Data-Centric Security GDSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A global company is moving its customer data to a public cloud provider that offers regions in multiple countries. The company must comply with a data residency law that requires personal data of citizens to remain within the country's borders. The security team also wants to maintain encryption keys under their own control. Which approach best satisfies both requirements?

   • ASelect a cloud region located within the required country and use customer-managed keys (CMK) stored in the cloud provider's key management service (KMS) with the company as the key owner.
   • BUse a cloud region outside the country but encrypt the data with a key stored on-premises.
   • CStore the data in the cloud provider's sovereign cloud offering, but allow the provider to manage the encryption keys.
   • DUse a multi-region replication setup that copies data to a region outside the country for disaster recovery.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A government agency is implementing a data classification scheme. They have defined four levels: Public, Internal, Confidential, and Secret. They need to ensure that documents are automatically labeled based on their content and that access to Confidential and Secret documents is restricted to specific user groups. Which approach should they take?

   • ACreate separate SharePoint sites for each classification level and restrict access using SharePoint permissions.
   • BTrain employees to manually label every document before saving it.
   • CUse a DLP policy to block all sharing of documents containing sensitive data.
   • DUse Microsoft Purview Information Protection with auto-labeling policies that detect sensitive content and apply the appropriate label.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of data classification in a data-centric security program?

   • ATo reduce the storage cost of data by moving less important data to cheaper storage tiers.
   • BTo ensure that all data is backed up daily to prevent loss.
   • CTo assign a level of sensitivity to data so that appropriate protection controls can be applied.
   • DTo encrypt all data using the same algorithm to ensure consistency.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational corporation uses a data lake to store data from multiple business units. Each business unit has its own data classification scheme, and some labels conflict (e.g., one unit labels data 'Confidential' while another uses 'Restricted' for the same sensitivity level). The security team must enforce consistent access policies across the entire data lake. Which approach should they take?

   • ADisable label-based access control and rely on network segmentation between business units.
   • BCreate a unified classification taxonomy and map each business unit's labels to the common taxonomy, then enforce access policies based on the mapped labels.
   • CUse the most restrictive label from any business unit for all data.
   • DAllow each business unit to continue using its own labels and enforce policies per business unit.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team needs to detect anomalous access to sensitive data stored in Amazon S3. They have enabled CloudTrail and S3 server access logging. What additional step is essential to turn these logs into actionable security insights?

   • AUse Amazon GuardDuty to analyze the logs and generate findings for unusual access patterns.
   • BStore the logs in a separate S3 bucket with a lifecycle policy to delete them after 30 days.
   • CEnable S3 Object Lock to prevent objects from being deleted.
   • DCreate an S3 bucket policy that denies access to the logs from outside the VPC.
   Reveal Solution Discussion Select an answer first