Data Security GCAD Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's cloud application allows users to submit documents. The company needs to ensure that the documents have not been tampered with and that the user who submitted them cannot deny the submission. The company also wants to ensure that the audit trail itself cannot be altered. Which combination of controls should the company implement?

   • AUse a blockchain-based storage system to store the documents and their metadata.
   • BEncrypt each document with the user's public key and store the encrypted document in the cloud storage.
   • CStore the document in a versioned bucket and rely on the cloud provider's audit logs to record who uploaded it.
   • DGenerate a cryptographic hash of each document, sign the hash with the user's private key, and store the signed hash in an append-only, immutable audit log.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which mechanism is used to verify that data has not been altered during transmission?

   • AEncryption
   • BTokenization
   • CHashing
   • DData masking
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is required by law to retain audit logs for five years. After five years, the logs must be destroyed. The logs are stored in a cloud object storage bucket with versioning enabled. What is the most secure way to ensure the logs are destroyed after the retention period?

   • AEncrypt the logs with a key and delete the key after five years.
   • BMove the logs to a cold storage tier and set a lifecycle rule to delete them after five years.
   • CConfigure a lifecycle rule to expire objects after five years and also purge all previous versions.
   • DManually delete the objects after five years and rely on the storage service to permanently remove them.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of data classification in an organization?

   • ATo categorize data based on its sensitivity and criticality to apply appropriate protection controls
   • BTo assign ownership and access rights to data based on its business value
   • CTo delete data that is no longer needed by the business
   • DTo encrypt all data regardless of its content or context
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company's DLP solution flags an employee attempting to upload a file containing social security numbers to a personal cloud storage account. The company's policy prohibits this. The DLP solution is configured to block the upload and notify the security team. However, the employee is a senior executive who demands the ability to upload the file for a legitimate business purpose. What should the security team do to balance security and business needs?

   • AAsk the executive to encrypt the file with a password and then upload it to the personal cloud storage account.
   • BPermanently block the upload and do not allow any exceptions, regardless of the executive's role.
   • CAllow the upload but require the executive to use a company-approved secure file sharing service with encryption and access controls, and log the activity for auditing.
   • DProvide the executive with the DLP administrator password so they can disable the policy when needed.
   Reveal Solution Discussion Select an answer first