5.1 - Understand Data Security CC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services company stores customer account records in a shared network drive. The compliance team requires that only authorized personnel can access the files, and that the files be retained for seven years per regulatory requirements. The IT team is implementing a data governance policy. Which combination of actions should the IT team take first?

   • AApply a digital signature to the files to ensure they have not been modified.
   • BDelete the files after one year to minimize storage costs and reduce the attack surface.
   • CEncrypt the files with AES-256 and store the encryption keys in a hardware security module.
   • DClassify the data as confidential, label the files accordingly, and set a retention period of seven years.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the main benefit of labeling data with its classification?

   • AIt makes data available to all users.
   • BIt helps users apply appropriate handling and raises awareness.
   • CIt automatically encrypts the data.
   • DIt reduces the storage space required.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common data classification level?

   • AEncrypted
   • BPublic
   • CBacked-up
   • DArchived
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to ensure that a contract sent to a client has not been altered and that it genuinely came from the company. Which cryptographic technique should they use?

   • ADigitally sign the contract with the company's private key.
   • BUse symmetric encryption with a shared key.
   • CHash the contract and send the hash along with the contract.
   • DEncrypt the contract with the client's public key.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A multinational corporation is implementing a data classification policy. They have data that is subject to different regulatory requirements in different countries: some data must be retained for 5 years, other data for 10 years. The company also wants to minimize storage costs. Which approach should they take?

   • ARetain data only in the country of origin to avoid conflicting regulations.
   • BApply a single 10-year retention period to all data to simplify compliance.
   • CClassify data by sensitivity and regulatory requirement, then apply retention periods based on the most restrictive applicable regulation.
   • DDelete all data after 5 years to reduce costs and risk.
   Reveal Solution Discussion Select an answer first