Data Security GCAD Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which regulation specifically addresses the protection of personal data of individuals in the European Union?

   • ASOX
   • BGDPR
   • CPCI DSS
   • DHIPAA
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare SaaS provider needs to share a production database with a third-party analytics vendor for a one-time research project. The vendor must see realistic patient data to build models, but the data cannot leave the provider's cloud environment, and the vendor must not be able to reverse-engineer actual patient identities. The provider has already classified the data as 'Restricted' under its data classification policy. Which approach best satisfies the vendor's need while protecting patient privacy?

   • AProvide the vendor with direct read-only access to the production database, relying on the vendor's contractual agreement to protect the data.
   • BEncrypt the production database with a new key and share the key with the vendor so they can decrypt and analyze the data.
   • CTokenize the production database by replacing patient identifiers with tokens and give the vendor the token-to-value mapping for analysis.
   • DCreate a static masked copy of the production database in a separate non-production environment and grant the vendor read-only access to that copy.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a cloud storage bucket containing files classified as 'Confidential'. The security team wants to implement least privilege access. Currently, all employees have read/write access to the bucket. The team needs to ensure that only the data owners can modify files, while other employees can only read files they are explicitly granted access to. The company uses an identity provider with group membership. Which access control approach best meets this requirement?

   • AUse role-based access control (RBAC) with a single 'Employee' role that has read access to all files and a separate 'DataOwner' role that has write access.
   • BUse discretionary access control (DAC) where each file owner sets permissions for other users.
   • CUse mandatory access control (MAC) with labels on files and clearances on users, where only users with a 'Confidential' clearance can read and only 'DataOwner' clearance can write.
   • DUse attribute-based access control (ABAC) with policies that allow write access only if the user is in the 'DataOwners' group and read access only if the user is in a group that has been granted read permission for the specific file.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is designing a cloud application that processes highly sensitive data. The security team wants to protect the data while it is being processed in memory. The data is currently encrypted at rest and in transit. Which additional control should the company implement to protect data in use?

   • AUse confidential computing, such as secure enclaves (e.g., Intel SGX or AMD SEV), to ensure that data is decrypted only inside a protected CPU environment and is not accessible to the host operating system.
   • BUse a web application firewall (WAF) to filter traffic to the application.
   • CUse a hardware security module (HSM) to store encryption keys and perform cryptographic operations.
   • DUse tokenization to replace sensitive data with tokens before processing.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which data classification label would typically be applied to information whose unauthorized disclosure could cause serious harm to an organization, such as customer financial records?

   • AInternal
   • BSensitive but unclassified
   • CConfidential
   • DPublic
   Reveal Solution Discussion Select an answer first