Using Sensitive Data GCLD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is preparing for a security audit and needs to show that it knows where all sensitive data is stored and who can access it. What should the company have in place?

   • AA network diagram showing all subnets and firewalls.
   • BA data loss prevention policy that blocks all external sharing of sensitive data.
   • CA comprehensive data inventory that includes storage locations, data owners, and access permissions.
   • DAn encryption key management policy that requires all data to be encrypted.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization is migrating patient records to a cloud object storage service. The security team needs to identify where protected health information (PHI) resides across existing on-premises file shares and cloud buckets before designing protection controls. Which approach should the team use first?

   • AApply a data loss prevention (DLP) policy to all cloud buckets to block any upload containing a patient identifier.
   • BEncrypt all files in the cloud buckets with a customer-managed key to protect PHI from unauthorized access.
   • CDeploy a data discovery scanner that indexes both on-premises shares and cloud buckets, using pattern matching for PHI fields such as patient IDs and diagnosis codes.
   • DCreate a data inventory by asking each department to manually report which files contain patient information.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of sensitive data is specifically regulated by the Health Insurance Portability and Accountability Act (HIPAA) in cloud environments?

   • ACredit card numbers
   • BPersonally identifiable information (PII)
   • CEducational records
   • DProtected health information (PHI)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A European e-commerce company processes customer orders and stores personal data in a cloud database. To comply with GDPR, the company must be able to demonstrate where personal data resides and how it flows. What should the company implement?

   • AA data inventory and mapping process that documents all storage locations, data flows, and access points for personal data.
   • BA firewall that blocks all traffic to non-EU countries.
   • CA data masking solution that anonymizes all personal data in the production database.
   • DA data loss prevention policy that prevents all copies of personal data.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company needs to provide a dataset to a third-party analytics firm for research. The dataset contains customer names, addresses, and purchase history. The legal team requires that the data cannot be used to identify individual customers. What should the company do before sharing the dataset?

   • AEncrypt the dataset and share the decryption key with the analytics firm.
   • BApply data masking to replace names and addresses with pseudonyms while preserving the purchase history for analysis.
   • CShare the dataset as-is and rely on a non-disclosure agreement to prevent misuse.
   • DRemove all purchase history and share only names and addresses.
   Reveal Solution Discussion Select an answer first