D2: COMMS & NETWORK SECURITY

Question 1

Data security architecture

Answer 1

Overall design of controls that protect information assets across their lifecycle including classification encryption access control and monitoring

Question 2

Information lifecycle

Answer 2

Stages through which data passes such as creation storage use sharing archival and destruction each with distinct security needs

Question 3

Data at rest

Answer 3

Data stored on persistent media such as disks backups or archives which must be protected with access controls and often encryption

Question 4

Data in transit

Answer 4

Data moving over networks between systems or locations which must be protected with secure protocols integrity checks and endpoint authentication

Question 5

Data in use

Answer 5

Data actively processed in memory or by applications which may require controls such as secure coding memory protection and confidential computing

Question 6

Structured vs unstructured data

Answer 6

Structured data resides in defined formats like relational tables while unstructured data includes documents email media and other free form content

Question 7

Data classification scheme

Answer 7

Defined set of labels and criteria such as public internal confidential that drives required safeguards and handling rules

Question 8

Data owner responsibilities

Answer 8

Define classification retention and protection needs for data approve access requests and ensure controls align with business and regulatory requirements

Question 9

Data custodian responsibilities

Answer 9

Implement and operate technical and physical safeguards for data such as backup access control and storage protection according to owner requirements

Question 10

Data inventory and catalog

Answer 10

Comprehensive record of data assets locations owners classifications and interfaces used to support governance risk assessment and discovery

Question 11

Data discovery

Answer 11

Process of locating and identifying sensitive information across systems and repositories often using automated scanning for patterns or tags

Question 12

Data minimization

Answer 12

Principle of collecting and retaining only the minimum amount of data needed for defined purposes to reduce risk and compliance burden

Question 13

Data retention policy

Answer 13

Rules specifying how long different types of data must be kept and in what form based on legal business and operational requirements

Question 14

Legal hold and retention override

Answer 14

Temporary suspension of normal disposition for specific data due to litigation or investigation which must be supported by storage and backup design

Question 15

Data destruction and sanitization

Answer 15

Methods to ensure data is irrecoverable when no longer needed such as overwrite degauss crypto erase or physical destruction

Question 16

Crypto shredding

Answer 16

Technique where destroying encryption keys renders encrypted data permanently unreadable without deleting all stored copies

Question 17

Encryption at rest

Answer 17

Use of cryptography to protect stored data on disks or in databases so that compromise of media does not expose plaintext information

Question 18

Encryption in transit

Answer 18

Use of cryptographic protocols to protect data flow between endpoints against eavesdropping and tampering such as TLS based connections

Question 19

Field level encryption

Answer 19

Encryption applied selectively to specific fields or columns within a dataset to protect highly sensitive elements while leaving other data in clear

Question 20

Tokenization

Answer 20

Replacement of sensitive data values with non sensitive tokens where the mapping is stored in a secured token vault

Question 21

Format preserving encryption

Answer 21

Encryption method that maintains the format of the original data such as length and character set to ease integration with legacy systems

Question 22

Pseudonymization

Answer 22

Processing that replaces direct identifiers with pseudonyms while keeping a mapping so data can still be linked under controlled conditions

Question 23

Anonymization

Answer 23

Processing that irreversibly removes or modifies identifiers and linkages so individuals cannot reasonably be re identified from the data set

Question 24

Differential privacy

Answer 24

Mathematical approach that adds carefully calibrated noise to query results so that outputs do not reveal whether any individual record is present

Question 25

Key management architecture

Answer 25

Design of processes and systems that generate store distribute rotate and retire cryptographic keys securely

Question 26

Key hierarchy

Answer 26

Structured relationship in which higher level keys such as key encryption keys protect lower level data encryption keys

Question 27

Key lifecycle

Answer 27

Stages through which a key passes including generation distribution activation use rotation backup revocation and destruction

Question 28

Hardware security module

Answer 28

Tamper resistant device that securely generates stores and uses cryptographic keys often providing strong logical and physical protections

Question 29

Cloud key management service

Answer 29

Managed service that provides key storage generation and access control often integrated with cloud storage and compute services

Question 30

Database security controls

Answer 30

Set of mechanisms such as access control encryption activity monitoring and configuration hardening that protect structured data stores

Question 31

Database activity monitoring

Answer 31

Real time or near real time observation of database traffic and queries to detect misuse anomalies or policy violations

Question 32

Data integrity controls

Answer 32

Mechanisms such as checksums digital signatures and database constraints that ensure data is complete accurate and unaltered

Question 33

Data loss prevention

Answer 33

Technologies and policies that detect and prevent unauthorized transfer or disclosure of sensitive information across endpoints networks and storage

Question 34

Endpoint DLP

Answer 34

Controls on user devices that monitor actions such as copy print or save to removable media for sensitive data and can block or alert

Question 35

Network DLP

Answer 35

Controls at gateways that inspect traffic for sensitive content patterns and apply policies such as block quarantine or encrypt

Question 36

Storage security

Answer 36

Combination of access control zoning encryption and monitoring applied to storage systems including block file and object services

Question 37

Object storage security

Answer 37

Protection of bucket and object level access using authentication authorization encryption and bucket policies especially in cloud environments

Question 38

File share security

Answer 38

Use of permissions share configuration and auditing to restrict and monitor access to shared file resources

Question 39

Multitenant data isolation

Answer 39

Data architecture ensuring that one tenants data cannot be accessed or inferred by another tenant whether using logical or physical separation

Question 40

Application level data control

Answer 40

Controls implemented in the application tier such as fine grained authorization validation and logging to protect data beyond storage controls

Question 41

Data warehouse and analytics security

Answer 41

Design of controls for large analytical environments including access segregation row or column security and aggregation rules

Question 42

Big data security considerations

Answer 42

Challenges such as distributed storage high volume and variety that require scalable access control encryption and monitoring

Question 43

Backup data protection

Answer 43

Safeguards for backup media including encryption offsite storage handling procedures and access restrictions

Question 44

Snapshot and replication security

Answer 44

Ensuring that storage snapshots and replicas inherit encryption access control and geographic constraints of primary data

Question 45

Information rights management

Answer 45

Technology that enforces usage policies on documents such as view print copy or forward based on embedded rights

Question 46

Data lineage

Answer 46

Recorded path of how data moves transforms and is used across systems to support impact analysis accountability and compliance

Question 47

Data quality and security

Answer 47

Recognition that high quality consistent data supports security analytics while poor quality can mask anomalies or cause incorrect access decisions

Question 48

Cloud data residency

Answer 48

Requirement that certain data be stored and processed only within specific geographic or legal jurisdictions affecting region and service selection

Question 49

SaaS data protection pattern

Answer 49

Combination of configuration controls encryption options export capabilities and monitoring used to protect data held in software as a service platforms