A financial services company runs a customer support application in the cloud. The application needs to display the last four digits of a customer's credit card number to support agents, but the full card number must not be accessible to the application or the agents. The company also needs to run analytics on transaction data without exposing sensitive card numbers. Which approach should the company use?

Use data masking to permanently replace the card number with random digits in the database, and store the original in a backup file.

Store the full card number in a secure vault and have the application retrieve it only when needed for display.

Encrypt the card number in the database and decrypt it in the application for display, then mask the first 12 digits in the UI.

Use tokenization to replace the full card number with a token, and store the mapping in a separate token vault. Display only the last four digits stored as a separate field.

A multinational company uses Azure to host customer data. The company must comply with data sovereignty requirements that mandate data be stored within the country of origin. The company has customers in Germany and France. The security architect is designing a storage solution that ensures German customer data is stored in Germany and French customer data is stored in France. Which approach should they take?

Use a single Azure Storage account in France and use customer-managed keys stored in Germany.

Use two separate Azure Storage accounts, one in Germany and one in France, and configure the application to route data based on the customer's country.

Use a single Azure Storage account in Germany and replicate data to France using geo-redundant storage.

Use a single Azure Storage account in Germany and use Azure Policy to deny access to French users.

What is the primary purpose of a Data Loss Prevention (DLP) solution in a cloud environment?

To encrypt data at rest in cloud storage

To provide backup and disaster recovery for cloud data

To monitor and prevent unauthorized data exfiltration

To manage user identities and access permissions

What is the primary purpose of using TLS (Transport Layer Security) in a cloud environment?

To authenticate users accessing cloud resources

To manage encryption keys for cloud services

To protect data in transit between clients and cloud services

To encrypt data at rest in cloud storage

GIAC Cloud Security Architecture and Design

Domain 3Objective 2

Defending Data in the Cloud GCAD Practice Questions (Page 3)

Part of the Data Protection and Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

8concepts

Questions 11–15

11application · medium
A financial services company runs a customer support application in the cloud. The application needs to display the last four digits of a customer's credit card number to support agents, but the full card number must not be accessible to the application or the agents. The company also needs to run analytics on transaction data without exposing sensitive card numbers. Which approach should the company use?
Select an answer first
12expert · hard
A multinational company uses Azure to host customer data. The company must comply with data sovereignty requirements that mandate data be stored within the country of origin. The company has customers in Germany and France. The security architect is designing a storage solution that ensures German customer data is stored in Germany and French customer data is stored in France. Which approach should they take?
Select an answer first
13foundation · easy
What is the primary purpose of a Data Loss Prevention (DLP) solution in a cloud environment?
Select an answer first
14foundation · easy
What is the primary purpose of using TLS (Transport Layer Security) in a cloud environment?
Select an answer first
15foundation · easy
When applying labeling schemes to cloud data assets, which label is most appropriate for a database containing customer payment card information that must be protected according to PCI DSS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Defending Data in the Cloud GCAD Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of a Data Loss Prevention (DLP) solution in a cloud environment?

What is the primary purpose of using TLS (Transport Layer Security) in a cloud environment?

When applying labeling schemes to cloud data assets, which label is most appropriate for a database containing customer payment card information that must be protected according to PCI DSS?

Keep studying — Data Protection and Security