Explain How Regulations Like GDPR Affect Cyber Defense Architecture in Relation to Data Privacy Impact on Logging, Data Sovereignty, and Data Residency. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An Italian insurance company's security team is deploying a new SIEM. The company has customers in Italy only, and the Italian data protection authority requires that personal data be stored within the EU. The SIEM vendor offers a multi-region deployment with automatic failover. The security architect is concerned about the failover feature. What should the architect configure to ensure data residency is maintained?

   • AEnable automatic failover to any region, as failover is a temporary technical process and not a data transfer.
   • BDisable all failover and accept the risk of a single-region outage, as this is the only way to guarantee residency.
   • CDisable the automatic failover to non-EU regions, and configure the SIEM to fail over only to another EU region.
   • DEnable automatic failover to the US region, as the vendor's headquarters is there and the vendor has a DPA with the company.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A Dutch hospital's SIEM logs patient access events, including the patient ID, the staff member who accessed the record, and the timestamp. The hospital's DPO has mandated a 6-month retention period for these logs. The security team has discovered that a ransomware investigation requires logs from 8 months ago. The logs have already been deleted. What should the security architect implement to prevent this situation in the future?

   • AImplement a two-tier retention policy: keep the raw logs for 6 months, and retain a reduced dataset (patient ID hashed, staff ID, timestamp) for 24 months for security investigations.
   • BExtend the retention period for all logs to 24 months, as security investigations require the data.
   • CKeep the raw logs for 6 months, and rely on the hospital's backup system to restore the deleted logs if needed.
   • DDisable the retention policy entirely so that logs are never deleted, ensuring data is always available for investigations.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A multinational retailer's SIEM ingests raw authentication logs from point-of-sale systems across EU stores. The logs contain the full name, email address, and purchase history of customers who used loyalty cards at the register. The DPO has flagged that the SIEM stores these logs for 24 months, but the loyalty program's purpose-limitation notice states customer purchase data is only processed for 6 months. The security team needs to keep the logs for threat detection. What should the security architect configure to satisfy GDPR while preserving detection capability?

   • AEncrypt the logs at rest and extend the retention period to 36 months to ensure sufficient data is available for forensic investigations.
   • BRetain the full logs for 24 months because security monitoring is a legitimate interest that overrides the loyalty program's stated retention period.
   • CConfigure the SIEM to pseudonymize customer identifiers in the logs at ingestion, and set a 6-month retention policy on the raw logs with a separate 24-month retention for anonymized metadata.
   • DDelete all logs containing loyalty card data immediately and rely on network flow logs that do not contain customer personal data.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   According to GDPR's purpose limitation principle, how should security logs containing personal data be handled?

   • AThey can be shared freely with third parties for research
   • BThey should be used only for the security purpose for which they were collected
   • CThey may be used for any internal business purpose
   • DThey must be anonymized immediately after collection
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does 'data sovereignty' mean in the context of GDPR?

   • AData must be encrypted using a specific algorithm
   • BData must be stored in a specific geographic location within the EU
   • CData must be accessible only to the data subject
   • DData is subject to the laws and regulations of the country where it is stored or processed
   Reveal Solution Discussion Select an answer first