A financial firm uses Google Workspace and wants to prevent sensitive financial data from being shared externally. They have a DLP policy that detects credit card numbers, but it only triggers a warning. The compliance team wants to enforce blocking, but the sales team needs to send credit card numbers to a specific partner for legitimate business. What is the best way to balance security and business needs?

Change the DLP policy action to 'Block' and add an exception for the partner's domain.

Block all external sharing of credit card numbers and require the sales team to use a different channel.

Keep the warning action and rely on user training to prevent sharing.

Use a data classification label to mark the data and rely on users to apply the label.

What is the primary purpose of tokenization in data protection?

To encrypt data using a symmetric key

To mask data by replacing characters with asterisks

To replace sensitive data with a non-sensitive placeholder that can be used in processing without exposing the original data

To hash data to a fixed-length value

A company stores sensitive data in an S3 bucket. The security team wants to enforce least-privilege access, but also needs to allow a third-party auditor to access the bucket for compliance reviews. The auditor should only be able to read the data, not modify it. Which configuration should be used?

Create an IAM role for the auditor with a policy that grants s3:GetObject and s3:ListBucket on the bucket, and require the auditor to assume the role using cross-account access.

Create an IAM user for the auditor with a policy that grants s3:PutObject and s3:GetObject on the bucket.

Use a presigned URL that grants write access to the auditor for a limited time.

Make the bucket public and rely on the auditor to only read the data.

Which of the following is a common method to encrypt data at rest in a cloud database?

SSL/TLS for database connections

Transparent Data Encryption (TDE)

Which protocol is the standard for encrypting data in transit between a web browser and a cloud-hosted application?

IPsec (Internet Protocol Security)

FTPS (File Transfer Protocol Secure)

GIAC Public Cloud Security

Domain 2Objective 1

Cloud Data Protection GPCS Practice Questions (Page 3)

Part of the Cloud Platform and Service Security domain, which makes up ~60% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~30–48 in this domain), expect 6–10 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

13concepts

Questions 11–15

11expert · hard
A financial firm uses Google Workspace and wants to prevent sensitive financial data from being shared externally. They have a DLP policy that detects credit card numbers, but it only triggers a warning. The compliance team wants to enforce blocking, but the sales team needs to send credit card numbers to a specific partner for legitimate business. What is the best way to balance security and business needs?
Select an answer first
12foundation · easy
What is the primary purpose of tokenization in data protection?
Select an answer first
13expert · hard
A company stores sensitive data in an S3 bucket. The security team wants to enforce least-privilege access, but also needs to allow a third-party auditor to access the bucket for compliance reviews. The auditor should only be able to read the data, not modify it. Which configuration should be used?
Select an answer first
14foundation · easy
Which of the following is a common method to encrypt data at rest in a cloud database?
Select an answer first
15foundation · easy
Which protocol is the standard for encrypting data in transit between a web browser and a cloud-hosted application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.