A company is implementing a data classification program. They need to ensure that all data is classified based on its sensitivity and regulatory requirements. They also want to automatically apply protections, such as encryption, to data classified as 'restricted'. Which approach should they take?

Ask employees to manually classify their files and apply encryption themselves.

Encrypt all data regardless of classification.

Use a DLP solution that blocks all transfers of data without classification.

Use a data discovery tool that scans data, applies classification labels based on content and context, and integrates with a DLP solution to enforce protections.

A healthcare organization is preparing for a compliance audit. The security team needs to identify all locations where patient records are stored, including file shares, databases, and email attachments. They also need to ensure that any file containing patient data is labeled with the appropriate classification. Which approach best satisfies both requirements?

Encrypt all files on the file server and assume that encryption implies classification.

Deploy a data discovery tool that scans on-premises and cloud repositories, then apply classification labels based on content inspection.

Ask all employees to manually identify and label files containing patient data.

Use a DLP solution that blocks all outbound email containing patient data, without scanning internal storage.

A company is required by law to retain financial records for 7 years, but also has a policy to delete employee personal data after 3 years of termination. The company uses a single data storage platform. How should they handle these conflicting retention requirements?

Use a data discovery tool to identify all financial records and employee data, and then manually manage retention.

Apply retention labels based on data classification, with financial records labeled for 7 years and employee personal data labeled for 3 years.

Delete employee personal data after 3 years, and retain financial records for 7 years by storing them in separate systems.

Retain all data for 7 years to comply with the financial records requirement, and delete employee data after 7 years.

A legal firm handles highly confidential client documents. They want to prevent sensitive data from being sent via email to unauthorized recipients. The firm uses Microsoft 365 and has data classification labels already in place. What should they configure to meet this requirement?

Use Azure Information Protection (AIP) to apply a 'Confidential' label to all documents, but do not enforce any restrictions.

Configure an email transport rule to encrypt all outgoing emails.

Enable Microsoft Defender for Office 365 to quarantine all emails with attachments.

Create a Microsoft Purview Data Loss Prevention (DLP) policy that detects the classification label and blocks emails to external recipients.

Which of the following is a common technique used to monitor data mobility?

Configuring firewalls to block all traffic

Logging and reviewing data transfer events

GIAC Defensible Security Architect

Domain 4Objective 2

Data Discovery, Governance, and Mobility Management GDSA Practice Questions (Page 7)

Part of the Data Protection and Governance domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 31–35

31application · medium
A company is implementing a data classification program. They need to ensure that all data is classified based on its sensitivity and regulatory requirements. They also want to automatically apply protections, such as encryption, to data classified as 'restricted'. Which approach should they take?
Select an answer first
32application · medium
A healthcare organization is preparing for a compliance audit. The security team needs to identify all locations where patient records are stored, including file shares, databases, and email attachments. They also need to ensure that any file containing patient data is labeled with the appropriate classification. Which approach best satisfies both requirements?
Select an answer first
33expert · hard
A company is required by law to retain financial records for 7 years, but also has a policy to delete employee personal data after 3 years of termination. The company uses a single data storage platform. How should they handle these conflicting retention requirements?
Select an answer first
34application · medium
A legal firm handles highly confidential client documents. They want to prevent sensitive data from being sent via email to unauthorized recipients. The firm uses Microsoft 365 and has data classification labels already in place. What should they configure to meet this requirement?
Select an answer first
35foundation · easy
Which of the following is a common technique used to monitor data mobility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.