What is the purpose of monitoring data access in an organization?

To reduce the amount of data stored

To detect unauthorized access or suspicious activity

To increase the speed of data retrieval

A company is decommissioning old hard drives that contain customer PII. The drives have reached the end of their retention period and must be disposed of. The company wants to ensure the data is irrecoverable. Which method is most appropriate?

Quick format the drives and reuse them for non-sensitive data

Encrypt the drives and then format them

Delete the files and empty the recycle bin

Degauss the drives and physically destroy them

An e-commerce company runs its product catalog database in a single cloud region. The compliance team requires that the database remain available during a regional outage, and the business can tolerate up to 30 minutes of downtime. What should the company implement?

Daily snapshots stored in the same region

Asynchronous replication to a database in the same region

Synchronous replication to a database in a different region

Weekly full backups stored in a different region

Which scenario best illustrates the 'integrity' aspect of data protection?

A database is restored to its last backup after a hardware failure

A financial transaction record remains unchanged and accurate during processing

A backup is stored offsite to protect against a natural disaster

A user is able to access a file only after entering their credentials

A security auditor is reviewing whether a company's data protection controls are effective. The company stores sensitive customer data in a database and uses encryption at rest. The auditor wants to verify that only authorized personnel can access the data and that encryption is properly configured. What should the auditor review?

Database access logs and encryption key management records

Backup retention schedules only

GIAC Critical Controls Certification

Domain 4Objective 1

Data Protection GCCC Practice Questions (Page 5)

Part of the Data Protection and Recovery domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 21–25

21foundation · easy
What is the purpose of monitoring data access in an organization?
Select an answer first
22application · medium
A company is decommissioning old hard drives that contain customer PII. The drives have reached the end of their retention period and must be disposed of. The company wants to ensure the data is irrecoverable. Which method is most appropriate?
Select an answer first
23application · medium
An e-commerce company runs its product catalog database in a single cloud region. The compliance team requires that the database remain available during a regional outage, and the business can tolerate up to 30 minutes of downtime. What should the company implement?
Select an answer first
24foundation · easy
Which scenario best illustrates the 'integrity' aspect of data protection?
Select an answer first
25application · medium
A security auditor is reviewing whether a company's data protection controls are effective. The company stores sensitive customer data in a database and uses encryption at rest. The auditor wants to verify that only authorized personnel can access the data and that encryption is properly configured. What should the auditor review?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.