1.1 Design Data Residency, Retention, and Access Control Models Within the Cortex Tenant to Meet Standards (e.g., GDPR, PCI, Local Privacy Laws) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization uses Cortex XSIAM and must comply with GDPR. The security team needs to ensure that only authorized personnel can access patient data, and all access must be logged. The organization has a small team of analysts who need to view alerts and a separate team of administrators who manage the tenant. What should the security architect configure?

   • ADisable direct user access and have all analysts share a single service account.
   • BUse the default roles provided by Cortex and rely on the built-in audit log to track access.
   • CGrant all users the same role to simplify management and enable audit logging for all actions.
   • DCreate custom roles with least-privilege permissions for analysts and administrators, and enable audit logging.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses Cortex XSIAM and needs to comply with GDPR. The security architect must ensure that personal data is handled appropriately. Which action is most important to implement first?

   • AEnable data encryption for all data at rest and in transit.
   • BCreate a data classification scheme that identifies personal data and applies appropriate handling procedures.
   • CSet up audit logging for all data access events.
   • DConfigure RBAC to restrict access to sensitive data.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A security architect needs to ensure that Cortex data for a European customer is stored only within the European Union. Which Cortex capability directly supports this requirement?

   • AData residency settings that select a specific geographic region for the tenant
   • BAudit logging that records all data access events
   • CRole-based access control that restricts data access to EU-based users
   • DRetention policies that automatically delete data after a set period
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A compliance officer needs to demonstrate that Cortex configurations align with GDPR requirements for data minimization. Which Cortex configuration is most relevant to this requirement?

   • AData retention policies that limit storage duration
   • BRole-based access control that restricts access to personal data
   • CData residency settings that select an EU region
   • DAudit logging that records all data processing activities
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company must demonstrate to an auditor that only authorized personnel have accessed personal data in Cortex XSIAM. The security architect needs to provide evidence of access. What should the architect configure?

   • AConfigure RBAC to restrict access to personal data.
   • BEnable data encryption for personal data.
   • CEnable audit logging and export logs to a SIEM for analysis.
   • DSet up data retention policies to limit how long personal data is stored.
   Reveal Solution Discussion Select an answer first