A software company develops applications that process user data. They need to ensure that data is handled appropriately from the moment it is created until it is deleted. The company wants to automate this process as much as possible. What should they implement?

Use a data discovery tool to periodically scan databases and delete data that is no longer needed.

Rely on the database administrator to manually archive and purge data based on a schedule.

Integrate data classification into the application development process and use automated retention policies to manage data throughout its lifecycle.

Store all data in a data lake and use a data governance tool to manage access, but do not implement retention policies.

A hospital is implementing a data loss prevention (DLP) strategy. They need to prevent patient health information (PHI) from being transmitted outside the organization. The hospital uses a mix of email, web, and cloud applications. What is the best way to implement DLP across these channels?

Deploy a unified DLP solution that integrates with email, web, and cloud applications, and configure policies to detect and block PHI.

Implement DLP only for email, as it is the most common channel for data exfiltration.

Use data classification labels to mark PHI and rely on users to avoid transmitting it.

Use separate DLP solutions for email, web, and cloud applications to avoid integration complexity.

What does data residency refer to?

The classification level assigned to data

The physical or geographic location where data is stored and processed

The encryption algorithm used to protect data

A global financial institution is subject to data residency regulations that require customer data to remain within the country of origin. They are planning to deploy a new customer relationship management (CRM) system. The system will be hosted in a public cloud and will need to support data processing in multiple regions. The security architect must ensure that data does not leave the country of origin. Which approach is most effective?

Deploy the CRM system in a cloud region within each country and configure data residency policies to prevent cross-border data transfers.

Use a single cloud region in a neighboring country and rely on encryption to protect data in transit.

Use a cloud access security broker (CASB) to monitor data transfers and alert on any cross-border movement.

Implement a data loss prevention (DLP) solution to block all data transfers between regions.

What is the purpose of a data retention policy?

To define how long data must be kept to meet legal, regulatory, and business requirements

To classify data based on sensitivity

To ensure data is encrypted at rest

GIAC Defensible Security Architect

Domain 4Objective 2

Data Discovery, Governance, and Mobility Management GDSA Practice Questions (Page 6)

Part of the Data Protection and Governance domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 26–30

26application · medium
A software company develops applications that process user data. They need to ensure that data is handled appropriately from the moment it is created until it is deleted. The company wants to automate this process as much as possible. What should they implement?
Select an answer first
27application · medium
A hospital is implementing a data loss prevention (DLP) strategy. They need to prevent patient health information (PHI) from being transmitted outside the organization. The hospital uses a mix of email, web, and cloud applications. What is the best way to implement DLP across these channels?
Select an answer first
28foundation · easy
What does data residency refer to?
Select an answer first
29expert · hard
A global financial institution is subject to data residency regulations that require customer data to remain within the country of origin. They are planning to deploy a new customer relationship management (CRM) system. The system will be hosted in a public cloud and will need to support data processing in multiple regions. The security architect must ensure that data does not leave the country of origin. Which approach is most effective?
Select an answer first
30foundation · easy
What is the purpose of a data retention policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.