Explain How Regulations Like GDPR Affect Cyber Defense Architecture in Relation to Data Privacy Impact on Logging, Data Sovereignty, and Data Residency. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Swedish software company's SIEM logs all employee authentication events, including the username, source IP, and the specific resource accessed. The company's works council has raised concerns that this logging is excessive. The security team argues that the logs are needed to detect account compromise. The DPO has asked the team to demonstrate compliance with the data minimization principle. What should the security architect do?

   • ARemove the source IP field from the logs, as it is the most privacy-invasive field.
   • BConduct a data protection impact assessment (DPIA) that documents the necessity of each logged field for the specific security purpose, and document a retention period.
   • CEncrypt the logs and restrict access to the security team only.
   • DReduce the log retention period to 7 days, but keep all fields unchanged.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What does 'data residency' refer to in the context of GDPR?

   • AThe legal jurisdiction that applies to the data
   • BThe encryption keys used to protect the data
   • CThe geographic location where data is stored and processed
   • DThe retention period for the data
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Spanish telecom company's SIEM stores call detail records (CDRs) for fraud detection. A data subject has submitted a request to access all personal data the company holds about them. The security team has identified CDRs that contain the data subject's phone number and call timestamps. The company's legal team has confirmed the request is valid. What must the security architect ensure happens with the CDR data?

   • AThe SIEM must block the data subject's phone number from being logged in the future, but historical CDRs can remain unchanged.
   • BThe SIEM must be able to search for and export all CDRs containing the data subject's phone number within the GDPR-mandated time frame.
   • CThe SIEM must permanently delete all CDRs containing the data subject's phone number immediately upon request.
   • DThe SIEM must anonymize the data subject's phone number in all CDRs so that the data is no longer personal data.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A French bank's SIEM is deployed in a single EU region. The bank is acquired by a US-based financial group. The new parent company requires the SIEM to be replicated to a US region for disaster recovery. The bank's DPO has confirmed that the US is not an adequate country. The bank cannot avoid the US replication requirement. What is the most appropriate architectural control to implement?

   • AReplicate the raw data to the US and rely on the parent company's binding corporate rules (BCRs) to legitimize the transfer.
   • BRefuse to replicate the data to the US, as GDPR prohibits any transfer of personal data to non-adequate countries.
   • CReplicate the raw data to the US but encrypt it with a key stored only in the EU.
   • DConfigure the SIEM to pseudonymize all personal data fields before replicating to the US, and store the pseudonymization keys in the EU.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A German financial services firm uses a US-based SIEM vendor. The firm's security operations center (SOC) in Frankfurt sends raw security logs containing customer account numbers to the vendor's cloud platform for analysis. The vendor's platform processes data in the US and stores it in the US. The firm's DPO has determined that the US is not an adequate country under GDPR. The firm cannot stop using the vendor's analytics engine. What architectural change should the security architect prioritize?

   • AAnonymize the customer account numbers in the logs before transmission to the US, so the data is no longer personal data.
   • BDeploy the vendor's SIEM in a dedicated EU region with data processing and storage confined to that region, and execute the vendor's Standard Contractual Clauses (SCCs) for any remote support access.
   • CEncrypt the logs end-to-end before sending them to the US platform so the vendor cannot read the customer account numbers.
   • DKeep the logs on-premises in Frankfurt and use the vendor's API to send only detection alerts (without personal data) to the US.
   Reveal Solution Discussion Select an answer first