Data-Centric Security GDSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key characteristic of a data-centric security architecture compared to a traditional perimeter-based architecture?

   • AIt eliminates the need for encryption.
   • BIt focuses on protecting the data itself, regardless of its location.
   • CIt relies on a single firewall to protect all data.
   • DIt requires all data to be stored in a central repository.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is migrating its on-premises file servers to Microsoft 365 SharePoint Online. They want to ensure that data-centric security principles are maintained in the cloud. Which combination of controls should they implement?

   • AEnable multi-factor authentication for all users and rely on Azure AD Conditional Access.
   • BUse a VPN to connect to SharePoint Online and restrict access to corporate IP addresses.
   • CApply sensitivity labels to documents and enable Microsoft Purview Data Loss Prevention policies.
   • DRely on SharePoint Online's default sharing settings and external sharing controls.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In attribute-based access control (ABAC), what is the primary basis for granting access to a resource?

   • AA combination of attributes such as user, resource, and environment
   • BThe user's role within the organization
   • CThe time of day the access request is made
   • DThe user's position in the organizational hierarchy
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A financial regulator requires a bank to prevent the exfiltration of customer data via email, but the bank's DLP solution currently only inspects email headers and attachments for keywords. The bank has a high volume of legitimate emails that contain customer account numbers in the body. The DLP team must reduce false positives while still detecting actual data loss. Which approach should they take?

   • ABlock all emails that contain any sequence of 10 or more digits.
   • BIncrease the keyword list to include all possible variations of account numbers.
   • CImplement exact data matching (EDM) using a fingerprint of the customer database, and configure the DLP to flag emails that contain a threshold number of matching records.
   • DDisable the DLP for emails and rely on user training to prevent data loss.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A media company distributes confidential pre-release movie scripts to reviewers. The scripts are PDF files, and the company wants to prevent reviewers from copying text, printing, or taking screenshots. The reviewers use a variety of devices, including some that do not support the company's chosen DRM plugin. The company also needs to track who accessed the document and when. Which approach is most effective?

   • AUse a DLP solution to block the PDF from being sent outside the company's email domain.
   • BEmbed a digital watermark with the reviewer's name in the PDF and rely on legal action if it leaks.
   • CConvert the PDF to a password-protected image and send it via email.
   • DUse a rights management service that encrypts the PDF and enforces usage policies in a viewer that supports the service, while also logging access events.
   Reveal Solution Discussion Select an answer first