What is the primary purpose of a data retention policy in cloud data lifecycle management?

To encrypt data at rest in cloud storage

To maximize storage costs by keeping all data indefinitely

To ensure data is stored for a defined period to meet legal and business requirements

To provide real-time access to data for all users

What is the principle of least privilege in the context of cloud data permissions?

Granting all users the same level of access to simplify management

Granting users the minimum permissions necessary to perform their job functions

Granting permissions based on the user's job title rather than their actual tasks

Granting users the maximum permissions possible to avoid access issues

Which cloud storage architecture feature is essential for enforcing data isolation between different customers in a multi-tenant environment?

Object-level access control policies

Server-side encryption with customer-managed keys

A financial services company runs a customer-facing web application that displays account numbers. The application team wants to use the account number as a lookup key in the database but does not want the raw account number to appear in application logs or database backups. The security team must ensure that the data is protected while still allowing the application to perform exact-match lookups. Which approach best meets these requirements?

Use format-preserving tokenization to replace account numbers with random tokens that preserve the original format, and store the mapping in a separate secure vault.

Encrypt the account number with AES-256 and store the ciphertext in the database; decrypt on every lookup.

Mask the account number in the database by replacing all but the last four digits with asterisks.

Apply a one-way hash (e.g., SHA-256) to the account number and use the hash as the lookup key.

Which storage architecture design is most appropriate for storing highly sensitive data that requires an additional layer of encryption beyond the cloud provider's default encryption?

Relying on network segmentation to protect data

Using only server-side encryption with cloud-managed keys

Using client-side encryption before uploading data to cloud storage

Storing data in a public cloud storage bucket with no encryption

GIAC Cloud Security Architecture and Design

Domain 3Objective 2

Defending Data in the Cloud GCAD Practice Questions (Page 1)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

8concepts

Questions 1–5

1foundation · easy
What is the primary purpose of a data retention policy in cloud data lifecycle management?
Select an answer first
2foundation · easy
What is the principle of least privilege in the context of cloud data permissions?
Select an answer first
3foundation · easy
Which cloud storage architecture feature is essential for enforcing data isolation between different customers in a multi-tenant environment?
Select an answer first
4application · medium
A financial services company runs a customer-facing web application that displays account numbers. The application team wants to use the account number as a lookup key in the database but does not want the raw account number to appear in application logs or database backups. The security team must ensure that the data is protected while still allowing the application to perform exact-match lookups. Which approach best meets these requirements?
Select an answer first
5foundation · easy
Which storage architecture design is most appropriate for storing highly sensitive data that requires an additional layer of encryption beyond the cloud provider's default encryption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.