A company is subject to both GDPR and a national law that requires financial records to be retained for 10 years. GDPR requires that personal data be deleted when no longer necessary. The company has a dataset that contains both personal data and financial records. The company wants to comply with both regulations. Which approach should they take?

Separate the personal data from the financial records, delete the personal data that is not required for the financial records, and retain the financial records (including necessary personal data) for 10 years.

Anonymize the personal data in the dataset and retain the anonymized data for 10 years.

Delete the personal data immediately and retain only the financial records for 10 years, even if the financial records contain personal data.

Retain the entire dataset for 10 years to comply with the national law, and rely on the legal basis of the national law to justify the retention of personal data.

A retail company processes credit card payments. To reduce the scope of PCI DSS compliance, the company wants to ensure that credit card numbers are not stored in its systems. Instead, the company wants to store a reference that can be used to process refunds. Which technique should the company use?

Tokenization, where the credit card number is replaced with a unique token that maps back to the original number in a secure vault.

Data masking, where the credit card number is displayed as XXXX-XXXX-XXXX-1234 in all applications.

Encryption, where the credit card number is encrypted with a strong algorithm and stored in the database.

Hashing, where the credit card number is hashed with a one-way algorithm and stored in the database.

A company is migrating its on-premises data center to a public cloud. The security team is concerned about the shared responsibility model. Which responsibility remains with the customer even when using a fully managed database service?

Configuring the network firewalls that protect the database service.

Patching the database operating system and software.

Managing access to the database, including user accounts, roles, and permissions.

Ensuring physical security of the data center hosting the database.

A company is designing a multi-cloud architecture and wants to ensure that data encrypted in one cloud can be decrypted in another cloud if the first cloud becomes unavailable. They also want to maintain control over the encryption keys. Which key management strategy is most appropriate?

Encrypt data with a customer-managed key stored in a single cloud's KMS and rely on that cloud's availability.

Use each cloud's native KMS and replicate the encrypted data to the other cloud.

Use client-side encryption with a key stored in a password manager.

Use a cloud-agnostic key management service (KMS) that stores keys in a hardware security module (HSM) accessible from all clouds.

A company's DLP solution is blocking all outbound emails that contain a 16-digit number, but employees are complaining that legitimate emails with tracking numbers are being blocked. The DLP is using a regular expression to detect credit card numbers. What is the best way to reduce false positives while still detecting credit card numbers?

Change the DLP rule to only block emails with exactly 16 digits and no other characters.

Enhance the DLP rule to include Luhn algorithm validation and context checks, such as proximity to keywords like 'card' or 'VISA'.

Increase the DLP sensitivity level to block more emails.

Disable the DLP rule and rely on employee training to avoid sending sensitive data.

GIAC Cloud Security Architecture and Design

Domain 3Objective 1

Data Security GCAD Practice Questions (Page 8)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 36–40

36expert · hard
A company is subject to both GDPR and a national law that requires financial records to be retained for 10 years. GDPR requires that personal data be deleted when no longer necessary. The company has a dataset that contains both personal data and financial records. The company wants to comply with both regulations. Which approach should they take?
Select an answer first
37application · medium
A retail company processes credit card payments. To reduce the scope of PCI DSS compliance, the company wants to ensure that credit card numbers are not stored in its systems. Instead, the company wants to store a reference that can be used to process refunds. Which technique should the company use?
Select an answer first
38application · medium
A company is migrating its on-premises data center to a public cloud. The security team is concerned about the shared responsibility model. Which responsibility remains with the customer even when using a fully managed database service?
Select an answer first
39expert · hard
A company is designing a multi-cloud architecture and wants to ensure that data encrypted in one cloud can be decrypted in another cloud if the first cloud becomes unavailable. They also want to maintain control over the encryption keys. Which key management strategy is most appropriate?
Select an answer first
40expert · hard
A company's DLP solution is blocking all outbound emails that contain a 16-digit number, but employees are complaining that legitimate emails with tracking numbers are being blocked. The DLP is using a regular expression to detect credit card numbers. What is the best way to reduce false positives while still detecting credit card numbers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Data Security GCAD Practice Questions (Page 8)

Questions 36–40

A company is migrating its on-premises data center to a public cloud. The security team is concerned about the shared responsibility model. Which responsibility remains with the customer even when using a fully managed database service?

A company is designing a multi-cloud architecture and wants to ensure that data encrypted in one cloud can be decrypted in another cloud if the first cloud becomes unavailable. They also want to maintain control over the encryption keys. Which key management strategy is most appropriate?

Keep studying — Data Protection and Security