Data-Centric Security GDSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A manufacturing company collects sensor data from its production lines. The data is initially stored in a high-performance database for real-time monitoring, then moved to a data lake for long-term analytics, and finally archived to cold storage after 5 years. They need to ensure that the data is encrypted at every stage and that deletion is secure. Which approach should they use?

   • AEncrypt data only in the high-performance database, since the data lake and cold storage are less critical.
   • BEncrypt data at each stage using the storage service's native encryption, and use a purge process that overwrites data before deletion.
   • CUse the same encryption key for all stages to simplify management.
   • DArchive the data in its original format without encryption to ensure compatibility.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is migrating its customer database to a public cloud object storage service. The security team must ensure that the data is protected at rest and that access is controlled based on the sensitivity labels assigned to each object. Which combination of controls should they implement?

   • AEnable server-side encryption for the storage bucket and use bucket policies that reference object tags or labels to grant access.
   • BUse client-side encryption and share the encryption keys with all users who have access to the bucket.
   • CRely on the cloud provider's default encryption and use a single IAM role for all employees.
   • DStore the data in a private on-premises environment instead of the public cloud to avoid shared responsibility issues.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A hospital is designing a data-centric security architecture for its electronic health records (EHR) system. The system must support emergency access where a clinician can override normal access controls to view a patient's record during a life-threatening situation. The override must be recorded and reviewed. The architecture must also enforce least privilege for routine access. Which design best meets these requirements?

   • ARequire a second clinician to approve every access request, including emergencies.
   • BGrant all clinicians full access to all patient records and rely on audit logs to detect misuse.
   • CImplement ABAC for routine access with a 'break-glass' procedure that grants temporary elevated access, logs the override, and requires post-hoc review.
   • DUse RBAC with a single 'clinician' role that includes an 'emergency' permission bit that is always enabled.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's DLP solution flags an employee who is uploading customer data to a personal cloud storage account. The employee claims it is for legitimate work-from-home purposes. What should the security team do first?

   • AIgnore the alert because the employee claims it is legitimate.
   • BImmediately block the employee's access to all cloud storage and report them to HR.
   • CReview the DLP incident details, including the data classification and the employee's role, to determine if the upload violates policy.
   • DChange the DLP policy to allow uploads to personal cloud storage for all employees.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services firm stores customer account numbers in a legacy database that cannot be modified to support field-level encryption. The compliance team requires that the data be unreadable if the database backup is stolen, but application developers still need to perform exact-match lookups on the account numbers for daily operations. Which data protection approach best meets these requirements?

   • AImplement format-preserving encryption on the account number column using an application-side proxy.
   • BEncrypt the entire database with transparent data encryption (TDE).
   • CApply dynamic data masking at the database view layer so only authorized users see full account numbers.
   • DUse tokenization with a token vault and replace account numbers with random tokens in the database.
   Reveal Solution Discussion Select an answer first