01
True or false
1 point
A legal hold may suspend ordinary deletion until the hold is released.
Free Practice Quiz Question List
5 Data Protection Architecture Online Quiz Questions
Use this free practice quiz with 20 questions to review 5 Data Protection Architecture, test your knowledge, and prepare for your next test or exam.
20 questions
02
Written response
1 point
How many security objectives does the material name when describing impact assessment?
03
Fill in the blank
1 point
When classifying data, assess potential harm if it loses confidentiality, integrity, or .
04
Choose one
1 point
Which example is data at rest that should be considered for encryption?
- A
Only data traveling between a user and a service
- B
Data stored in a database, object store, or backup
- C
Only data currently being processed by an application
- D
Only data that has been classified as Restricted
05
True or false
1 point
Data classification labels should be applied consistently to exports and backups as well as primary databases.
- A
True
- B
False
06
Written response
1 point
What is the name of the deletion method that renders encrypted data inaccessible by reliably destroying its encryption key?
07
Choose one
1 point
An organization classifies information as Public. Which conclusion best follows from the material?
- A
It needs no security controls because it is public.
- B
It requires the strongest confidentiality controls in every case.
- C
It may need integrity controls to prevent tampering, even if confidentiality protection is limited.
- D
It should be deleted immediately after publication.
08
Fill in the blank
1 point
Key rotation limits continued use of a key, but does not by itself remove already-created .
09
Choose all
1 point
Select all items a retention rule should identify.
- A
The data covered by the rule
- B
The retention start point
- C
The retention period
- D
The responsible owner
- E
The disposal method
- F
A guarantee that no legal hold can ever apply
10
Choose one
1 point
A threat actor compromises an application that is authorized to decrypt stored customer data. What does the material indicate about the protection encryption provides in this situation?
- A
Encryption makes the application unable to decrypt data.
- B
The compromised application may still access decrypted data.
- C
The data becomes safe without authentication or authorization.
- D
Compromise of the application automatically destroys its encryption keys.
11
Choose all
1 point
Select all conditions that support using cryptographic erase to make data inaccessible.
- A
The data was encrypted with suitable keys.
- B
All relevant copies are protected by the key being destroyed.
- C
A plaintext copy remains available for routine access.
- D
The key is reliably destroyed.
- E
A recoverable copy of the key is retained.
12
Open ended
1 point
A customer record has reached its planned deletion date, but the organization also has searchable exports and long-lived backups containing it. Describe how the organization should plan and verify deletion across these locations, including how a legal hold would affect the process.
13
Choose one
1 point
A team proposes collecting extra customer fields for possible future tasks, even though they are unnecessary for its current work. What change best follows the material's data-protection guidance?
- A
Collect all potentially useful data and rely on encryption to protect it.
- B
Copy the data to several locations so it is easier to find.
- C
Collect and copy only the data needed for the task.
- D
Keep every collected field indefinitely to avoid losing it.
14
Choose one
1 point
An organization labels a dataset Confidential. How should it use that classification label?
- A
Use the label only on the primary database and ignore copies.
- B
Use the label to guide safeguards across systems and copies.
- C
Use the label only to decide whether data should be encrypted in transit.
- D
Use the label as a substitute for access permissions.
15
Choose one
1 point
An organization classifies a dataset as Public. Which conclusion about its protection is best supported?
- A
Public information does not need security controls of any kind.
- B
Public information always requires the same confidentiality safeguards as Restricted information.
- C
Public information may need integrity controls to prevent tampering.
- D
Public information should be retained indefinitely because it is not confidential.
16
Choose one
1 point
A database is encrypted at rest, but an attacker compromises an application that is authorized to read it. What is the most accurate assessment?
- A
The database remains protected as long as the encryption key is stored separately.
- B
An attacker who compromises an authorized application may still access decrypted data.
- C
The encrypted database no longer requires access controls.
- D
The application cannot access the data unless an administrator manually decrypts it.
17
Choose one
1 point
A record reaches the end of its ordinary retention period while a legal hold is still active. What should the organization do?
- A
The hold may suspend ordinary deletion until it is released.
- B
The organization should delete the information on schedule and document the hold afterward.
- C
A legal hold applies only to the primary database, not other copies.
- D
The hold requires the organization to retain all information permanently.
18
True or false
1 point
True or false: Collecting and copying only the data needed for a task can reduce the amount of information an organization must protect.
- A
True
- B
False
19
Written response
1 point
A security team needs the NIST publication cited for guidance on cryptographic key management. Enter its publication identifier.
20
Written response
1 point
A system makes encrypted data inaccessible by reliably destroying its encryption key. What is this disposal method called?