Discovering and Storing Sensitive Data GCLD Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which cloud service capability allows customers to use their own encryption keys to encrypt data at rest in cloud storage?

   • ACustomer-managed keys (CMK) with a cloud key management service
   • BServer-side encryption with provider-managed keys
   • CClient-side encryption with a passphrase
   • DTransport Layer Security (TLS) for data in transit
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is required to delete customer data upon request, but must also retain audit logs for five years. The customer data is stored in a cloud database and the audit logs are stored in cloud object storage. What should the security team implement?

   • AConfigure the database to support immediate deletion of customer records and apply a retention policy to the audit log storage that keeps logs for five years.
   • BEncrypt the customer data and the audit logs, and rely on encryption to satisfy both requirements.
   • CApply a five-year retention policy to the database and the audit log storage to simplify management.
   • DDelete the audit logs immediately when customer data is deleted to avoid retaining unnecessary data.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which method is considered a secure deletion technique for sensitive data stored in cloud object storage?

   • ADeleting the data and then overwriting the storage media with zeros
   • BRenaming the file to a non-sensitive name
   • CMoving the data to a different storage class
   • DSimply deleting the object from the storage bucket
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company wants to automate the protection of sensitive data in a cloud storage bucket. The automation must discover new sensitive data, classify it, encrypt it, and apply a retention policy. The team wants to minimize the time between data upload and protection. Which approach should they use?

   • AEnable default encryption on the bucket and rely on the storage service's built-in classification and retention features.
   • BUse a scheduled job that runs every 24 hours to scan the bucket, classify, encrypt, and apply retention policies.
   • CCreate a manual process where users classify and encrypt data before uploading, and apply retention policies manually.
   • DUse an event-driven cloud function that triggers on new object uploads, performs content inspection, applies classification labels, encrypts the object, and sets a retention policy.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A healthcare organization is migrating patient records to a cloud object storage service. The security team needs to automatically identify any stored files that contain protected health information (PHI) and apply a confidentiality label to them. The organization uses a cloud-native data classification tool that supports content inspection. Which approach should the security team implement to meet this requirement?

   • AEnable server-side encryption on the storage bucket and rely on the encryption key to indicate PHI classification.
   • BCreate a lifecycle rule that deletes any file older than 90 days to reduce the chance of PHI being stored.
   • CManually review the bucket inventory and apply labels to files based on the folder naming convention used by the source system.
   • DConfigure a discovery job that scans the bucket using built-in sensitive data types for health information and automatically applies a confidentiality label to matching files.
   Reveal Solution Discussion Select an answer first