Using Sensitive Data GCLD Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large enterprise uses a cloud collaboration platform where employees share files. The security team wants to prevent credit card numbers from being shared externally while allowing internal sharing. They also need to know if any files containing credit card numbers have already been shared externally. Which approach best meets both requirements?

   • AAudit all sharing events and manually review logs for potential credit card data exposure.
   • BDeploy a DLP policy that scans files for credit card patterns, blocks external sharing, and reports on existing external shares.
   • CEncrypt all files in the collaboration platform and require a second factor for external access.
   • DDisable external sharing for all users and rely on user training to avoid sharing sensitive data.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A cloud environment hosts a database containing PHI. The security team wants to ensure that only healthcare providers with a specific role can access the data, and that all access is logged for auditing. Which combination of controls should be implemented?

   • AAllow all authenticated users to access the database and rely on the data classification label to remind them of sensitivity.
   • BCreate a role-based access control policy that grants the 'Healthcare Provider' role read access to the database, and enable detailed audit logging on the database.
   • CEncrypt the database and provide the encryption key to all users who need access.
   • DUse a data loss prevention policy to block any query that returns more than 100 rows.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary goal of a Data Loss Prevention (DLP) policy in a cloud environment?

   • ATo encrypt all data at rest
   • BTo prevent unauthorized access or exfiltration of sensitive data
   • CTo automate data backup processes
   • DTo improve data storage efficiency
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is implementing a DLP solution to protect sensitive data in a cloud email service. The security team wants to prevent sensitive data from being sent to external recipients while allowing internal sharing. They also need to ensure that any blocked attempts are logged for compliance. Which configuration should be used?

   • AEmail encryption for all external emails containing sensitive data.
   • BDLP rules that inspect email content for sensitive data patterns, block external sends, and log all blocked attempts.
   • CDLP rules that quarantine all emails containing sensitive data, including internal emails.
   • DAudit logging of all email sends without any content inspection.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A cloud security team needs to detect unauthorized access to a database containing financial records. They want to know who accessed the data, when, and from which IP address. Which control should be prioritized?

   • AEnable detailed audit logging on the database and integrate the logs with a centralized monitoring system.
   • BApply encryption to the database and store the keys in a hardware security module.
   • CConfigure a network access control list to restrict database access to specific IP ranges.
   • DImplement data masking so that financial records are hidden from unauthorized users.
   Reveal Solution Discussion Select an answer first