Cloud Data Protection GPCS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is concerned about employees sending sensitive customer data via email. The company uses Microsoft 365 and wants to prevent sensitive data from leaving the organization through email. Which control should be implemented?

   • AEnable Microsoft Defender for Office 365 to block malicious attachments.
   • BSet up a mail flow rule that adds a disclaimer to all external emails.
   • CConfigure transport layer security (TLS) for all email communications.
   • DEnable Microsoft Purview Data Loss Prevention (DLP) policies that detect sensitive data in emails and block or warn the sender.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A payment processing company handles credit card numbers. To reduce PCI DSS scope, they want to avoid storing raw PANs in their application database. However, the customer service team needs to see the last four digits of the card to verify identity. What is the best approach?

   • AStore the PAN in a separate database and restrict access with IAM policies.
   • BMask the PAN in the database by replacing all but the last four digits with asterisks.
   • CEncrypt the PAN with AES-256 and store the key in the same database.
   • DStore a token in the database and keep the raw PAN in a separate, highly secured token vault.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company uses AWS S3 to store sensitive data. They have a bucket policy that allows access to a specific IAM role. However, a security audit reveals that the role can be assumed by any user in the account. The security team wants to ensure that only users with a specific tag can assume the role and access the bucket. What is the most effective way to enforce this?

   • AModify the trust policy of the role to require the 'access-level=high' tag on the requesting user.
   • BAdd a condition to the bucket policy that requires the 'access-level=high' tag on the principal.
   • CUse S3 Access Points with a policy that requires the tag.
   • DEnable S3 Object Ownership and require the bucket owner to have the tag.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An e-commerce company uses AWS RDS for MySQL with automated backups enabled. A security review requires that backups be encrypted and that only the database admin role can restore them. The current backups are unencrypted. What should the company do to meet both requirements?

   • AUse AWS Backup to create backups and enable encryption with a KMS key, then share the key with the admin role.
   • BEnable encryption on the RDS instance, which automatically encrypts future automated backups and snapshots.
   • CExport the backups to S3 and apply an S3 bucket policy that allows only the admin role to access the bucket.
   • DEnable Multi-AZ deployment to ensure backups are taken from a standby instance.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A startup uses a single GCP project for all workloads. A developer accidentally made a Cloud Storage bucket public. The security team needs to prevent this from happening again while still allowing developers to create buckets for their projects. What is the most effective preventive control?

   • AEnable Cloud Audit Logs and set up an alert to notify the security team when a bucket becomes public.
   • BCreate a custom role that includes storage.buckets.create but excludes storage.buckets.setIamPolicy.
   • CRequire all developers to use a shared bucket and grant them object-level permissions.
   • DUse Organization Policy to define a constraint that blocks the 'allUsers' and 'allAuthenticatedUsers' bindings on buckets.
   Reveal Solution Discussion Select an answer first