Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A multinational company must comply with both GDPR and PCI DSS. They store customer data in a cloud database. The security team is designing the encryption strategy. Which approach satisfies both regulations?

   • AUse a single encryption key for all data to simplify compliance reporting.
   • BEncrypt only payment data because GDPR does not require encryption.
   • CEncrypt all personal and payment data at rest using strong encryption, and manage keys with a cloud KMS that supports key rotation and access auditing.
   • DStore all data in an on-premises data center to avoid cloud-specific compliance issues.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a padding oracle attack?

   • AAn attack that guesses the encryption key by trying all possible combinations
   • BAn attack that injects malicious SQL queries into a database
   • CAn attack that forces a client to use an older, weaker version of TLS
   • DAn attack that exploits the server's response to invalid padding to decrypt data without the key
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is investigating a potential downgrade attack on their TLS configuration. They notice that some clients are connecting with TLS 1.0 despite the server supporting TLS 1.2. The server logs show that the clients are not legacy systems. Which configuration change is most likely to prevent this?

   • ASet the server to prefer the client's supported protocols.
   • BDisable TLS 1.0 and TLS 1.1 on the server and enforce a minimum of TLS 1.2.
   • CUse a stronger certificate, such as ECDSA, to prevent downgrade attacks.
   • DEnable TLS_FALLBACK_SCSV to prevent protocol downgrade during handshake.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A multinational company must comply with GDPR, which requires protecting personal data. They store data in a cloud database and need to ensure that data is encrypted at rest. They also need to be able to respond to data subject access requests by retrieving and decrypting specific records. Which solution best meets these requirements?

   • AUse cloud provider's transparent data encryption (TDE) with customer-managed keys stored in a hardware security module (HSM).
   • BUse application-level encryption with a single key stored in the application's environment variables.
   • CEncrypt the entire database with a key that is automatically rotated by the cloud provider without customer control.
   • DUse full-disk encryption on the database server and rely on the cloud provider's physical security.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A software company is designing a feature to store user documents. They need to protect the documents from unauthorized access if the storage server is compromised. They also need to detect any unauthorized modification of the documents. Which combination of controls should they implement?

   • AHash the documents with SHA-256 and store the hashes in a separate database.
   • BEncrypt the documents with AES-256 and store an HMAC of each document for integrity verification.
   • CCompress the documents and store them in a password-protected archive.
   • DUse only full-disk encryption on the storage server.
   Reveal Solution Discussion Select an answer first