Discovering and Storing Sensitive Data GCLD Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security team discovers that a contractor has access to a sensitive database and has been exporting large amounts of data. The team must immediately reduce the risk of further data exfiltration while preserving the ability to investigate the incident. Which action should be taken first?

   • AIncrease monitoring alerts and allow the contractor to continue working while observing behavior.
   • BDisable the database entirely to prevent any access, then investigate later.
   • CRevoke the contractor's access to the database and enable detailed audit logging to capture any remaining activity.
   • DChange the contractor's role to read-only access and continue monitoring.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which data classification level typically includes information that, if disclosed, could cause serious harm to an organization or individuals, such as health records or financial account numbers?

   • ARestricted
   • BInternal
   • CConfidential
   • DPublic
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A financial services firm must store customer transaction logs for seven years to meet regulatory requirements. The logs are accessed rarely but must be retrievable within 24 hours of a request. The firm also requires that the storage service encrypt data at rest by default and that access be restricted to a specific security group. Which storage option best balances these needs?

   • AFile storage with manual encryption and per-file ACLs managed by individual users.
   • BArchive storage with lifecycle policies, default encryption, and IAM-based access restrictions.
   • CStandard object storage with no lifecycle policy, default encryption, and public read access.
   • DBlock storage attached to a single VM with encryption disabled and network-level restrictions only.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A financial services company stores customer account data in a cloud object storage service. Compliance requires that encryption keys be rotated every 90 days and that the security team retain the ability to revoke access to the data immediately if a key is compromised. The company wants to minimize the administrative overhead of managing keys. Which key management approach should they choose?

   • AStore the encryption keys in a configuration file within the same storage bucket as the data, protected by bucket permissions.
   • BUse customer-managed keys stored in the cloud provider's key management service, with automated rotation enabled and access policies limited to the security team.
   • CGenerate a new key each time data is written and store all keys in a database with access restricted to the application team.
   • DUse provider-managed keys and rely on the provider's default rotation schedule, which is typically every 30 days.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company wants to prevent sensitive customer data from being emailed outside the organization. The data is stored in a cloud application, and the security team needs to detect and block such transmissions in real time. Which control should be deployed?

   • ARestrict access to the email service to a small group of users.
   • BConfigure a data loss prevention (DLP) policy that scans outbound email content and blocks messages containing sensitive patterns.
   • CSet up a monitoring alert that notifies administrators after sensitive data is emailed.
   • DEnable encryption on the email service and rely on encryption to prevent data leakage.
   Reveal Solution Discussion Select an answer first