Discovering and Storing Sensitive Data GCLD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary function of a cloud key management service (KMS)?

   • ATo monitor network traffic for malicious activity
   • BTo centrally manage the lifecycle of encryption keys, including creation, rotation, and deletion
   • CTo store user passwords for cloud applications
   • DTo encrypt all data in transit between cloud services
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company must retain customer data for five years, but a new regulation requires that certain data be deleted after two years. The data is stored in object storage with versioning enabled. The security team needs to ensure that deleted data is not recoverable after the retention period, while still allowing recovery of accidental deletions during the retention period. Which configuration best meets these requirements?

   • AEnable versioning but do not set lifecycle policies, relying on manual deletion after the retention period.
   • BUse lifecycle policies to expire object versions after the retention period and enable object lock with retention until the required deletion date.
   • CDisable versioning and rely on backups to recover accidental deletions.
   • DSet lifecycle policies to delete all versions immediately after upload.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a large amount of unstructured data in multiple cloud storage buckets. The security team needs to identify which buckets contain sensitive data and apply DLP policies to prevent exfiltration. The team is concerned about the cost of scanning all data. What should they do first?

   • AEncrypt all buckets and rely on encryption to prevent exfiltration.
   • BRun an automated discovery scan on all buckets using sampling and content inspection to identify sensitive data, then apply DLP policies to the buckets that contain sensitive data.
   • CManually review the bucket names and apply DLP policies to buckets with 'sensitive' in the name.
   • DApply DLP policies to all buckets without scanning to ensure comprehensive coverage.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team must prevent sensitive data from leaving the corporate network via email or web uploads. They also need to allow legitimate sharing of non-sensitive data. The team wants to avoid blocking business operations. Which DLP strategy is most appropriate?

   • AEncrypt all outbound communications and assume encryption prevents data leakage.
   • BDeploy DLP policies that classify data by sensitivity and apply different actions (block, warn, allow) based on the classification and destination.
   • CMonitor outbound traffic and generate reports for manual review without blocking anything.
   • DBlock all outbound email and web uploads to ensure no sensitive data leaves the network.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to prevent sensitive data from being uploaded to a public file-sharing site. The company uses a cloud access security broker (CASB) and has classified its sensitive data. What should the security team configure in the CASB?

   • AEnable multi-factor authentication for all users accessing the file-sharing site.
   • BEncrypt all sensitive data at rest and rely on encryption to prevent exfiltration.
   • CCreate a DLP policy that inspects outbound traffic for classified sensitive data and blocks uploads to the file-sharing site.
   • DBlock all access to the file-sharing site for all users.
   Reveal Solution Discussion Select an answer first