In a data-centric security architecture, where are security controls typically integrated?

Primarily in the database layer

Across applications, databases, and storage systems

A hospital wants to design a data-centric security architecture for its electronic health records (EHR) system. The system consists of a web application, a database, and a file storage for scanned documents. They need to ensure that patient data is protected across all layers, and that access is audited. Which architecture best aligns with data-centric principles?

Encrypt the database and file storage, use TLS for web traffic, and implement RBAC for application access.

Use a VPN for all remote access and require multi-factor authentication for all users.

Apply sensitivity labels to all patient data, encrypt data at rest and in transit, use ABAC for fine-grained access, and enable auditing on all data access.

Place the web app, database, and file storage in a private network and use a firewall to block external access.

Which statement best describes the core principle of data-centric security?

Security is enforced by requiring strong passwords for all user accounts.

Security controls are applied to the data itself, following it wherever it resides or travels.

Security relies on the physical security of the data center where the data is stored.

Security is achieved by segmenting the network into zones with strict firewall rules.

A company is evaluating its security strategy. They currently rely on network segmentation and firewalls to protect data. They want to adopt a data-centric security approach. Which change best reflects this shift?

Implement data classification, encryption, and access controls that follow the data regardless of location.

Move all data to a private cloud to avoid public cloud risks.

Add more firewalls and intrusion prevention systems to strengthen the perimeter.

Use a SIEM to monitor network traffic for anomalies.

GIAC Defensible Security Architect

Domain 4Objective 1

Data-Centric Security GDSA Practice Questions (Page 6)

Part of the Data Protection and Governance domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
In a data-centric security architecture, where are security controls typically integrated?
Select an answer first
27application · medium
A hospital wants to design a data-centric security architecture for its electronic health records (EHR) system. The system consists of a web application, a database, and a file storage for scanned documents. They need to ensure that patient data is protected across all layers, and that access is audited. Which architecture best aligns with data-centric principles?
Select an answer first
28foundation · easy
Which statement best describes the core principle of data-centric security?
Select an answer first
29application · medium
A company is evaluating its security strategy. They currently rely on network segmentation and firewalls to protect data. They want to adopt a data-centric security approach. Which change best reflects this shift?
Select an answer first
30foundation · easy
Which term describes the ability of a rights management system to enforce policies on a document even after it has been downloaded to a user's device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Data-Centric Security GDSA Practice Questions (Page 6)

Questions 26–30

In a data-centric security architecture, where are security controls typically integrated?

Which statement best describes the core principle of data-centric security?

A company is evaluating its security strategy. They currently rely on network segmentation and firewalls to protect data. They want to adopt a data-centric security approach. Which change best reflects this shift?

Which term describes the ability of a rights management system to enforce policies on a document even after it has been downloaded to a user's device?

Keep studying — Data Protection and Governance