Data-Centric Security GDSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A global company is moving sensitive HR data to a multi-tenant SaaS application. They have strict data residency requirements: data must remain in the EU. They also need to ensure that the SaaS provider cannot access the data in plaintext, and that their administrators can revoke access for a terminated employee within minutes. Which combination of controls should they implement?

   • AUse the SaaS provider's EU data residency option and rely on the provider's encryption at rest.
   • BUse client-side encryption with customer-managed keys and integrate with the provider's SCIM API for automated user deprovisioning.
   • CStore the data in an on-premises database and use the SaaS application only for display.
   • DUse a VPN to connect to the SaaS provider and enforce IP restrictions.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A university is implementing a data classification scheme for research data. They need to ensure that files containing personally identifiable information (PII) are automatically labeled and that access to these files is restricted to authorized research staff. Which approach should they take?

   • AUse a data classification tool that scans file content for PII patterns and automatically applies a 'Confidential' label, then configure access policies based on that label.
   • BRequire all researchers to manually classify their files and submit a request to IT to set permissions.
   • CStore all research data in a separate network share and grant access only to the research department.
   • DEncrypt all research files with a single encryption key and share the key with all research staff.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary function of a Data Loss Prevention (DLP) system?

   • ATo monitor, detect, and prevent unauthorized data exfiltration or leakage
   • BTo provide backup and recovery for critical data
   • CTo manage user access permissions to files and folders
   • DTo encrypt all data stored in the cloud
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A government agency must retain certain records for 10 years, but also has a legal hold that requires preserving all records related to an ongoing investigation, even if they would normally be deleted. The agency uses an automated data lifecycle management system that deletes data when its retention period expires. How should they configure the system to comply with both requirements?

   • AMove the investigation records to a separate storage system that has no retention policy.
   • BApply a retention label with a 10-year period to the records, and then place a legal hold on the specific records related to the investigation to prevent their deletion.
   • CDisable the automated deletion feature and rely on manual deletion after the investigation ends.
   • DExtend the retention period for all records to 20 years to ensure the investigation records are preserved.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A software company stores source code in a cloud-based Git repository. The security team wants to protect the code at rest and in transit, and also ensure that if a developer's laptop is stolen, the source code cannot be read from the local clone. Which set of controls should they implement?

   • ARequire developers to use SSH keys for authentication and disable password authentication.
   • BStore the source code in an encrypted archive and require developers to decrypt it manually before each use.
   • CEnable encryption at rest for the repository, require TLS for all Git operations, and use full-disk encryption on developer laptops.
   • DUse a VPN for all Git operations and restrict access to the repository from specific IP addresses.
   Reveal Solution Discussion Select an answer first