Managing Encryption and Privacy GSLC Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of encryption in an information security program?

   • ATo ensure availability by preventing denial-of-service attacks.
   • BTo provide confidentiality by making data unreadable to unauthorized parties.
   • CTo ensure data integrity by detecting unauthorized modifications.
   • DTo authenticate users by verifying their identities before access.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company discovers that an employee's laptop containing encrypted customer data was stolen. The laptop's hard drive was encrypted with BitLocker, and the recovery key was stored in Active Directory. What is the first step in the incident response process?

   • ADisable the employee's Active Directory account.
   • BWipe the laptop remotely to prevent data access.
   • CImmediately notify all affected customers of a data breach.
   • DDetermine whether the encryption was active and whether the recovery key was accessible to unauthorized parties.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   A company is implementing a data classification scheme. Which data type would typically require the highest level of encryption and access control?

   • ACustomer credit card numbers
   • BInternal meeting schedules
   • CEmployee cafeteria menu
   • DPublic marketing brochures
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A multinational company transfers employee HR data between its data centers in the EU and the US. The data includes personal data covered by GDPR. The network team proposes using IPsec VPNs between the sites. What additional control is necessary to ensure GDPR compliance for these transfers?

   • AEnsure a legal transfer mechanism, such as Standard Contractual Clauses, is in place for the EU-US data transfer.
   • BUse a dedicated private fiber link between the data centers instead of the public internet.
   • CEncrypt the data with TLS before sending over the IPsec tunnel.
   • DAnonymize the HR data before transfer so it no longer qualifies as personal data.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An organization discovers that a database containing personal data was encrypted with a key that was compromised in a phishing attack. The organization has a legal obligation to notify regulators within 72 hours of becoming aware of a breach. The security team is still investigating the scope. What is the BEST course of action?

   • ANotify regulators within the 72-hour window, even if the full scope is not yet known, and provide updates as the investigation continues.
   • BNotify the affected individuals first, then regulators.
   • CWait until the investigation is complete to notify regulators, to provide accurate information.
   • DNotify regulators only if the data was actually accessed, not just potentially exposed.
   Reveal Solution Discussion Select an answer first