Explain How Regulations Like GDPR Affect Cyber Defense Architecture in Relation to Data Privacy Impact on Logging, Data Sovereignty, and Data Residency. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How can a cyber defense architect ensure data residency compliance under GDPR when using cloud services?

   • ABy implementing strict access controls
   • BBy using a private cloud on-premises
   • CBy encrypting all data regardless of location
   • DBy selecting a cloud region within the EU/EEA for data storage and processing
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A European cloud provider's SIEM ingests logs from its customers. The provider has customers in the EU and in a non-adequate country. The provider's DPO has mandated that EU customer data must not leave the EU. The provider's SIEM is a single multi-tenant instance. The security architect needs to ensure that EU customer data is not accessible from the non-adequate country. What is the most effective architectural change?

   • AUse a single SIEM instance but tag all EU customer data with a region label, and configure RBAC to block access from the non-adequate country.
   • BUse a single SIEM instance in the EU, and have the non-adequate country customers access it remotely via a VPN.
   • CUse a single SIEM instance in the non-adequate country, and have EU customers access it remotely via a VPN.
   • DDeploy a separate SIEM instance in the EU for EU customers, and a separate instance in the non-adequate country for those customers, with no cross-instance access.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does the GDPR principle of data minimization affect the logging of security events?

   • ALogs must be retained for at least one year
   • BOnly personal data that is strictly necessary for the security purpose should be logged
   • CAll user activity must be logged to ensure accountability
   • DLogs must be encrypted at rest and in transit
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key architectural consideration for retention policies under GDPR in a cyber defense system?

   • ADefine retention periods that balance security needs with GDPR's storage limitation principle
   • BStore logs in a separate location to avoid GDPR requirements
   • CRetain all logs indefinitely to support future investigations
   • DDelete all logs immediately after analysis
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Under GDPR, which right allows a data subject to request the deletion of their personal data under certain conditions?

   • ARight to data portability
   • BRight to object
   • CRight to rectification
   • DRight to erasure ('right to be forgotten')
   Reveal Solution Discussion Select an answer first