A healthcare organization stores patient records in an Azure Blob Storage account. They must ensure that if a storage account key is compromised, the data remains unreadable. They also need to enforce that only authorized applications can access the data, and they want to minimize key management overhead. Which approach best meets these requirements?

Enable Azure Storage Service Encryption with customer-managed keys stored in Azure Key Vault.

Use Azure AD authentication with managed identities and enable infrastructure encryption for the storage account.

Store the data in an Azure SQL Database with Transparent Data Encryption and Always Encrypted.

Encrypt the data client-side before writing to Blob Storage, and use Azure AD authentication with managed identities.

A company is designing a data-centric security architecture for a hybrid cloud environment. The company wants to use a cloud key management service (KMS) to manage encryption keys, but the compliance team requires that the cloud provider cannot access the plaintext keys. The company also wants to minimize the performance impact of encryption on frequently accessed data. Which approach should they choose?

Use a single long-lived encryption key for all data and store it in the cloud KMS.

Use cloud KMS with a software-generated key that is stored in the provider's database.

Use envelope encryption with a cloud KMS that stores the master key in a hardware security module (HSM) that the provider cannot export, and cache the data encryption keys locally.

Use client-side encryption with a key stored on-premises and never use the cloud KMS.

A company has a DLP policy that blocks the transfer of files containing credit card numbers to external destinations. However, they discover that employees are bypassing the DLP by splitting the data into multiple smaller files that individually do not trigger the policy. What is the most effective way to address this bypass?

Use encryption on all files to prevent DLP from reading them.

Implement a DLP policy that correlates multiple file transfers from the same user within a short time window and aggregates the data content.

Block all file transfers to external destinations.

Increase the DLP sensitivity threshold to catch smaller amounts of data.

A legal firm shares confidential merger documents with external counsel. They need to ensure that the documents cannot be forwarded, printed, or screenshotted, and that access can be revoked even after the files are downloaded. Which technology should they use?

Send the documents via a secure file transfer service with a link that expires in 24 hours.

Use Azure Information Protection with a custom protection template that disables forwarding, printing, and screenshots, and allows revocation.

Encrypt the documents with a password and share the password separately.

Use a digital signature to ensure the document is not tampered with.

GIAC Defensible Security Architect

Domain 4Objective 1

Data-Centric Security GDSA Practice Questions (Page 9)

Part of the Data Protection and Governance domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

10concepts

Questions 41–45

41application · medium
A healthcare organization stores patient records in an Azure Blob Storage account. They must ensure that if a storage account key is compromised, the data remains unreadable. They also need to enforce that only authorized applications can access the data, and they want to minimize key management overhead. Which approach best meets these requirements?
Select an answer first
42expert · hard
A company is designing a data-centric security architecture for a hybrid cloud environment. The company wants to use a cloud key management service (KMS) to manage encryption keys, but the compliance team requires that the cloud provider cannot access the plaintext keys. The company also wants to minimize the performance impact of encryption on frequently accessed data. Which approach should they choose?
Select an answer first
43expert · hard
A company has a DLP policy that blocks the transfer of files containing credit card numbers to external destinations. However, they discover that employees are bypassing the DLP by splitting the data into multiple smaller files that individually do not trigger the policy. What is the most effective way to address this bypass?
Select an answer first
44application · medium
A legal firm shares confidential merger documents with external counsel. They need to ensure that the documents cannot be forwarded, printed, or screenshotted, and that access can be revoked even after the files are downloaded. Which technology should they use?
Select an answer first
45foundation · easy
In the data lifecycle, which phase involves the secure removal of data that is no longer needed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Data-Centric Security GDSA Practice Questions (Page 9)

Questions 41–45

A legal firm shares confidential merger documents with external counsel. They need to ensure that the documents cannot be forwarded, printed, or screenshotted, and that access can be revoked even after the files are downloaded. Which technology should they use?

In the data lifecycle, which phase involves the secure removal of data that is no longer needed?

Keep studying — Data Protection and Governance