Which encryption method protects data while it is being transmitted between a user's browser and a cloud application?

Symmetric key encryption for storage

What is the principle of least privilege in the context of access control for sensitive data?

Users should be granted only the minimum permissions necessary to perform their job functions

Access should be granted to all users by default

Users should have full access to all data to maximize productivity

Access should be granted based on seniority

A hospital is moving patient health records to a cloud storage service. The compliance officer requires that all PHI be protected both while stored and while transmitted between the hospital and the cloud. Which combination of controls should be implemented?

Store the data in a private cloud with no internet connectivity.

Encrypt the data at rest using cloud-managed keys and enforce TLS for all data in transit.

Apply data masking to all PHI fields before uploading to the cloud.

Use a VPN tunnel for all traffic and rely on the cloud provider's physical security for storage.

A company stores sensitive financial data in a cloud database. The security team wants to ensure that even if the underlying storage is compromised, the data remains unreadable. They also want to control which applications can access the decryption keys. Which approach should they take?

Restrict database access to a small set of IP addresses.

Enable encryption in transit using TLS for all database connections.

Use data masking to obscure the financial data in the database.

Enable encryption at rest for the database and manage the encryption keys using a cloud key management service with access controls.

What is the primary purpose of creating a data inventory and mapping for sensitive data in the cloud?

To automate the deployment of cloud resources

To improve network performance by optimizing data routing

To reduce cloud storage costs by deleting unnecessary data

To know where sensitive data resides, how it flows, and who can access it

GIAC Cloud Security Essentials

Domain 5Objective 2

Using Sensitive Data GCLD Practice Questions (Page 3)

Part of the Data Protection and Automation domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 11–15

11foundation · easy
Which encryption method protects data while it is being transmitted between a user's browser and a cloud application?
Select an answer first
12foundation · easy
What is the principle of least privilege in the context of access control for sensitive data?
Select an answer first
13application · medium
A hospital is moving patient health records to a cloud storage service. The compliance officer requires that all PHI be protected both while stored and while transmitted between the hospital and the cloud. Which combination of controls should be implemented?
Select an answer first
14application · medium
A company stores sensitive financial data in a cloud database. The security team wants to ensure that even if the underlying storage is compromised, the data remains unreadable. They also want to control which applications can access the decryption keys. Which approach should they take?
Select an answer first
15foundation · easy
What is the primary purpose of creating a data inventory and mapping for sensitive data in the cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.