5.9 Identify Protected Data in a Network 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A cyberops analyst is investigating a breach where a database of customer email addresses and passwords was stolen. The company is concerned about legal and reputational damage. Which consequence is most directly associated with this type of data exposure?

   • AHIPAA non-compliance penalties
   • BIdentity theft and fraud
   • CPatent infringement claims
   • DLoss of intellectual property rights
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational company operates in a jurisdiction where sexual orientation is considered PSI and requires explicit consent for processing. The company's HR database stores employee sexual orientation for diversity reporting. The legal team wants to minimize compliance risk while retaining the data. Which action should the cyberops analyst recommend?

   • AAnonymize the data so it cannot identify individuals
   • BObtain explicit consent from employees and implement strict access controls
   • CMove the data to a cloud provider in a different jurisdiction
   • DEncrypt the field and restrict access to HR only
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which regulatory framework in the United States governs the protection of protected health information (PHI)?

   • APCI DSS (Payment Card Industry Data Security Standard)
   • BHIPAA (Health Insurance Portability and Accountability Act)
   • CGDPR (General Data Protection Regulation)
   • DSOX (Sarbanes-Oxley Act)
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A human resources system stores employee records that include job titles, performance reviews, and salary information. A security analyst is asked to classify this data. Which classification is most accurate?

   • APII only, because the records contain employee names and job titles.
   • BBoth PII and PSI, because the records contain identifiers and sensitive personal attributes.
   • CPSI only, because salary and performance are sensitive personal information.
   • DPHI, because the records are stored in a human resources system.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company stores customer data in a cloud database. The data includes names, email addresses, and purchase history. A security analyst is asked to recommend a control to reduce the risk of a data breach. Which control is most directly effective for protecting this data?

   • AStore the data in a public cloud without access controls.
   • BEncrypt the database at rest and in transit.
   • CGrant all employees read access to the database for convenience.
   • DDisable all logging to reduce the attack surface.
   Reveal Solution Discussion Select an answer first