A company uses Google Cloud Storage to store files that are shared with external partners. The security team wants to ensure that partners can only access files that are explicitly shared with them, and that they cannot list the contents of the bucket. Which configuration should they implement?

Use signed URLs for individual files and do not grant partners any IAM role on the bucket.

Grant partners the 'Storage Object Viewer' role on the bucket, and use bucket policies to restrict access to specific objects.

Grant partners the 'Storage Object Viewer' role on the bucket, and use signed URLs for individual files.

Create a new IAM role with only 'storage.objects.get' permission and assign it to partners.

A company uses Microsoft 365 and Azure. The security team wants to prevent users from sharing sensitive documents externally via email or SharePoint links. They have enabled sensitivity labels for documents. Which control should they configure to block external sharing of labeled content?

Apply a retention policy to labeled documents to prevent deletion.

Set SharePoint site permissions to 'Only members can share' for all sites.

Use Azure AD conditional access to block access from external networks.

Configure a data loss prevention (DLP) policy in Microsoft Purview that detects sensitivity labels and blocks external sharing.

A retail company processes credit card payments and stores transaction data in a database. To reduce the risk of data breaches, the security team wants to ensure that credit card numbers are not stored in the database in plaintext. The application must be able to retrieve the full credit card number for refunds. Which technique should they use?

Use a one-way hash of the credit card number and store the hash in the database.

Use tokenization and store the token in the database, with the mapping to the original credit card number stored in a separate secure vault.

Use encryption and store the encrypted credit card number in the database, with the decryption key stored in the application's source code.

Use masking to display only the last four digits of the credit card number in the database.

Which cloud service capability is commonly used to implement DLP controls for data stored in cloud storage services?

Object versioning and lifecycle management

Content inspection and policy enforcement

Load balancing and auto-scaling

Virtual private network (VPN) connectivity

GIAC Cloud Security Architecture and Design

Domain 3Objective 2

Defending Data in the Cloud GCAD Practice Questions (Page 2)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

8concepts

Questions 6–10

6application · medium
A company uses Google Cloud Storage to store files that are shared with external partners. The security team wants to ensure that partners can only access files that are explicitly shared with them, and that they cannot list the contents of the bucket. Which configuration should they implement?
Select an answer first
7application · medium
A company uses Microsoft 365 and Azure. The security team wants to prevent users from sharing sensitive documents externally via email or SharePoint links. They have enabled sensitivity labels for documents. Which control should they configure to block external sharing of labeled content?
Select an answer first
8application · medium
A retail company processes credit card payments and stores transaction data in a database. To reduce the risk of data breaches, the security team wants to ensure that credit card numbers are not stored in the database in plaintext. The application must be able to retrieve the full credit card number for refunds. Which technique should they use?
Select an answer first
9foundation · easy
Which data protection technique replaces sensitive data with a non-sensitive equivalent that has no mathematical relationship to the original value, and uses a secure mapping to retrieve the original data when needed?
Select an answer first
10foundation · easy
Which cloud service capability is commonly used to implement DLP controls for data stored in cloud storage services?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Defending Data in the Cloud GCAD Practice Questions (Page 2)

Questions 6–10

A company uses Google Cloud Storage to store files that are shared with external partners. The security team wants to ensure that partners can only access files that are explicitly shared with them, and that they cannot list the contents of the bucket. Which configuration should they implement?

A company uses Microsoft 365 and Azure. The security team wants to prevent users from sharing sensitive documents externally via email or SharePoint links. They have enabled sensitivity labels for documents. Which control should they configure to block external sharing of labeled content?

Which data protection technique replaces sensitive data with a non-sensitive equivalent that has no mathematical relationship to the original value, and uses a secure mapping to retrieve the original data when needed?

Which cloud service capability is commonly used to implement DLP controls for data stored in cloud storage services?

Keep studying — Data Protection and Security