A company stores sensitive data in a cloud database and must protect it at rest. The security team wants to use customer-managed keys but is concerned about the risk of losing access to the keys, which would make the data unrecoverable. They also want to minimize the chance of a single point of failure. Which approach best addresses these concerns?

Use provider-managed keys to avoid the risk of losing customer-managed keys.

Disable key rotation and rely on a single static key to simplify management.

Store a copy of the customer-managed key in a secure file share alongside the database.

Use a cloud KMS with customer-managed keys and enable key versioning, automatic rotation, and multi-region replication of the key.

Which cloud storage option is most appropriate for storing highly sensitive data that requires granular access control and integration with existing identity management systems?

Object storage with identity-based access policies

Cold archival storage with no access controls

A security team manages encryption keys for a cloud environment. They need to rotate a key that is used to encrypt a large volume of data. The team is concerned about the cost and time of re-encrypting all data. Which approach should they take?

Manually re-encrypt all data with a new key over a weekend to minimize disruption.

Enable automatic key rotation on the KMS key and rely on the KMS to re-encrypt data with the new key version.

Create a new key and update the application configuration to use the new key, leaving the old data encrypted with the old key.

Disable the old key and create a new key, then copy all data to a new storage location encrypted with the new key.

Why is monitoring access to sensitive data important in a cloud environment?

To reduce the cost of data storage

To automatically encrypt data when it is accessed

To detect and investigate unauthorized access attempts or anomalies

To improve the speed of data retrieval

What is the primary consideration when selecting a cloud storage service for sensitive data that must comply with data residency requirements?

The color scheme of the cloud provider's console

The geographical region where the storage service is hosted

The number of availability zones in the region

The storage service's API compatibility with on-premises systems

GIAC Cloud Security Essentials

Domain 5Objective 1

Discovering and Storing Sensitive Data GCLD Practice Questions (Page 1)

Part of the Data Protection and Automation domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

9concepts

Questions 1–5

1expert · hard
A company stores sensitive data in a cloud database and must protect it at rest. The security team wants to use customer-managed keys but is concerned about the risk of losing access to the keys, which would make the data unrecoverable. They also want to minimize the chance of a single point of failure. Which approach best addresses these concerns?
Select an answer first
2foundation · easy
Which cloud storage option is most appropriate for storing highly sensitive data that requires granular access control and integration with existing identity management systems?
Select an answer first
3expert · hard
A security team manages encryption keys for a cloud environment. They need to rotate a key that is used to encrypt a large volume of data. The team is concerned about the cost and time of re-encrypting all data. Which approach should they take?
Select an answer first
4foundation · easy
Why is monitoring access to sensitive data important in a cloud environment?
Select an answer first
5foundation · easy
What is the primary consideration when selecting a cloud storage service for sensitive data that must comply with data residency requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.