Data Security GCAD Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the principle of least privilege?

   • AUsers should have all permissions necessary to perform their job functions and no more
   • BUsers should be granted access based on their seniority
   • CUsers should be granted access to all data to maximize productivity
   • DUsers should have the same access as their manager
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A multinational company must comply with GDPR, which requires that personal data be kept no longer than necessary. The company stores customer records in an object storage bucket in a cloud region within the EU. The records include a field indicating the retention period based on the customer's contract. The company wants to automate deletion of records that have exceeded their retention period. Which approach should they implement?

   • AMove all customer records to a cold storage tier and rely on the storage provider to delete them after a year.
   • BWrite a scheduled script that queries the metadata of each object, compares the contract expiration date to the current date, and deletes objects that have expired.
   • CEnable object versioning and configure the bucket to retain only the latest version of each object, deleting all previous versions after 30 days.
   • DUse a lifecycle policy on the object storage bucket that automatically deletes objects after a fixed number of days, and set that number to the maximum contract length across all customers.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which encryption technique is most commonly used to protect data transmitted between a web browser and a cloud application?

   • ATokenization
   • BAES-256 encryption at rest
   • CHomomorphic encryption
   • DTLS/SSL
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary goal of a Data Loss Prevention (DLP) system?

   • ATo ensure data is backed up regularly
   • BTo encrypt all data stored in the cloud
   • CTo monitor, detect, and prevent unauthorized access, use, or transmission of sensitive data
   • DTo classify data automatically based on its content
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company that handles health records is subject to HIPAA. They plan to use a public cloud provider to store and process these records. Which requirement must the company ensure is met to comply with HIPAA?

   • AEnter into a business associate agreement (BAA) with the cloud provider.
   • BEnsure that all PHI is encrypted with at least AES-256 encryption.
   • CUse only cloud providers located in the same country as the company.
   • DObtain written consent from each patient before storing their data in the cloud.
   Reveal Solution Discussion Select an answer first