Data Protection GCCC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the main purpose of a data retention policy?

   • ATo define how long data must be kept and when it should be deleted
   • BTo provide backup and recovery procedures
   • CTo ensure data is encrypted at all times
   • DTo classify data based on sensitivity
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A critical application must be back online within 4 hours of a failure. What is the RTO for this application?

   • A8 hours
   • B4 hours
   • C0 hours
   • D1 day
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company stores sensitive customer data in a cloud object storage service. The data is encrypted at rest using server-side encryption. The company's security team wants to ensure that even the cloud provider cannot access the plaintext data. Which approach should the company use?

   • AUse server-side encryption with provider-managed keys
   • BUse server-side encryption with customer-managed keys stored in the provider's key management service
   • CUse client-side encryption before uploading the data
   • DUse TLS for all uploads and downloads
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a potential data breach. The company stores sensitive data in a database with encryption at rest and access logging enabled. The analyst needs to determine whether any unauthorized access occurred. Which evidence source is most useful?

   • ABackup job logs
   • BNetwork firewall logs
   • CEncryption key rotation logs
   • DDatabase access logs showing user queries and timestamps
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is reviewing the data protection controls for a system that stores customer payment information. The system currently uses encryption at rest and in transit, but there is no data classification scheme. The analyst wants to ensure that the protection controls are appropriate for the data sensitivity. Which action should the analyst take FIRST?

   • AReview access logs to see who has accessed the payment information.
   • BAdd additional encryption layers to the payment information.
   • CImplement a data classification scheme and label the payment information as confidential.
   • DDisable access to the payment information until a classification scheme is in place.
   Reveal Solution Discussion Select an answer first