What is the purpose of a data retention policy?

To classify data based on sensitivity

To define how long data must be kept and when it should be securely disposed of

To ensure data is kept indefinitely for future analysis

What is the primary difference between data masking and tokenization?

Masking is used only in production; tokenization is used only in non-production

Masking encrypts data; tokenization hashes data

Masking replaces data with realistic but fake values; tokenization replaces data with a random token that can be mapped back to the original value

Masking is reversible; tokenization is irreversible

A company is implementing a data classification scheme. The company has a mix of public marketing materials, internal project plans, and customer personal data. The security team wants to apply different security controls based on classification. Which approach should they take?

Define three classification levels (Public, Internal, Restricted) and apply corresponding controls: Public data is accessible to everyone, Internal data requires authentication, and Restricted data requires encryption and strict access controls.

Use a single classification level for all data and rely on the security team to manually review access requests.

Classify all data as Restricted to ensure the highest level of security is applied uniformly.

Classify data based on the storage location, with data in the cloud classified as Restricted and data on-premises classified as Internal.

GIAC Cloud Security Architecture and Design

Domain 3Objective 1

Data Security GCAD Practice Questions (Page 9)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 41–45

41foundation · easy
What is the purpose of a data retention policy?
Select an answer first
42foundation · easy
Which US regulation sets standards for the protection of protected health information (PHI)?
Select an answer first
43foundation · easy
What is the primary difference between data masking and tokenization?
Select an answer first
44application · medium
A company is implementing a data classification scheme. The company has a mix of public marketing materials, internal project plans, and customer personal data. The security team wants to apply different security controls based on classification. Which approach should they take?
Select an answer first
45foundation · easy
During which data lifecycle stage is it most important to enforce data loss prevention (DLP) policies to prevent unauthorized transmission of sensitive data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Data Security GCAD Practice Questions (Page 9)

Questions 41–45

What is the purpose of a data retention policy?

Which US regulation sets standards for the protection of protected health information (PHI)?

What is the primary difference between data masking and tokenization?

A company is implementing a data classification scheme. The company has a mix of public marketing materials, internal project plans, and customer personal data. The security team wants to apply different security controls based on classification. Which approach should they take?

During which data lifecycle stage is it most important to enforce data loss prevention (DLP) policies to prevent unauthorized transmission of sensitive data?

Keep studying — Data Protection and Security