A company is subject to GDPR and must delete personal data upon request. However, they also have a legal obligation to retain certain records for tax purposes for seven years. How should they reconcile these conflicting requirements?

Delete all personal data immediately upon request, regardless of legal retention requirements.

Refuse the erasure request and inform the data subject that the data is retained for legal reasons.

Anonymize the data so it is no longer considered personal data, then delete it.

Implement a data retention policy that distinguishes between data subject to erasure and data that must be retained for legal compliance, and apply deletion only to the former.

A company is designing a data encryption strategy for a multi-tenant cloud application. They want to ensure that each tenant's data is encrypted with a unique key, and that the keys are managed by the company, not the cloud provider. Which approach best meets these requirements?

Use a single encryption key for all tenants and store it in the cloud provider's KMS.

Use envelope encryption with a per-tenant data encryption key (DEK) that is encrypted by a master key stored in the company's own KMS.

Use the cloud provider's default encryption with a service-managed key.

Use client-side encryption with a key stored in each tenant's browser.

In the cloud shared responsibility model, which security area is typically the responsibility of the customer?

Encryption of customer data and management of customer encryption keys

Physical security of data centers

Network infrastructure security

GIAC Cloud Security Architecture and Design

Domain 3Objective 1

Data Security GCAD Practice Questions (Page 4)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 16–20

16expert · hard
A company is subject to GDPR and must delete personal data upon request. However, they also have a legal obligation to retain certain records for tax purposes for seven years. How should they reconcile these conflicting requirements?
Select an answer first
17foundation · easy
Which encryption technique is used to protect data while it is being processed in memory or by a CPU?
Select an answer first
18expert · hard
A company is designing a data encryption strategy for a multi-tenant cloud application. They want to ensure that each tenant's data is encrypted with a unique key, and that the keys are managed by the company, not the cloud provider. Which approach best meets these requirements?
Select an answer first
19foundation · easy
What does a digital signature provide in addition to data integrity?
Select an answer first
20foundation · easy
In the cloud shared responsibility model, which security area is typically the responsibility of the customer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Data Security GCAD Practice Questions (Page 4)

Questions 16–20

A company is subject to GDPR and must delete personal data upon request. However, they also have a legal obligation to retain certain records for tax purposes for seven years. How should they reconcile these conflicting requirements?

Which encryption technique is used to protect data while it is being processed in memory or by a CPU?

A company is designing a data encryption strategy for a multi-tenant cloud application. They want to ensure that each tenant's data is encrypted with a unique key, and that the keys are managed by the company, not the cloud provider. Which approach best meets these requirements?

What does a digital signature provide in addition to data integrity?

In the cloud shared responsibility model, which security area is typically the responsibility of the customer?

Keep studying — Data Protection and Security