Discovering and Storing Sensitive Data GCLD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An e-commerce company must delete customer personal data after 30 days of account closure, but retain transaction records for tax purposes for five years. The data is stored in object storage. Which approach ensures both requirements are met automatically?

   • AStore all data in a single bucket with no lifecycle policies and review data periodically.
   • BManually delete personal data each month and rely on backups to retain transaction records.
   • CTag objects with retention metadata and configure lifecycle rules to delete personal data after 30 days and transaction records after five years.
   • DApply a single retention policy to all objects that deletes everything after five years.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of a DLP control that prevents sensitive data from leaving the organization?

   • AEncrypting data at rest using AES-256
   • BBlocking email attachments that contain credit card numbers
   • CRegularly backing up data to a different region
   • DRequiring multi-factor authentication for cloud console access
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the main benefit of automating data protection processes such as discovery, classification, and encryption?

   • AEliminating the need for security monitoring
   • BGuaranteeing that no data will ever be breached
   • CReducing the need for encryption keys
   • DEnsuring consistent and scalable protection across the cloud environment
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company uses a cloud KMS to encrypt data in multiple services. The security team must ensure that only specific applications can decrypt data, while administrators can manage keys but not decrypt data. The team also needs to rotate keys without disrupting applications. Which configuration best meets these requirements?

   • AGrant all users the key admin role and rely on application-level permissions to control decryption.
   • BCreate separate IAM roles for key administrators and crypto users, and use key aliases for applications to reference the current key version.
   • CUse a single key for all services and rotate it manually during maintenance windows.
   • DDisable key rotation and grant applications direct access to the key material.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has a cloud storage bucket that contains sensitive data. The security team wants to ensure that access is monitored and that any unusual access patterns trigger an alert. What should they configure?

   • AEnable encryption on the bucket and rely on the encryption to prevent unauthorized access.
   • BEnable audit logging on the bucket and create a monitoring alert that triggers on anomalous access patterns, such as a sudden increase in downloads.
   • CGrant access to the bucket only to a small group of users and rely on the small group size to ensure security.
   • DCreate a lifecycle policy that deletes objects after 30 days to reduce the window for unauthorized access.
   Reveal Solution Discussion Select an answer first