Data-Centric Security GDSA Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A healthcare organization must retain medical records for 10 years, but after that, they must be destroyed. They also need to ensure that data is available for active research for the first 2 years, then moved to long-term storage. They are using a combination of Azure SQL Database and Azure Blob Storage. What is the most cost-effective and compliant approach?

   • AStore all data in Azure Blob Storage from the beginning, using the hot tier.
   • BKeep all data in Azure SQL Database for 10 years and then delete it.
   • CArchive all data to tape and store it offsite.
   • DUse Azure SQL Database for the first 2 years, then move data to Azure Blob Storage with a lifecycle policy that transitions to cool and archive tiers, and deletes after 10 years.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is a key multi-tenant consideration when applying data-centric security in a public cloud?

   • AEnsuring that data from different tenants is not co-located on the same physical server
   • BEnsuring that data is encrypted and access controls are enforced to prevent cross-tenant access
   • CEnsuring that all tenants use the same encryption keys
   • DEnsuring that each tenant has its own dedicated network infrastructure
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A healthcare organization uses a modern data lake with fine-grained access policies. The security team wants to ensure that only users with a current 'clinician' role and a 'treatment purpose' attribute can read patient records, and that any access attempt is logged for audit. Which access governance approach should they implement?

   • AAttribute-based access control (ABAC) with policies that evaluate role and purpose attributes, integrated with the data lake's audit logging.
   • BRole-based access control (RBAC) with a single 'clinician' role that grants read access to all patient records.
   • CData classification labels applied to patient records, with access granted based on the label alone.
   • DDatabase-level permissions that grant read access to the 'clinician' group and rely on the database's native audit log.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A company is evaluating whether to adopt a data-centric security architecture. The current architecture relies heavily on network segmentation and perimeter firewalls. The company's data is increasingly shared with external partners and stored in multiple cloud services. The CISO wants to reduce the risk of data exposure when a partner's environment is compromised. Which argument best supports the move to data-centric security?

   • AData-centric security is required by all cloud providers as part of their shared responsibility model.
   • BData-centric security eliminates the need for network security controls, simplifying the overall architecture.
   • CData-centric security embeds protection into the data itself, so the data remains protected even when it resides in a partner's environment or a cloud service outside the corporate perimeter.
   • DData-centric security guarantees that data cannot be exfiltrated by insiders.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A multinational company is redesigning its security architecture. The CISO wants to ensure that data remains protected even when it is copied to a partner's cloud environment, and that security controls follow the data rather than relying solely on network boundaries. Which architectural approach best aligns with this goal?

   • AImplement a data-centric security architecture that applies encryption, access policies, and rights management directly to the data objects.
   • BUse a cloud access security broker (CASB) to monitor all traffic between the company and partner clouds.
   • CRequire all partners to sign a data processing agreement that mandates they implement equivalent security controls.
   • DStrengthen the corporate firewall and segment the network to prevent data from leaving the internal environment.
   Reveal Solution Discussion Select an answer first