for sensitive data being sent outside the organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Data Security GCAD Practice Questions (Page 2)

Questions 6–10

A company needs to ensure that a contract file has not been tampered with during transmission from a law firm to its cloud storage. Which mechanism provides the strongest assurance of integrity?

A company wants to prevent employees from uploading sensitive files to personal cloud storage accounts. They have a DLP solution that can inspect outbound web traffic. Which configuration is most effective?

Which DLP technique is used to inspect network traffic for sensitive data being sent outside the organization?

Keep studying — Data Protection and Security