Discovering and Storing Sensitive Data GCLD Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An e-commerce company must retain customer order records for seven years to meet tax regulations, but must delete payment card data after the transaction is fully settled. The company stores both types of data in the same cloud storage bucket. What should the security team implement to satisfy both requirements?

   • AManually delete payment card data each month and rely on the default bucket policy to delete order records after seven years.
   • BSeparate the data into different buckets or use object tags to apply different lifecycle policies: delete payment data after settlement and retain order records for seven years.
   • CApply a single lifecycle policy that deletes all objects in the bucket after seven years.
   • DEncrypt the payment card data and keep it in the same bucket for seven years to simplify management.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A multinational company must classify data according to regulatory requirements that vary by region. Some data is subject to strict privacy laws, while other data has no special handling requirements. The security team needs a classification scheme that supports automated protection decisions. What should they implement?

   • AClassify data based solely on the storage location, ignoring content sensitivity.
   • BDefine sensitivity levels (e.g., public, internal, confidential, restricted) and map each level to regulatory requirements and protection controls.
   • CUse a single classification label for all data to simplify management.
   • DApply the strictest classification to all data regardless of actual sensitivity.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of encryption at rest for sensitive data stored in cloud services?

   • ATo speed up data retrieval times
   • BTo protect data from unauthorized access if the underlying storage is compromised
   • CTo enable data sharing with external parties
   • DTo reduce storage costs by compressing data
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company wants to automate the protection of sensitive data across multiple cloud services. The security team must ensure that any new sensitive data is discovered, classified, encrypted, and monitored without manual intervention. However, the team also needs to avoid over-provisioning access and keep operational costs low. Which approach best meets these goals?

   • AEnable encryption on all services and rely on encryption as the sole protection mechanism.
   • BGrant all security team members broad access to all services to simplify automation.
   • CUse separate manual processes for discovery, classification, encryption, and monitoring to maintain control.
   • DImplement a centralized automation pipeline that runs discovery scans, applies classification labels, enables encryption, and sets up monitoring alerts, with least-privilege service accounts.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary goal of a Data Loss Prevention (DLP) policy?

   • ATo monitor system performance and uptime
   • BTo detect and prevent unauthorized transmission or exposure of sensitive data
   • CTo manage user access permissions
   • DTo encrypt all data stored in the cloud
   Reveal Solution Discussion Select an answer first