A security analyst notices that a service account is reading a large number of records from a database containing financial data. The analyst wants to determine whether this is normal behavior or a potential exfiltration. What should the analyst do first?

Review the access logs for the database to see the pattern of queries and compare it to the service account's historical behavior.

Enable encryption on the database to protect the data from being read.

Apply a data loss prevention policy to block the service account from reading more than a certain number of records.

Immediately revoke the service account's permissions to stop any possible exfiltration.

A company has a data loss prevention (DLP) policy that blocks the sharing of credit card numbers via email. Recently, a legitimate business process was disrupted because a salesperson emailed a document containing a credit card number to a customer for payment verification. The security team needs to allow this legitimate use while still preventing unauthorized sharing. What should they do?

Disable the DLP policy for all external email to avoid disrupting business processes.

Encrypt all outgoing email and rely on the recipient's email security to protect the data.

Refine the DLP policy to allow sharing with specific approved external domains and require justification for each exception, while continuing to block other external sharing.

Increase the sensitivity threshold of the DLP policy so that only large volumes of credit card numbers are blocked.

Which access control model assigns permissions based on a user's role within an organization?

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)

Discretionary Access Control (DAC)

A financial services company stores customer transaction data in a cloud data warehouse. The compliance team requires that only authorized risk analysts can view full credit card numbers, while other employees may see only the last four digits. What should the security architect implement?

Encrypt the entire database with a cloud KMS key and give all employees the decryption key.

Classify the data as 'Confidential – Financial' and enforce role-based access control (RBAC) so only risk analysts have SELECT permission on the column containing full card numbers.

Create a separate copy of the data with full card numbers and grant access to all employees.

Apply a data masking policy that shows only the last four digits to all users, including risk analysts.

What is the primary purpose of data masking in a non-production environment?

To obscure sensitive data so that it cannot be used to identify real individuals

To reduce the size of the database

GIAC Cloud Security Essentials

Domain 5Objective 2

Using Sensitive Data GCLD Practice Questions (Page 5)

Part of the Data Protection and Automation domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 21–25

21application · medium
A security analyst notices that a service account is reading a large number of records from a database containing financial data. The analyst wants to determine whether this is normal behavior or a potential exfiltration. What should the analyst do first?
Select an answer first
22expert · hard
A company has a data loss prevention (DLP) policy that blocks the sharing of credit card numbers via email. Recently, a legitimate business process was disrupted because a salesperson emailed a document containing a credit card number to a customer for payment verification. The security team needs to allow this legitimate use while still preventing unauthorized sharing. What should they do?
Select an answer first
23foundation · easy
Which access control model assigns permissions based on a user's role within an organization?
Select an answer first
24application · medium
A financial services company stores customer transaction data in a cloud data warehouse. The compliance team requires that only authorized risk analysts can view full credit card numbers, while other employees may see only the last four digits. What should the security architect implement?
Select an answer first
25foundation · easy
What is the primary purpose of data masking in a non-production environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.