Cloud Data Protection GPCS Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A software company uses a third-party support tool that captures screen recordings and logs. These logs sometimes contain customer names and email addresses. The company wants to share these logs with a development team for debugging, but must remove PII before sharing. What is the most appropriate technique?

   • AEncrypt the logs with a key that only the development team has.
   • BTokenize the PII and provide the development team with the token mapping table.
   • CDelete the logs entirely and ask the support tool vendor to provide new logs without PII.
   • DApply a redaction policy that replaces names and email addresses with placeholder values like '[REDACTED]'.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A retail company uses a cloud-based log aggregation service that collects application logs from production. The logs contain customer email addresses and credit card numbers. The company wants to share these logs with a third-party analytics vendor for performance monitoring, but must ensure that sensitive data is not exposed. Which approach should be taken?

   • AEncrypt the logs with a customer-managed key and provide the vendor with access to the key.
   • BApply a DLP policy to the vendor's access to the log bucket to block downloads.
   • CConfigure the log pipeline to redact email addresses and credit card numbers before the logs are sent to the vendor.
   • DStore the logs in a separate bucket and grant the vendor read-only access to that bucket.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company uses a cloud KMS to manage encryption keys for various services. The security team wants to ensure that keys are rotated regularly and that old keys are not used for new encryption operations. Which practice should be implemented?

   • AUse the same key for all services to simplify management.
   • BEnable automatic key rotation for the KMS keys and configure services to use the latest key version.
   • CManually rotate keys every year and update all services to use the new key.
   • DStore keys in a configuration file and rotate them by updating the file.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary function of a Data Loss Prevention (DLP) solution?

   • ATo detect and prevent unauthorized access, transfer, or leakage of sensitive data
   • BTo manage user identities and access permissions
   • CTo encrypt all data in the cloud
   • DTo provide a backup and recovery solution
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A healthcare organization is deploying a web application that transmits patient records from a mobile app to an Azure App Service backend. The security team must ensure that data is protected during transmission and that any interception attempts are detectable. Which combination of controls should be implemented?

   • AEnforce HTTPS on the App Service and enable TLS 1.2 or higher, then configure Application Gateway with a WAF policy.
   • BUse Azure Front Door with a custom domain and configure a redirect from HTTP to HTTPS.
   • CEnable Azure Defender for Cloud and set up a continuous export of security alerts to a Log Analytics workspace.
   • DPlace the App Service in a VNet and use a private endpoint to restrict access to the app.
   Reveal Solution Discussion Select an answer first