Free Data Protection and Data Roles practice questions
10 free SY0-801 questions on Data Protection and Data Roles, each with a full explanation — no account needed. This section sits in the Security Architecture part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
An audit finds Social Security numbers pasted into support emails, captured in screenshots attached to tickets and shared in chat messages. Which description and control fit BEST?
Emails, screenshots and chat messages are unstructured data, and the first job is finding the sensitive content, which DLP tools do by scanning mailboxes, file shares and cloud storage for patterns. Column encryption, dynamic masking and database views are precise controls for structured data held in known fields.
A company wants to run analytics on sensitive records in a public cloud so that even the provider's administrators and hypervisor can't read the data while it is being processed. Which approach fits BEST?
Data being processed is data in use, and a trusted execution environment keeps it encrypted and walled off from the host operating system, the hypervisor and the provider's administrators. Disk encryption and customer-managed storage keys protect data at rest, and TLS protects data in transit, so none of them covers the moment of processing.
A company's classification scheme uses Public, Internal, Confidential and Restricted, with Restricted the most sensitive. How does Confidential in this scheme compare with Confidential in the U.S. government scheme?
In a typical four-tier commercial scheme, Confidential sits between Internal and Restricted, while for the U.S. government it is the lowest of the three classified levels, below Secret and Top secret. Restricted isn't a U.S. classification level at all, so the two schemes can't be lined up word for word.
An analyst holds a Secret clearance, yet she can't open most of the Secret documents stored in her building. What is the MOST likely reason?
Access to classified data needs both a clearance at or above the data's level and a need to know, so she sees only what her work requires. Owner-granted access describes discretionary control, whereas government classification is the textbook case of mandatory access control, decided by labels and central policy.
An attacker changes the prices on a retailer's published price list, which anyone can view. Why is this still a security incident even though the data is public?
A Public label means disclosure causes no harm, so the data needs no confidentiality protection, but it still has to be accurate, and an unauthorized change is an integrity failure. Publishing data doesn't move it to a higher tier or automatically make it critical.
Developers need a copy of the production customer database to test a new feature. The copy must behave like real data, but a breach of the test environment must expose no real customers. Which method fits BEST?
Static masking permanently replaces values in a copy with realistic fake ones, so the test database works but holds no real customers. Dynamic masking is the tempting choice, but it leaves real data stored and only hides it at display time, and encryption with a key the developers hold lets them read every real record.
A company stores unsalted SHA-256 hashes of customers' Social Security numbers so it can match records without keeping the numbers. Why is this weak, and what fixes it?
There are at most a billion possible Social Security numbers, so an attacker can hash every one and rebuild the whole table; a keyed hash such as HMAC stops this as long as the key stays secret. SHA-256 has no key to reverse it with, and Base64 is an encoding that anyone can decode.
A research dataset has names, Social Security numbers and email addresses removed, but it keeps each person's ZIP code, full date of birth and sex. Why is re-identification still a serious risk?
Quasi-identifiers identify people in combination, and research found that ZIP code, full birth date and sex alone single out about 87 percent of Americans. Pseudonymization replaces identifiers while keeping a separate mapping, which this dataset doesn't do, and no token vault is involved.
An analyst finds a PowerShell command launched with a long -EncodedCommand string of Base64 text. What kind of protection does Base64 give the hidden command?
Base64 is an encoding that hides text from casual eyes but can be decoded by anyone, so it is obfuscation, and attackers use it to make commands harder to read in logs. It uses no key, so it isn't encryption, and unlike a hash it reverses exactly to the original.
A legacy billing system stores card numbers in a field that accepts exactly 16 digits. The numbers must be encrypted so authorized systems holding a key can recover them, and the field can't change. Which method fits BEST?
Format-preserving encryption produces ciphertext with the same length and alphabet as the input, so a 16-digit field still holds 16 digits, and key holders can decrypt it. Standard AES changes the value's length and character set, while hashing and static masking can't be reversed to recover the card number.
Study this section
Every lesson that covers Data Protection and Data Roles on the SY0-801 exam.