Cloud Data Protection GPCS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary goal of data redaction in logs?

   • ATo remove or obscure sensitive information from log entries before they are stored or analyzed
   • BTo encrypt log files at rest
   • CTo delete logs after a certain period
   • DTo compress log files to save storage space
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security architect is designing a solution to encrypt data at rest in a cloud object storage service. The solution must allow the organization to use its own encryption keys and to rotate them without re-encrypting the data. Which key management approach should be used?

   • AUse a client-side encryption library that encrypts data before upload, using a key stored in the application's configuration.
   • BUse envelope encryption with a customer-managed key as the key encryption key (KEK) and data encryption keys (DEKs) generated per object.
   • CUse a cloud-managed key and rely on the provider's automatic rotation.
   • DUse a single customer-managed key to directly encrypt all objects.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is subject to a legal hold that requires preserving all email communications for an ongoing lawsuit. The company also has a data retention policy that deletes emails older than 3 years. The legal team wants to ensure that no emails are deleted while the hold is in place, but also wants to minimize storage costs. Which approach should be taken?

   • AExport all emails to an archive and then delete them from the mailboxes.
   • BKeep the retention policy and rely on the legal team to manually preserve relevant emails.
   • CUse a DLP policy to block the deletion of emails containing keywords related to the lawsuit.
   • DApply a litigation hold to all mailboxes and remove the retention policy that deletes emails older than 3 years.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A developer is building a file-sharing application that needs to encrypt files before uploading them to a cloud storage bucket. The application will run on multiple servers, and each server needs to be able to decrypt files uploaded by any other server. The team wants to avoid managing a shared secret across servers. What is the best approach?

   • AUse a cloud KMS to generate a data encryption key (DEK) and wrap it with a key encryption key (KEK) stored in KMS.
   • BEncrypt files with a password derived from the file name and store the password in the object metadata.
   • CUse a different asymmetric key pair for each server and store the private keys in the application code.
   • DGenerate a single symmetric key and distribute it to all servers via a configuration file.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A hospital uses Microsoft 365 and wants to prevent patients' medical record numbers (MRNs) from being shared externally via email. They have a DLP policy that detects MRNs, but it only triggers a policy tip and does not block the email. The compliance officer wants to enforce blocking. What should they change?

   • AModify the DLP policy action to 'Block' and add an override option for the sender with a business justification.
   • BIncrease the confidence level of the DLP rule to 100 to ensure it catches all MRNs.
   • CEnable audit logging to track when the policy tip is shown.
   • DCreate a new transport rule in Exchange Online that blocks emails with MRNs.
   Reveal Solution Discussion Select an answer first