Managing System Security GSLC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A multinational corporation must comply with the EU General Data Protection Regulation (GDPR) for personal data of EU residents. The company currently stores this data in a public cloud region located in the EU. The security team is evaluating whether this setup meets GDPR requirements. What is the most accurate assessment?

   • AThe company must move the data to an on-premises data center within the EU to ensure GDPR compliance.
   • BStoring data in an EU public cloud region satisfies GDPR data residency requirements, provided the organization implements appropriate technical and organizational measures.
   • CGDPR requires that all personal data be stored only in the country where the data subject resides.
   • DUsing a public cloud for personal data is inherently non-compliant with GDPR because the cloud provider has access to the data.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A university is deploying a new research computing cluster that will be used by faculty and students. The cluster will process sensitive research data. The security team must balance the need for security with the need for usability and collaboration. Which approach best achieves this balance?

   • AAllow all users to have administrative access to the cluster to facilitate research and avoid delays.
   • BImplement a strict security baseline that disables all unnecessary services and requires multi-factor authentication for all users.
   • CIsolate the cluster from the internet and require all access to be through a VPN, but do not implement additional security controls.
   • DUse a risk-based approach that applies stronger controls to sensitive data and more permissive controls to non-sensitive data, while providing training and clear policies.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security manager is leading the response to a suspected data breach. The breach may have involved the exfiltration of customer data. The company's legal counsel has advised that the company may have a legal obligation to notify affected customers and regulators. The security team has identified the likely source of the breach but has not yet confirmed the full scope. What is the most appropriate action for the security manager to take?

   • AWait for the investigation to be fully complete before taking any action, to avoid providing incorrect information.
   • BNotify affected customers and regulators immediately, even if the full scope is not yet known.
   • CConsult with legal counsel to determine the specific notification requirements and timeline, then act accordingly.
   • DPreserve all evidence and continue the investigation to determine the full scope of the breach before notifying authorities.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security manager is overseeing the migration of a legacy application from an on-premises data center to a public cloud environment. The application has a hard-coded service account with administrative privileges, and the team is planning to lift-and-shift the application without changes. The manager must ensure that the migration does not introduce new security risks. Which of the following is the most important action to take?

   • ARefactor the application to use managed identities or short-lived credentials instead of the hard-coded service account.
   • BEncrypt the application's configuration files that contain the service account credentials.
   • CMigrate the application as-is and then apply a security baseline to the new cloud virtual machines.
   • DUse a cloud access security broker (CASB) to monitor access to the application after migration.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security manager is reviewing the access control for a shared network drive that contains project files. The manager wants to ensure that only project team members can access the files, and that the access is automatically revoked when a team member leaves the project. Which of the following is the most appropriate approach?

   • AUse a shared password for the shared drive and provide it to all project team members.
   • BCopy the project files to each user's local machine and remove the shared drive.
   • CCreate a security group for the project team, add team members to the group, and assign the group permissions to the shared drive.
   • DAssign permissions directly to each user's account for the shared drive.
   Reveal Solution Discussion Select an answer first