Design and Apply Data Security Technologies and Strategies CCSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which property of a cryptographic hash function makes it suitable for detecting unauthorized modifications to data?

   • AAny change to the input produces a different output
   • BIt produces a fixed-size output regardless of input size
   • CIt can be used to encrypt data
   • DIt is reversible with the correct key
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A retail company processes credit card payments through a third-party payment gateway. To reduce PCI DSS scope, the company wants to avoid storing actual card numbers in its own cloud environment while still being able to reference transactions for customer service and analytics. Which strategy should the company implement?

   • AHash the card numbers using SHA-256 and store only the digests for transaction reference
   • BReplace card numbers with randomly generated tokens and store the mapping in a secure token vault
   • CEncrypt the card numbers with a customer-managed key and store the ciphertext in the application database
   • DStore the card numbers in a hardware security module (HSM) and reference them by a unique identifier in the application
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A research organization wants to publish a dataset of patient health records for academic study. The dataset must be useful for statistical analysis, but the organization must ensure that individuals cannot be re-identified. The dataset includes rare medical conditions and small geographic regions, which create a high re-identification risk. Which approach should the organization take?

   • AApply a DLP policy that blocks the publication of the dataset
   • BRemove all direct identifiers such as names and social security numbers and publish the dataset as-is
   • CEncrypt the dataset and provide the decryption key only to approved researchers
   • DApply k-anonymity by generalizing quasi-identifiers so that each record is indistinguishable from at least k-1 other records
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does tokenization differ from encryption in protecting sensitive data?

   • ATokenization replaces data with a random token that has no mathematical relationship to the original, while encryption transforms data using an algorithm and key
   • BTokenization is reversible with a key, while encryption is not
   • CTokenization is a one-way function, while encryption is reversible
   • DTokenization is used for data at rest, while encryption is used for data in transit
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's DLP solution is deployed across email, web, and cloud storage. The security team discovers that sensitive data is being exfiltrated through a custom application that uses an API to upload data to a cloud service. The DLP solution does not currently monitor API traffic. Which action should the team take to close this gap?

   • ABlock all API access to the cloud service from the custom application
   • BConfigure the DLP solution to inspect API traffic by integrating it with the cloud service's API gateway
   • CStore the API keys used by the custom application in a secrets vault
   • DRequire the custom application to encrypt all API payloads
   Reveal Solution Discussion Select an answer first