Cloud Data Protection GPCS Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company is required by law to retain financial records for 7 years and then securely delete them. The records are stored in an Azure Storage account with immutable blobs enabled. The company wants to ensure that after the retention period, the data is permanently deleted and that deletion is logged. What should the security team configure?

   • AEnable soft delete for blobs and set a retention period of 7 years.
   • BConfigure a lifecycle management policy to delete blobs after 7 years and enable versioning.
   • CUse a legal hold policy on the blobs and manually remove the hold after 7 years.
   • DSet a time-based retention policy for 7 years on the immutable blobs, then after the period expires, delete the blobs and enable diagnostic logging for the storage account.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A global company uses Azure Active Directory (Azure AD) and stores user data in Azure Blob Storage. They must comply with data residency requirements that mandate EU user data remain in the EU. They currently have a single storage account in the EU and replicate it to a US region for DR. The compliance team is concerned about the US replication. What is the best way to maintain DR while ensuring EU data stays in the EU?

   • AUse Azure Site Recovery to replicate the storage account to the US region.
   • BKeep the US replication but apply a customer-managed key to encrypt the data.
   • CUse Azure Storage geo-redundant storage (GRS) with a paired region in the EU.
   • DDisable replication and rely on the primary EU region only.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   What does BYOK (Bring Your Own Key) allow an organization to do in a cloud environment?

   • AShare encryption keys with other customers to reduce costs
   • BUse encryption keys that the organization generates and manages, while the cloud service uses them for encryption
   • CBypass encryption entirely for performance reasons
   • DUse the cloud provider's default encryption keys for all services
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A company uses AWS S3 to store sensitive documents. They currently use SSE-S3 for encryption. A new policy requires that they use customer-managed keys and that the keys be rotated every 90 days. What is the most efficient way to meet this requirement?

   • ASwitch the bucket to SSE-KMS with a customer-managed key and enable automatic key rotation.
   • BKeep SSE-S3 and manually rotate the AWS-managed keys every 90 days.
   • CUse client-side encryption and store the key in an S3 bucket with a lifecycle policy to delete it after 90 days.
   • DEnable S3 Versioning and create a new version of each object every 90 days.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A company uses Azure VM disks encrypted with Azure Disk Encryption (ADE), which uses a Key Vault key. They need to back up these VMs using Azure Backup. The security team wants to ensure that backups are also encrypted and that the encryption keys are managed by the customer. What is the most appropriate configuration?

   • ADisable encryption on the backups because the source disks are already encrypted.
   • BEnable Azure Backup with encryption using the same Key Vault key used for ADE.
   • CExport the backups to an unencrypted storage account and rely on network security.
   • DUse a different Key Vault key for backups to avoid key management complexity.
   Reveal Solution Discussion Select an answer first