GSEC Defense in Depth Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Encrypt the backup tapes using AES-256 with keys managed separately from the tapes.

  Why this is correct

  Encrypting the tapes with AES-256 renders the data unreadable without the key, so a lost or stolen tape does not expose customer information. Managing keys separately from the tapes ensures the key is not lost with the media. This is the direct technical control that addresses the confidentiality risk described.

• ✗

  Require the courier to sign a non-disclosure agreement and provide chain-of-custody documentation.

  Why it's wrong here

  An NDA and chain-of-custody records create legal and procedural accountability, but they do not prevent data exposure if a tape is physically lost or stolen. Anyone who recovers the tape could still read its contents. This is an administrative control that supports investigation but does not protect the data itself.

• ✗

  Install GPS trackers on the transport vehicle and monitor the route in real time.

  Why it's wrong here

  GPS tracking helps locate a vehicle after a theft and may deter some incidents, but it does not protect the data on the tapes. If a tape is removed and copied, tracking the vehicle provides no confidentiality. This is a physical security measure that supports recovery, not data protection.

• ✗

  Reduce the backup retention period from one year to thirty days to limit exposure.

  Why it's wrong here

  Shortening retention reduces the window in which a lost tape could be exploited, but it does not prevent exposure if a tape is lost during the shortened period. It also conflicts with business and regulatory retention requirements. The control changes policy but leaves the underlying data unprotected on the media.