Defending Data in the Cloud GCAD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization stores patient records in an Azure Blob Storage account. Compliance requires that only authorized clinical staff can access records containing protected health information (PHI), while administrative staff can access non-PHI operational documents stored in the same account. The organization uses Azure Active Directory (Azure AD) for identity. Which combination of controls should the organization implement?

   • AApply sensitivity labels to blobs and use Azure Purview (Microsoft Purview) to enforce access policies based on the labels.
   • BUse Azure Blob index tags to mark blobs as 'PHI' or 'Operational' and configure Azure RBAC roles with conditions that check the index tags.
   • CStore PHI blobs in a separate storage account and assign Azure RBAC roles to grant clinical staff access to that account only.
   • DApply a data classification label to blobs and use Azure AD conditional access policies to restrict access based on the label.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A government agency is required to retain email records for seven years and then securely delete them. The agency uses Microsoft 365 Exchange Online. The compliance officer wants to ensure that emails are not permanently deleted before the retention period ends, and that after seven years they are purged in a way that meets the agency's secure disposal policy. Which solution should the security architect implement?

   • AUse eDiscovery holds to preserve all email for seven years, then manually delete the mailboxes.
   • BCreate a retention policy in Microsoft Purview that retains email for seven years and then deletes it.
   • CExport all emails to a third-party archiving system and delete them from Exchange Online immediately.
   • DSet the Exchange Online deleted item retention period to seven years and rely on the user to delete emails after that time.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global bank must store customer data for EU residents in the EU to comply with GDPR data residency requirements. The bank uses AWS and currently stores data in us-east-1. The security architect is tasked with moving the data to an EU region. The bank also requires that encryption keys be managed by the bank and stored in the EU. Which approach best satisfies both requirements?

   • AMove the data to an on-premises data center in the EU and connect it to AWS using Direct Connect.
   • BUse S3 Cross-Region Replication to copy data to eu-central-1, and configure the destination bucket to use a customer-managed KMS key stored in the EU region.
   • CKeep the data in us-east-1 but apply a bucket policy that denies access to users outside the EU.
   • DCopy the data to eu-central-1 using S3 Cross-Region Replication and enable S3 default encryption with an AWS-managed key.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which cloud access control mechanism is used to grant a specific user read-only access to a single object in a cloud storage bucket?

   • ABucket-level policy
   • BObject-level access control list (ACL)
   • CNetwork security group (NSG) rule
   • DShared access signature (SAS) with read-only permissions
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A cloud security architect is defining data classification levels for a new cloud environment. Which classification level is typically used for data that, if exposed, could cause significant harm to the organization but is not intended for public release?

   • APublic
   • BConfidential
   • CTop Secret
   • DInternal
   Reveal Solution Discussion Select an answer first