Using Sensitive Data GCLD Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which technique is commonly used to redact sensitive information in documents or logs?

   • ADeleting the document
   • BEncrypting the entire document
   • CReplacing the sensitive text with asterisks or placeholders
   • DCompressing the document
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company stores sensitive data in a cloud database and uses a key management service (KMS) to manage encryption keys. The security team wants to ensure that only a specific application can decrypt the data, and that the keys are rotated regularly. They also want to minimize the risk of key compromise. Which approach should they take?

   • AUse cloud-provider-managed keys and rely on the provider's default rotation schedule.
   • BStore the encryption keys in the application's source code for easy access.
   • CUse customer-managed keys in the KMS, grant the application's service account decrypt permission, and configure automatic key rotation.
   • DEncrypt the data with a static key and never rotate it to avoid complexity.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary technique used by data discovery tools to identify sensitive data in cloud storage?

   • ANetwork traffic analysis
   • BUser behavior analytics
   • CVulnerability scanning
   • DContent inspection and pattern matching
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A software development team needs to test a new feature that uses customer email addresses. The production database contains real emails, but the team must not see real emails. The test environment also needs to maintain the ability to send test emails to a controlled test mailbox. Which approach should be used?

   • AGrant the development team read-only access to the production email column.
   • BEncrypt the email addresses in the test environment and decrypt them only when sending emails.
   • CUse a subset of production data that contains only email addresses of users who have opted out of communications.
   • DMask the email addresses in the test environment by replacing them with fictional addresses that route to a test mailbox.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is an example of personally identifiable information (PII) that a cloud security professional must protect?

   • AA product's model number
   • BA server's IP address
   • CA customer's social security number
   • DA company's public website URL
   Reveal Solution Discussion Select an answer first