Discovering and Storing Sensitive Data GCLD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to prevent sensitive data from being emailed outside the organization. The data is stored in a cloud productivity suite and in a cloud storage service. The security team needs to detect and block attempts to share this data externally. Which control should they implement?

   • ASet the cloud productivity suite to allow external sharing only with a one-time passcode.
   • BConfigure the cloud storage service to require multi-factor authentication for all users.
   • CApply encryption to all stored data and require users to manually encrypt files before emailing them.
   • DEnable data loss prevention (DLP) policies that scan email and shared documents for sensitive data types and block external sharing.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company wants to ensure that all new objects uploaded to a cloud storage bucket are automatically encrypted and that any object containing sensitive data is automatically moved to a more restricted bucket. Which automation approach should they implement?

   • AEnable default encryption on the bucket and require users to manually move sensitive objects to the restricted bucket.
   • BUse a cloud function that triggers on new object creation, checks the object for sensitive data, encrypts it if needed, and moves it to the restricted bucket if sensitive.
   • CCreate a scheduled job that runs nightly to encrypt all objects and move any object older than 24 hours to the restricted bucket.
   • DApply a bucket policy that denies uploads of unencrypted objects and rely on the storage service's built-in classification.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why is regular rotation of encryption keys important for cloud security?

   • ATo eliminate the need for access controls on keys
   • BTo increase the speed of encryption operations
   • CTo limit the amount of data exposed if a key is compromised
   • DTo reduce the cost of key management services
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which automated technique is specifically designed to locate sensitive data such as credit card numbers or social security numbers within files stored in cloud object storage?

   • ANetwork traffic analysis to identify data exfiltration attempts
   • BStorage capacity monitoring to estimate data growth
   • CUser access logging to determine who has viewed files
   • DContent-based scanning using pattern matching and regular expressions
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company must store sensitive data that is accessed frequently for the first month, then rarely for five years. The data must be retrievable within 48 hours. The security team must minimize cost while ensuring encryption at rest and access restricted to a specific team. Which storage strategy best meets all constraints?

   • AUse block storage attached to a VM with encryption and restrict access via the VM's network.
   • BStore all data in archive storage from the start to minimize cost.
   • CStore data in standard object storage for the first month, then transition to archive storage using a lifecycle policy, with encryption and IAM restrictions.
   • DStore all data in standard object storage for five years to ensure fast retrieval.
   Reveal Solution Discussion Select an answer first