Defending Data in the Cloud GCAD Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   A company is migrating a legacy application to the cloud. The application stores credit card numbers in a database and must comply with PCI DSS. The security architect must choose a data protection strategy that minimizes the scope of PCI DSS compliance while still allowing the application to process transactions. Which strategy is most effective?

   • AMask the credit card numbers in the database so that only the last four digits are visible.
   • BTokenize the credit card numbers at the point of entry, storing only tokens in the application database and the actual card numbers in a separate, isolated token vault.
   • CEncrypt the credit card numbers in the database using AES-256 with a key stored in the cloud provider's KMS.
   • DUse format-preserving encryption to keep the data in the same format, allowing the application to operate without changes.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A cloud application needs to display customer credit card numbers to support agents, but the agents do not need to see the full number. Which data masking technique should be used to show only the last four digits?

   • AEncryption
   • BStatic data masking
   • CTokenization
   • DDynamic data masking
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A company is implementing a data classification scheme for files stored in Google Drive. The security team wants to automatically apply a 'Confidential' label to files that contain employee PII, and then restrict sharing of those files to internal users only. Which approach should they use?

   • AUse Google Cloud DLP to scan Drive files and apply a label based on the findings, then use Drive labels to restrict sharing.
   • BUse Google Workspace DLP to create a rule that detects PII and automatically applies a 'Confidential' label, and then use a sharing rule to block external sharing of labeled files.
   • CUse Google Drive's built-in 'Confidential' label and set the default sharing to 'Anyone with the link can view'.
   • DManually review all files and apply the 'Confidential' label to those containing PII.
   Reveal Solution Discussion Select an answer first