A company stores sensitive customer data in Azure Blob Storage. The security team wants to detect when a large number of blobs are downloaded in a short period, which could indicate data exfiltration. They also need to retain the evidence for forensic analysis. What should they configure?

Enable Azure Defender for Storage and rely on its built-in anomaly detection alerts.

Enable diagnostic settings to send storage logs to a Log Analytics workspace and create an alert rule for high-volume read operations.

Apply a lifecycle management policy to delete blobs older than 30 days.

Use Azure Monitor to track the number of successful requests and set a budget alert.

What is the purpose of a data retention policy?

To define how long data must be kept and when it should be deleted

To back up data to another region

Why is it important to enable logging for data access in cloud storage?

To track who accessed data, when, and from where, for security auditing and forensics

To improve data storage performance

A financial services company stores customer account data in an AWS S3 bucket encrypted with SSE-S3. A new compliance mandate requires that the company retain direct control over the encryption keys and be able to rotate them independently of AWS. Which approach should the security team implement?

Switch the bucket to SSE-S3 and enable S3 versioning to preserve previous encrypted versions.

Use S3 Object Lock with a compliance retention period to prevent objects from being deleted.

Apply a bucket policy that denies all access unless the request includes an encryption header.

Enable S3 default encryption with SSE-KMS using a customer-managed key and configure automatic key rotation.

In which scenario is tokenization most commonly used?

Authenticating users to a cloud application

Backing up data to a remote cloud storage

Encrypting data in transit over the internet

Payment card processing to reduce the scope of PCI DSS compliance

GIAC Public Cloud Security

Domain 2Objective 1

Cloud Data Protection GPCS Practice Questions (Page 2)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

13concepts

Questions 6–10

6application · medium
A company stores sensitive customer data in Azure Blob Storage. The security team wants to detect when a large number of blobs are downloaded in a short period, which could indicate data exfiltration. They also need to retain the evidence for forensic analysis. What should they configure?
Select an answer first
7foundation · easy
What is the purpose of a data retention policy?
Select an answer first
8foundation · easy
Why is it important to enable logging for data access in cloud storage?
Select an answer first
9application · medium
A financial services company stores customer account data in an AWS S3 bucket encrypted with SSE-S3. A new compliance mandate requires that the company retain direct control over the encryption keys and be able to rotate them independently of AWS. Which approach should the security team implement?
Select an answer first
10foundation · easy
In which scenario is tokenization most commonly used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.