Defending Data in the Cloud GCAD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization uses Azure and wants to prevent sensitive data from being uploaded to external file-sharing services. The security team has implemented Microsoft Defender for Cloud Apps and wants to enforce a policy that blocks uploads of files containing credit card numbers to unsanctioned apps. Which policy type should they configure?

   • AAn access policy that requires multi-factor authentication for all users accessing external file-sharing services.
   • BA cloud discovery policy that identifies unsanctioned apps and generates a report for the security team.
   • CA file policy that uses DLP to inspect files and blocks the upload if credit card numbers are detected.
   • DA session policy that monitors user activity and alerts when a file with credit card numbers is uploaded.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which practice is essential for the secure disposal of data in cloud storage?

   • AOverwriting the data multiple times with random patterns
   • BDeleting the data and then emptying the recycle bin or trash
   • CCryptographic erasure by deleting the encryption keys
   • DMoving the data to a cold storage tier
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which key management practice is essential for protecting data at rest in a cloud environment?

   • ADisabling encryption to avoid key management overhead
   • BStoring encryption keys in the same cloud storage bucket as the encrypted data
   • CEmbedding encryption keys in application source code for easy access
   • DUsing a dedicated key management service (KMS) to store and manage encryption keys separately from the data
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses Microsoft 365 and has a data loss prevention (DLP) policy that blocks sharing of credit card numbers via email. Recently, an employee used a personal Gmail account to send a spreadsheet containing customer credit card numbers. The security team wants to extend DLP coverage to prevent this type of exfiltration. Which control should they implement?

   • ADeploy a cloud access security broker (CASB) that integrates with the company's identity provider and applies DLP policies to web traffic, including personal webmail.
   • BUse Azure Information Protection to label the spreadsheet as 'Confidential' and rely on users to respect the label.
   • CConfigure a DLP policy in Microsoft 365 that blocks uploads to personal webmail domains in the browser.
   • DEnable Microsoft Defender for Cloud Apps and configure a session policy that blocks downloads from SharePoint to personal devices.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A multinational company uses AWS KMS to encrypt data in S3 buckets. A new regulation requires that encryption keys for data stored in the EU must be managed and stored within the EU, and the company must be able to immediately revoke access to the data if a key is compromised. The company currently uses AWS-managed keys (aws/s3). What should the company do?

   • ASwitch to customer-managed keys (CMKs) created in the EU region and enable automatic key rotation.
   • BUse AWS-managed keys but restrict the S3 bucket policy to only allow access from EU IP addresses.
   • CCreate a customer-managed key (CMK) in the EU region, use it for S3 encryption, and ensure the key policy allows only EU-based IAM principals to use it.
   • DUse an AWS CloudHSM in the EU region and store the key material in the HSM, but continue using the default S3 encryption.
   Reveal Solution Discussion Select an answer first