Managing Encryption and Privacy GSLC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization processes patient records that are classified as 'Confidential' under its data classification policy. The records are stored in an on-premises database and also backed up to tape for disaster recovery. The organization must comply with HIPAA. Which combination of controls best meets the classification requirement?

   • AUse full-disk encryption on the database server and rely on that to protect the backup tapes.
   • BEncrypt only the database files with TDE and store the backup tapes in a locked cabinet.
   • CEncrypt the backup tapes with a password-protected ZIP file and leave the database unencrypted because it is behind the firewall.
   • DEncrypt the database files with Transparent Data Encryption (TDE) and encrypt the backup tapes with a hardware security module (HSM)-managed key.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A startup is developing a smart home device that collects audio data. The team wants to follow privacy by design. The device must process audio locally for voice commands, but the company also wants to improve its AI models using user data. Which approach best balances privacy and business needs?

   • AProcess audio locally on the device and only send anonymized, aggregated data to the cloud for model training.
   • BSend all raw audio to the cloud for processing and model training, with encryption in transit.
   • CObtain broad consent from users to use their audio data for any purpose.
   • DStore audio locally and never share any data with the company.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A software development team is building a mobile health app that collects users' health metrics. The product manager wants to integrate privacy by design. Which practice best exemplifies this principle?

   • ACollect all available health metrics now to avoid future development delays, and encrypt the data.
   • BCollect only the minimum health data needed for the app's core functionality and encrypt it in transit and at rest.
   • CDefer privacy considerations until after the app is launched and user feedback is received.
   • DRely on the app store's privacy labels to satisfy privacy requirements.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which US regulation sets standards for protecting sensitive patient health information and requires encryption of that data?

   • AFERPA
   • BGDPR
   • CGLBA
   • DHIPAA
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A social media company is redesigning its user profile feature. The design team wants to implement privacy by design. The feature will allow users to share their location with friends. Which design choice best reflects privacy by design?

   • ACollect location data continuously even when the app is not in use.
   • BAllow users to choose who can see their location and for how long, with location data encrypted in transit and at rest.
   • CMake location sharing default to public to encourage social interaction.
   • DStore location data indefinitely for future marketing purposes.
   Reveal Solution Discussion Select an answer first