A hospital's IT department is configuring access to patient records. The policy states that only healthcare providers directly involved in a patient's care should have access. A nurse requests access to a patient's record because the patient is a neighbor. What should the IT department do?

Ask the patient if they consent to the nurse viewing the record

Deny access because the nurse is not part of the patient's care team

Grant access but log the nurse's activity

Grant access because the nurse knows the patient personally

An HR system stores employee records including home addresses, medical leave records, and performance reviews. Which of these data types is considered PII?

Home addresses and medical leave records, but not performance reviews

All three: home addresses, medical leave records, and performance reviews

An employee wants to use a personal cloud storage service to back up work files because the company's approved storage is full. The files include customer contracts and internal project plans. What should the employee do?

Use the personal service because the company storage is full

Use the personal service only for the project plans, not the contracts

Compress the files before uploading to reduce risk

Request additional storage from IT or use an approved alternative

A company's legal team needs to share a contract with an external auditor. The contract contains confidential business terms and the auditor's email address. The company's policy requires encryption for external sharing. The IT team must choose a method that balances security with the auditor's ability to access the file. Which method is most appropriate?

Email the contract as an encrypted PDF with the password sent in a separate email

Upload the contract to a public cloud storage link with no password

Print the contract and mail it to the auditor

Use a secure file-sharing service that requires the auditor to authenticate with a one-time code

A company is developing a new smartphone and has created a document with the device's specifications, a list of beta testers' email addresses, and a public press release. How should the specifications document be classified?

PII, because it includes beta testers' email addresses

Proprietary, because it contains trade secrets about the product

Confidential, but only until the press release is issued

Public, because it describes a product that will be released

CiscoCertified Support Technician (CCST) IT Support

Domain 5Objective 3

5.3. Recognize How Company Policies and Confidentiality Guidelines Protect User Data. 100-140 Practice Questions (Page 4)

Part of the Common Threats and Preventions domain, which makes up ~12% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~2–4 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

6concepts

Questions 16–20

16expert · hard
A hospital's IT department is configuring access to patient records. The policy states that only healthcare providers directly involved in a patient's care should have access. A nurse requests access to a patient's record because the patient is a neighbor. What should the IT department do?
Select an answer first
17application · medium
An HR system stores employee records including home addresses, medical leave records, and performance reviews. Which of these data types is considered PII?
Select an answer first
18application · medium
An employee wants to use a personal cloud storage service to back up work files because the company's approved storage is full. The files include customer contracts and internal project plans. What should the employee do?
Select an answer first
19expert · hard
A company's legal team needs to share a contract with an external auditor. The contract contains confidential business terms and the auditor's email address. The company's policy requires encryption for external sharing. The IT team must choose a method that balances security with the auditor's ability to access the file. Which method is most appropriate?
Select an answer first
20application · medium
A company is developing a new smartphone and has created a document with the device's specifications, a list of beta testers' email addresses, and a public press release. How should the specifications document be classified?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-140

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-140” is a trademark of its owner, used for identification only.