Introduction to Data Security CSCU Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A university research department handles three types of data: unpublished research findings, student records, and publicly available course catalogs. The department wants to implement a data classification scheme. Which classification labels and corresponding controls are most appropriate?

   • AUnpublished research: 'Public'; student records: 'Internal'; course catalogs: 'Confidential'.
   • BUnpublished research: 'Internal'; student records: 'Public'; course catalogs: 'Confidential'.
   • CAll data: 'Confidential' with the same encryption and access controls to simplify management.
   • DUnpublished research: 'Restricted' with encryption and need-to-know access; student records: 'Confidential' with access controls; course catalogs: 'Public' with no special controls.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is data security important for an organization's information assets?

   • AIt ensures that data is stored in physical files only
   • BIt eliminates the need for user authentication
   • CIt guarantees that all data will be publicly available for transparency
   • DIt helps prevent financial loss, reputational damage, and legal penalties from data breaches
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A government agency is implementing a data classification policy. They have data that is unclassified, sensitive but unclassified (SBU), confidential, and top secret. The agency must ensure that data is protected according to its classification, but also allow for efficient sharing between departments with appropriate clearance. Which approach is most effective?

   • AUse discretionary access control (DAC) where data owners decide who can access their data.
   • BRely on user training to ensure that employees only share data with authorized individuals.
   • CApply the same protection to all data regardless of classification.
   • DImplement mandatory access control (MAC) based on classification labels and user clearances.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A hospital's IT department is updating its data-handling policy. Patient medical records are stored in an encrypted database, but staff frequently email unencrypted spreadsheets containing patient names and diagnoses to each other for shift handovers. The hospital's compliance officer wants to reduce the risk of unauthorized disclosure while keeping the handover process efficient. Which action best addresses the threat without disrupting daily operations?

   • ARequire all staff to encrypt their laptops with BitLocker and enforce a strong password policy.
   • BReclassify patient medical records as 'internal use only' so they are no longer subject to the highest security controls.
   • CTrain staff on the importance of data confidentiality and ask them to voluntarily stop emailing patient data.
   • DImplement a Data Loss Prevention (DLP) solution that blocks emails containing patient identifiers and directs staff to use the encrypted internal messaging system.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small law firm stores client case files on a network share. The firm wants to ensure that only the assigned attorney and the paralegal can read a case file, and that any changes are logged. Which combination of measures best achieves this?

   • AStore the files on a USB drive kept in the attorney's desk.
   • BShare the folder with everyone and rely on the office door being locked.
   • CSet NTFS permissions to grant read access to the attorney and paralegal, and enable auditing on the folder.
   • DEncrypt the files with a password known to all staff.
   Reveal Solution Discussion Select an answer first