Question 90 A company deletes cloud objects but retains unmanaged replicas in backups. What should disposal planning include? Map primary and replicated copies and manage deletion according to retention and restoration constraints Distinguish controller decisions from processor obligations in the processing agreement Keep sanitization method, verification result, custody and disposal records Keep classification, access and retention rules effective through archival and final disposal Explanation Correct Answer A:A deletion request may leave additional recoverable copies unless the entire data lifecycle is considered. Incorrect Answers B:The other scenario states that a cloud vendor processes personal information under customer instruction, where purpose determination and delegated processing are different responsibilities; by contrast, the present case requires map primary and replicated copies and manage deletion according to retention and restoration constraints. C:This option fits a different fact pattern where a manufacturer must prove discarded media no longer exposes a design secret: documented validation supports assurance that reuse or destruction was appropriate for sensitivity; the current case instead requires map primary and replicated copies and manage deletion according to retention and restoration constraints. D:For the separate situation in which employees assume moving records to an archive means they no longer need access controls, lifecycle transitions do not remove confidentiality or integrity obligations; here the stated problem requires map primary and replicated copies and manage deletion according to retention and restoration constraints.
Question 91 A consumer asks who decides why collected location data is used. Which role should be identified? Identify the responsible data controller or equivalent governing party for processing purposes Minimize collection and promptly dispose of raw images after required verification and retention periods Keep classification, access and retention rules effective through archival and final disposal Map primary and replicated copies and manage deletion according to retention and restoration constraints Explanation Correct Answer A:Purpose and means decisions belong to the controlling organization under applicable arrangements. Incorrect Answers B:Keeping unnecessary identity evidence creates avoidable privacy and breach risk; it is relevant where a service needs raw identification images only to verify accounts at signup, whereas the current facts require identify the responsible data controller or equivalent governing party for processing purposes to address the stated problem. C:Lifecycle transitions do not remove confidentiality or integrity obligations; although this helps when employees assume moving records to an archive means they no longer need access controls, it leaves the current case's need to identify the responsible data controller or equivalent governing party for processing purposes unresolved. D:A deletion request may leave additional recoverable copies unless the entire data lifecycle is considered; it is relevant where a company deletes cloud objects but retains unmanaged replicas in backups, whereas the current facts require identify the responsible data controller or equivalent governing party for processing purposes to address the stated problem.
Question 92 A manufacturer must prove discarded media no longer exposes a design secret. What evidence should it retain? Map primary and replicated copies and manage deletion according to retention and restoration constraints Select and verify media sanitization under a risk-based program suitable for the device and data Identify the responsible data controller or equivalent governing party for processing purposes Keep sanitization method, verification result, custody and disposal records Explanation Correct Answer D:Documented validation supports assurance that reuse or destruction was appropriate for sensitivity. Incorrect Answers A:A deletion request may leave additional recoverable copies unless the entire data lifecycle is considered; although this helps when a company deletes cloud objects but retains unmanaged replicas in backups, it leaves the current case's need to keep sanitization method, verification result, custody and disposal records unresolved. B:Deletion of visible files alone is not reliable sanitization of underlying media; it is relevant where a solid-state drive containing classified data is being reused for a lower-sensitivity task, whereas the current facts require keep sanitization method, verification result, custody and disposal records to address the stated problem. C:For the separate situation in which a consumer asks who decides why collected location data is used, purpose and means decisions belong to the controlling organization under applicable arrangements; here the stated problem requires keep sanitization method, verification result, custody and disposal records.
Question 93 A fleet's operating system reaches end of support next quarter but a critical workflow still depends on it. What should management plan? Approve a migration or replacement path with temporary risk treatment and deadlines Verify return or approved destruction of retained information and revoke access Preserve the held information through a supported migration before sanitizing the original media Treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement Explanation Correct Answer A:End-of-support removes timely vendor fixes and raises residual exposure. Incorrect Answers B:For the separate situation in which an outsourcing contract expires but the supplier still retains files in its platform, contract termination does not itself remove residual data or external credentials; here the stated problem requires approve a migration or replacement path with temporary risk treatment and deadlines. C:This option fits a different fact pattern where a records team wants to erase evidence that has an active litigation hold because the disks are old: retention obligations override routine end-of-life destruction for in-scope evidence; the current case instead requires approve a migration or replacement path with temporary risk treatment and deadlines. D:The other scenario states that a critical router is still technically functional but cannot receive security updates, where operational uptime does not substitute for supported vulnerability remediation; by contrast, the present case requires approve a migration or replacement path with temporary risk treatment and deadlines.
Question 94 Several storage arrays are retired without checking contractual record retention. What step is essential? Reconcile legal holds and retention obligations before sanitizing or disposing of media Verify return or approved destruction of retained information and revoke access Treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement Inventory, sanitize and dispose of devices under a controlled retirement process Explanation Correct Answer A:Required records must survive compliant retention even when equipment is retired. Incorrect Answers B:Contract termination does not itself remove residual data or external credentials; although this helps when an outsourcing contract expires but the supplier still retains files in its platform, it leaves the current case's need to reconcile legal holds and retention obligations before sanitizing or disposing of media unresolved. C:Operational uptime does not substitute for supported vulnerability remediation; this responds to the different circumstance in which a critical router is still technically functional but cannot receive security updates, while the current case states that several storage arrays are retired without checking contractual record retention, calling for reconcile legal holds and retention obligations before sanitizing or disposing of media. D:The other scenario states that a department stockpiles obsolete tablets that contain customer data, where idle devices remain risk-bearing assets until custody and data disposition are resolved; by contrast, the present case requires reconcile legal holds and retention obligations before sanitizing or disposing of media.
Question 95 A department stockpiles obsolete tablets that contain customer data. What lifecycle action is most appropriate? Verify return or approved destruction of retained information and revoke access Inventory, sanitize and dispose of devices under a controlled retirement process Preserve the held information through a supported migration before sanitizing the original media Treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement Explanation Correct Answer B:Idle devices remain risk-bearing assets until custody and data disposition are resolved. Incorrect Answers A:Contract termination does not itself remove residual data or external credentials; this responds to the different circumstance in which an outsourcing contract expires but the supplier still retains files in its platform, while the current case states that a department stockpiles obsolete tablets that contain customer data, calling for inventory, sanitize and dispose of devices under a controlled retirement process. C:For the separate situation in which a records team wants to erase evidence that has an active litigation hold because the disks are old, retention obligations override routine end-of-life destruction for in-scope evidence; here the stated problem requires inventory, sanitize and dispose of devices under a controlled retirement process. D:For the separate situation in which a critical router is still technically functional but cannot receive security updates, operational uptime does not substitute for supported vulnerability remediation; here the stated problem requires inventory, sanitize and dispose of devices under a controlled retirement process.
Question 96 A critical router is still technically functional but cannot receive security updates. How should it be classified? Treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement Reconcile legal holds and retention obligations before sanitizing or disposing of media Preserve the held information through a supported migration before sanitizing the original media Verify return or approved destruction of retained information and revoke access Explanation Correct Answer A:Operational uptime does not substitute for supported vulnerability remediation. Incorrect Answers B:Required records must survive compliant retention even when equipment is retired; this responds to the different circumstance in which several storage arrays are retired without checking contractual record retention, while the current case states that a critical router is still technically functional but cannot receive security updates, calling for treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement. C:Retention obligations override routine end-of-life destruction for in-scope evidence; although this helps when a records team wants to erase evidence that has an active litigation hold because the disks are old, it leaves the current case's need to treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement unresolved. D:The other scenario states that an outsourcing contract expires but the supplier still retains files in its platform, where contract termination does not itself remove residual data or external credentials; by contrast, the present case requires treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement.
Question 97 An outsourcing contract expires but the supplier still retains files in its platform. What should offboarding require? Inventory, sanitize and dispose of devices under a controlled retirement process Verify return or approved destruction of retained information and revoke access Treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement Approve a migration or replacement path with temporary risk treatment and deadlines Explanation Correct Answer B:Contract termination does not itself remove residual data or external credentials. Incorrect Answers A:Idle devices remain risk-bearing assets until custody and data disposition are resolved; this responds to the different circumstance in which a department stockpiles obsolete tablets that contain customer data, while the current case states that an outsourcing contract expires but the supplier still retains files in its platform, calling for verify return or approved destruction of retained information and revoke access. C:The other scenario states that a critical router is still technically functional but cannot receive security updates, where operational uptime does not substitute for supported vulnerability remediation; by contrast, the present case requires verify return or approved destruction of retained information and revoke access. D:For the separate situation in which a fleet's operating system reaches end of support next quarter but a critical workflow still depends on it, end-of-support removes timely vendor fixes and raises residual exposure; here the stated problem requires verify return or approved destruction of retained information and revoke access.
Question 98 A records team wants to erase evidence that has an active litigation hold because the disks are old. What should prevail? Preserve the held information through a supported migration before sanitizing the original media Treat unsupported status as an elevated lifecycle risk requiring compensating controls or replacement Inventory, sanitize and dispose of devices under a controlled retirement process Approve a migration or replacement path with temporary risk treatment and deadlines Explanation Correct Answer A:Retention obligations override routine end-of-life destruction for in-scope evidence. Incorrect Answers B:For the separate situation in which a critical router is still technically functional but cannot receive security updates, operational uptime does not substitute for supported vulnerability remediation; here the stated problem requires preserve the held information through a supported migration before sanitizing the original media. C:This option fits a different fact pattern where a department stockpiles obsolete tablets that contain customer data: idle devices remain risk-bearing assets until custody and data disposition are resolved; the current case instead requires preserve the held information through a supported migration before sanitizing the original media. D:The other scenario states that a fleet's operating system reaches end of support next quarter but a critical workflow still depends on it, where end-of-support removes timely vendor fixes and raises residual exposure; by contrast, the present case requires preserve the held information through a supported migration before sanitizing the original media.
Question 99 A security officer encrypts database files at rest but a privileged app exposes records in clear memory. What additional risk must be treated? Use cloud-service discovery and governance capabilities such as a CASB where appropriate Protect data in use through access isolation, process hardening and appropriate runtime controls Use data loss prevention inspection with tuned classification rules and approved exceptions Define encryption scope, key custody, rotation and allowed decrypt principals Explanation Correct Answer B:At-rest encryption does not govern plaintext while authorized applications process it. Incorrect Answers A:For the separate situation in which teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files, cloud access governance identifies risky services and applies organization data-handling policy; here the stated problem requires protect data in use through access isolation, process hardening and appropriate runtime controls. C:The other scenario states that a company needs to detect sensitive identifiers leaving through web uploads, where dLP identifies or blocks risky transfers based on content and context; by contrast, the present case requires protect data in use through access isolation, process hardening and appropriate runtime controls. D:Effective cryptography depends on lifecycle management and authorization, not a checkbox; although this helps when a standard mandates encryption everywhere but ignores key storage and access, it leaves the current case's need to protect data in use through access isolation, process hardening and appropriate runtime controls unresolved.
Question 100 A publisher wants to discourage unauthorized redistribution of licensed reports. Which protection is most relevant? Use cloud-service discovery and governance capabilities such as a CASB where appropriate Apply digital rights management with authorized licensing and recipient controls Use data loss prevention inspection with tuned classification rules and approved exceptions Define encryption scope, key custody, rotation and allowed decrypt principals Explanation Correct Answer B:DRM supports controlled use of protected content beyond network encryption alone. Incorrect Answers A:Cloud access governance identifies risky services and applies organization data-handling policy; it is relevant where teams adopt dozens of unsanctioned cloud collaboration tools holding sensitive files, whereas the current facts require apply digital rights management with authorized licensing and recipient controls to address the stated problem. C:DLP identifies or blocks risky transfers based on content and context; although this helps when a company needs to detect sensitive identifiers leaving through web uploads, it leaves the current case's need to apply digital rights management with authorized licensing and recipient controls unresolved. D:This option fits a different fact pattern where a standard mandates encryption everywhere but ignores key storage and access: effective cryptography depends on lifecycle management and authorization, not a checkbox; the current case instead requires apply digital rights management with authorized licensing and recipient controls.
