Managing Encryption and Privacy GSLC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step in responding to a suspected privacy breach involving encrypted data?

   • ADelete all encrypted data to prevent unauthorized access.
   • BNotify all affected customers immediately before any investigation.
   • CIgnore the incident if the data was encrypted.
   • DContain the incident to prevent further data loss or exposure.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multinational company stores personal data of EU citizens in a cloud database. The database is encrypted at rest with a key managed by the cloud provider. Under GDPR, what is the primary concern with this arrangement?

   • AThe cloud provider is the data controller and is solely responsible for encryption.
   • BGDPR requires that all personal data be encrypted with a key length of at least 256 bits.
   • CGDPR prohibits storing personal data in a cloud environment outside the EU.
   • DThe cloud provider may have access to the encryption keys, which could affect the organization's ability to demonstrate appropriate technical safeguards.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A software development team is building a new mobile app that collects user location data. The product manager wants to store the data in plaintext to make analytics easier. The privacy team insists on privacy by design. Which approach best aligns with privacy by design?

   • AEncrypt the location data at rest and in transit, and implement access controls so only authorized analytics personnel can decrypt it.
   • BStore the data in plaintext but anonymize it before analysis.
   • CCollect the data but do not store it; only use it in real-time for the app's features.
   • DObtain user consent and store the data in plaintext because consent overrides privacy by design.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services firm is designing a new customer portal. The data classification policy defines four tiers: Public, Internal, Confidential, and Restricted. Customer account numbers and transaction history are classified as Restricted. Which encryption control is most appropriate for this data?

   • AUse full-disk encryption on the database server only.
   • BEncrypt the database fields containing account numbers and transaction history using column-level encryption.
   • CApply TLS to all connections to the portal and store data in plaintext.
   • DEncrypt the entire database with TDE and rely on application-level access controls.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which encryption technique protects an entire storage device, including the operating system and all files, by encrypting the whole disk?

   • ADatabase encryption
   • BFull-disk encryption (FDE)
   • CFile-level encryption
   • DTransport Layer Security (TLS)
   Reveal Solution Discussion Select an answer first