Data Protection & Lifecycle Practice Questions

Answers and explanations appear when you work through the set above.

1. A company wants to prevent sensitive customer records from leaving through email, web uploads, or removable media. Which control is the BEST fit for this requirement?

   • A retention schedule for customer email records
   • DLP enforcing policies at relevant egress points
   • A database backup rotation policy
   • A digital certificate authority

2. A customer contract requires records to be retained for seven years, but a regulator issues a legal hold after five years. What should the data custodian do FIRST?

   • Delete the records that have reached the normal retention threshold.
   • Move the records to an unrestricted archive so they cannot be altered.
   • Suspend disposition of held records and escalate under policy.
   • Shorten the retention period because the contract is older than the records.

3. An organization will reuse a self-encrypting solid-state drive internally. The drive uses approved encryption, and the organization can reliably identify and destroy every key protecting the data. Which sanitization method is MOST appropriate?

   • Degaussing the drive
   • A normal file deletion followed by formatting
   • Cryptographic erase, with verification of the sanitization result
   • Overwriting every logical block repeatedly without checking the device implementation

4. A vendor will receive a magnetic tape containing highly confidential data and the organization will not retain control of the tape. Which disposition provides the strongest assurance that the data cannot be recovered from the media?

   • Delete the tape files and return the media with an inventory record to the vendor
   • Clear the tape with a single approved overwrite and reuse it
   • Degauss the tape and keep no sanitization record
   • Physically destroy the tape by an approved destruction process and document the result

5. A global organization is selecting a cloud region for a health-data workload. Which consideration is MOST important before approving the region?

   • Whether the provider offers the lowest storage price
   • Compliance of the region and contract with residency, sovereignty, and cross-border requirements
   • Whether the region has the largest number of availability zones
   • Whether the application uses a relational database with indexed tables rather than a document-oriented storage engine

6. A payment application needs to let support staff reference a customer account value without exposing the original number. The payment processor must be able to exchange the value for the original when authorized. Which technique BEST meets this requirement?

   • Tokenization with controlled mapping
   • Irreversible anonymization of the account number
   • Base64 encoding of the account number
   • A one-way hash exposed to every support analyst

7. A research team needs to analyze patient trends while a separate authorized service retains the ability to reconnect each record to a patient. What is the BEST description of the dataset supplied to the team?

   • Fully anonymized data
   • Pseudonymized data with protected, separate re-identification
   • Tokenized data that is necessarily outside privacy requirements
   • Unclassified data because names were removed

8. A security architect must protect confidential records while an analytics process operates on them in server memory. Which control BEST addresses the data-in-use exposure?

   • Encrypting backup tapes and restricting access to the backup library while leaving the live analytics process unchanged
   • TLS on client and replication links, with unrestricted analytics access to host memory
   • Least privilege and risk-appropriate confidential-computing enclaves for protected processing
   • Reduce retention periods for archived customer records without changing the active analytics process

9. A records manager is designing a data lifecycle policy for a new customer system. Which sequence BEST reflects sound lifecycle governance?

   • Collect without purpose limits, copy to each business unit, archive when capacity is exhausted, then delete without verification
   • Classify and collect for a defined purpose, apply handling rules, limit retention, and verify sanitization or destruction
   • Encrypt after disposal, retain duplicate copies permanently, then classify the data if an incident occurs
   • Destroy data immediately after collection unless a user requests access