Using Sensitive Data GCLD Practice Questions (Page 11)

Questions 51–53

1. 51foundation · easy

   Which cloud service is commonly used to monitor and log access to sensitive data in AWS?

   • AAWS Lambda
   • BAWS CloudTrail
   • CAmazon EC2
   • DAmazon S3
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security analyst notices that a large number of files containing sensitive data have been downloaded from a cloud storage bucket by a single user over a short period. The analyst needs to determine whether this is a legitimate business need or a potential exfiltration. Which action should the analyst take first?

   • AEncrypt the bucket contents to prevent further downloads.
   • BEnable data loss prevention policies to block all future downloads from the bucket.
   • CReview the user's access permissions and the audit logs for the bucket to see if the downloads are consistent with the user's role and normal behavior.
   • DImmediately revoke the user's access to the bucket to prevent further downloads.
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   A security team needs to understand how sensitive data flows through a cloud application that ingests user uploads, processes them, and stores results in a database. The team wants to identify all points where data is stored, transmitted, and accessed. What should they create?

   • AA data flow diagram that maps the movement of data between services and identifies storage locations and access points.
   • BAn access control list that grants permissions to each service.
   • CA data loss prevention policy that blocks sensitive data from being transmitted between services.
   • DAn encryption key management plan that defines how keys are rotated.
   Reveal Solution Discussion Select an answer first