Which of the following is an example of an unstructured data source that a data discovery tool would scan?

A CSV file exported from an enterprise application

A relational database table containing customer records

A shared network folder containing Word documents and PDFs

A data warehouse with structured sales transactions

An organization is required by law to retain financial records for seven years. After that period, the records must be securely destroyed. The organization also wants to ensure that the disposal process is auditable. Which approach should they take?

Use a data classification scheme to label records as 'retain' or 'destroy'.

Implement a retention policy that automatically deletes records after seven years and logs the deletion for audit purposes.

Keep records indefinitely to avoid any risk of premature deletion.

Manually delete records when the legal department approves.

A company allows employees to transfer files between a cloud storage service and their personal devices. The company must comply with data residency laws that require data to remain in a specific country. They also need to prevent sensitive data from being copied to personal devices. The security team is considering multiple controls. Which combination of controls best balances usability and compliance?

Use a VPN for all transfers and assume the VPN ensures data remains in the required country.

Configure the cloud storage to use a region in the required country, and implement a DLP policy that blocks downloads of sensitive data to personal devices.

Disable all downloads from the cloud storage service.

Encrypt all data in the cloud and allow unrestricted downloads.

A company is creating a data governance framework. They need to assign responsibility for data classification and ensure that data retention policies are enforced. Which roles and responsibilities should they define?

A single data owner who handles all classification and retention tasks.

The IT department classifies data and the legal department enforces retention.

No formal roles; employees are expected to follow policies voluntarily.

Data stewards who classify data, and data custodians who enforce retention and disposal policies.

What is the primary purpose of Data Loss Prevention (DLP) controls?

To prevent unauthorized access, use, or transmission of sensitive data

To ensure data is backed up regularly

GIAC Defensible Security Architect

Domain 4Objective 2

Data Discovery, Governance, and Mobility Management GDSA Practice Questions (Page 4)

Part of the Data Protection and Governance domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 16–20

16foundation · easy
Which of the following is an example of an unstructured data source that a data discovery tool would scan?
Select an answer first
17application · medium
An organization is required by law to retain financial records for seven years. After that period, the records must be securely destroyed. The organization also wants to ensure that the disposal process is auditable. Which approach should they take?
Select an answer first
18expert · hard
A company allows employees to transfer files between a cloud storage service and their personal devices. The company must comply with data residency laws that require data to remain in a specific country. They also need to prevent sensitive data from being copied to personal devices. The security team is considering multiple controls. Which combination of controls best balances usability and compliance?
Select an answer first
19application · medium
A company is creating a data governance framework. They need to assign responsibility for data classification and ensure that data retention policies are enforced. Which roles and responsibilities should they define?
Select an answer first
20foundation · easy
What is the primary purpose of Data Loss Prevention (DLP) controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.