Cloud Data Protection GPCS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A government contractor must retain financial records for 7 years per federal regulation, but must delete them immediately after that period. They store files in Azure Blob Storage with immutable snapshots enabled. After 7 years, the compliance officer attempts to delete the blobs but the deletion fails. What is the most likely cause?

   • AThe blobs are encrypted with a customer-managed key that has been disabled.
   • BThe blobs are in an archive access tier and require rehydration before deletion.
   • CThe immutability policy is still in effect and prevents deletion until the policy is removed or expires.
   • DThe storage account has a soft-delete policy that retains deleted blobs for 30 days.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company uses AWS KMS with a customer-managed key to encrypt an S3 bucket. The security team accidentally deleted the KMS key. They need to recover the data. What is the most likely outcome and what should they do?

   • AThe data can be decrypted with a new key by re-encrypting the objects.
   • BThe data is still accessible because S3 stores a copy of the key.
   • CThe data can be recovered by contacting AWS support to restore the key.
   • DThe data is permanently unrecoverable because the key is gone; they should restore the key from a backup if available.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of a cloud Key Management Service (KMS)?

   • ATo centrally manage the lifecycle of encryption keys, including creation, rotation, and deletion
   • BTo encrypt all data automatically without any configuration
   • CTo provide a firewall for cloud resources
   • DTo store user passwords in a secure vault
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A retail company uses a third-party analytics platform to process clickstream data. The data includes customer email addresses, which are considered PII. The analytics vendor does not need the actual email addresses, only a consistent identifier to track user sessions. The security team wants to minimize exposure while keeping the data useful. What should they implement?

   • AApply a DLP policy that blocks all outbound traffic containing email addresses.
   • BReplace email addresses with a cryptographic token generated by a tokenization service before sending data to the vendor.
   • CEncrypt the email addresses with AES-256 and send the ciphertext along with the encryption key to the vendor.
   • DMask the email addresses by replacing the domain with 'example.com' before sending.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company uses AWS RDS for its production database and needs to implement a backup strategy that ensures backups are encrypted and accessible only to authorized personnel. The company also wants to be able to restore to a specific point in time. Which approach should be taken?

   • AEnable multi-AZ deployment to replicate data to a standby instance.
   • BTake manual snapshots daily and store them in an S3 bucket with server-side encryption.
   • CEnable automated backups with a retention period of 30 days and encrypt the backups using a KMS key. Restrict access to the backups using IAM policies.
   • DUse AWS Backup with a backup plan that copies backups to a separate account.
   Reveal Solution Discussion Select an answer first