What is the primary purpose of data classification?

To reduce the amount of data stored by eliminating redundant copies

To determine the appropriate level of protection based on the sensitivity and criticality of data

To make data more accessible to all employees within an organization

To ensure data is encrypted in transit and at rest

What is the primary purpose of auditing data protection controls?

To delete data that is no longer needed

To encrypt data that was previously unencrypted

To create backups of critical data

To verify that controls are working as intended and comply with policies

A company stores customer payment card data in an on-premises database and also sends daily extracts to a cloud storage bucket for analytics. The security team requires that the data be protected both while stored and while transmitted. Which set of controls BEST meets this requirement?

Encrypt the database files with BitLocker and transfer the extracts over the corporate VPN.

Use TLS for the transfer and rely on the cloud provider's default encryption for the bucket, but leave the database unencrypted because it is behind a firewall.

Apply column-level encryption to the payment card numbers and use SFTP for the transfer.

Enable encryption at rest for the database and the cloud bucket, and use TLS for the network transfer between them.

A multinational company must retain customer purchase records for 7 years per tax law, but a new privacy regulation requires that personal data not be kept longer than necessary. The company's legal team confirms that after 7 years, the purchase records must be deleted. Which retention and disposal approach BEST satisfies both requirements?

Retain the records for exactly 7 years, then automatically delete them using a secure deletion process that overwrites the storage media.

Anonymize the records after 3 years and keep them for 7 years for tax purposes.

Delete the records after 7 years by simply removing the files from the file system and emptying the recycle bin.

Retain the records indefinitely because tax law requires long retention and privacy regulations do not override it.

A company runs a critical application on a virtual machine in a single cloud availability zone. The application's data is stored on a managed disk. The company's RTO is 15 minutes, and the RPO is zero. Which solution best meets these objectives?

Replicate the managed disk synchronously to another availability zone and configure automatic failover

Use a larger VM with more CPU and memory

Take hourly snapshots of the managed disk and store them in the same region

Back up the VM daily to a different region

GIAC Critical Controls Certification

Domain 4Objective 1

Data Protection GCCC Practice Questions (Page 1)

Part of the Data Protection and Recovery domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 1–5

1foundation · easy
What is the primary purpose of data classification?
Select an answer first
2foundation · easy
What is the primary purpose of auditing data protection controls?
Select an answer first
3application · medium
A company stores customer payment card data in an on-premises database and also sends daily extracts to a cloud storage bucket for analytics. The security team requires that the data be protected both while stored and while transmitted. Which set of controls BEST meets this requirement?
Select an answer first
4application · medium
A multinational company must retain customer purchase records for 7 years per tax law, but a new privacy regulation requires that personal data not be kept longer than necessary. The company's legal team confirms that after 7 years, the purchase records must be deleted. Which retention and disposal approach BEST satisfies both requirements?
Select an answer first
5expert · hard
A company runs a critical application on a virtual machine in a single cloud availability zone. The application's data is stored on a managed disk. The company's RTO is 15 minutes, and the RPO is zero. Which solution best meets these objectives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.