Explain How Regulations Like GDPR Affect Cyber Defense Architecture in Relation to Data Privacy Impact on Logging, Data Sovereignty, and Data Residency. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A European e-commerce company's SIEM currently logs full HTTP request URLs, including query strings that contain session tokens and customer IDs. The security team needs to detect SQL injection attempts, which are visible in the URL. The DPO has required the company to minimize personal data in logs. What should the security architect implement?

   • AKeep the full URL but restrict access to the logs to the security team only.
   • BConfigure the SIEM to redact the session token and customer ID parameters from the URL at ingestion, while preserving the rest of the URL for SQL injection detection.
   • CLog only the HTTP method, status code, and source IP, and drop the full URL entirely.
   • DEncrypt the full URL in the log so that only the SIEM administrators can read it.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A German manufacturing company's SIEM logs all network traffic metadata, including source and destination IPs, ports, and protocol. The company's DPO has determined that IP addresses are personal data in this context. The security team needs to detect lateral movement, which requires correlating IP addresses across the network. The DPO has mandated data minimization. What is the most balanced architectural approach?

   • AStore the raw IP addresses in an encrypted database and restrict access to the security team only.
   • BLog only the source IP address and drop the destination IP address, as the source is the most important for detection.
   • CKeep the raw IP addresses in the SIEM, as they are essential for lateral movement detection, and document the necessity in a DPIA.
   • DReplace the raw IP addresses with a deterministic hash at ingestion, and maintain a separate, access-controlled mapping table that is only queried when a specific investigation requires it.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Portuguese retail chain's SIEM stores logs of customer transactions. A data subject has requested that their personal data be erased. The security team has identified the relevant logs, but the legal team has determined that the company is legally required to retain certain transaction data for tax purposes for 10 years. What should the security architect do?

   • AErase the logs but keep a separate record that the erasure occurred, to demonstrate compliance with the request.
   • BImplement a technical control that restricts the erasure of the tax-relevant logs, and document the legal basis for the retention override.
   • CErase the logs immediately to honor the data subject's request, and accept the legal risk of non-compliance with tax law.
   • DAnonymize the customer's personal data in the logs, but keep the transaction data for tax purposes.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Dutch healthcare organization is designing a new SIEM. The organization treats patients in the Netherlands only, and the Dutch data protection authority requires that health data be stored within the EU. The security team wants to use a cloud SIEM that offers regions in the EU, the US, and Asia. The SIEM will ingest logs from patient management systems. Which deployment decision best satisfies the data residency requirement?

   • AUse the EU region for storage but allow the US region to process the data, since processing is transient and does not constitute storage.
   • BSelect the SIEM's EU region for both the primary data store and the processing engine, and configure the SIEM to block any cross-region replication or failover to non-EU regions.
   • CSelect the US region for the primary data store because the SIEM vendor is headquartered there, and rely on the vendor's EU data processing agreement.
   • DStore the data on-premises in the Netherlands and use the cloud SIEM only for alerting, with no raw log storage in the cloud.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Belgian bank's SIEM logs all customer transaction data for fraud detection. A data subject has requested access to their personal data. The security team has identified the relevant logs, but the logs also contain the transaction data of other customers. The bank's legal team has confirmed that the request is valid. What should the security architect ensure happens?

   • AThe SIEM must block the data subject's data from being logged in the future, but historical logs can remain unchanged.
   • BThe SIEM must export the entire log entries, including the other customers' data, as the data is all part of the same transaction.
   • CThe SIEM must delete the data subject's data from the logs and provide a confirmation of deletion.
   • DThe SIEM must be able to extract and export only the data subject's personal data, redacting or excluding the personal data of other customers.
   Reveal Solution Discussion Select an answer first