Identify Data Classification Requirements CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A hospital is implementing a data lifecycle policy for patient records. The policy must comply with a regulation that requires retaining medical records for 10 years, but also requires that patient consent be obtained before any data is used for research. The hospital wants to use de-identified patient data for research. What is the most appropriate approach?

   • AObtain consent for research use, de-identify the data, classify the de-identified data as internal, and retain the original records for 10 years
   • BRetain all patient records for 10 years, then dispose of them without considering research use
   • CDe-identify patient data for research, classify the de-identified data as public, and retain the original records for 10 years
   • DDispose of patient records after 5 years to reduce the risk of unauthorized access
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government agency is defining data lifecycle policies. They have a dataset of citizen tax records that must be retained for seven years per regulation, then securely destroyed. Which lifecycle stage requires the most explicit definition of the data's classification and sensitivity?

   • AStorage, because the data must be encrypted and access-controlled based on its classification
   • BRetention, because the retention period must match the classification level
   • CGeneration, because the classification must be assigned at the point of creation to guide all subsequent handling
   • DDisposal, because the destruction method must be appropriate for the data's sensitivity
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A retail company is implementing a data governance program. They have a data dictionary that defines each data element, but they are unsure who should be responsible for ensuring that customer purchase history is properly classified and that access is granted only to authorized personnel. Which role should be assigned this responsibility?

   • AData owner, who defines the classification and authorizes access based on business needs
   • BDatabase administrator, who manages the physical storage and performance
   • CSecurity analyst, who monitors for unauthorized access and alerts on anomalies
   • DData custodian, who implements the technical controls and manages access
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement correctly describes the relationship between data owner and data custodian in a data dictionary context?

   • AThe custodian is accountable for data breaches; the owner is responsible for daily backups.
   • BThe custodian assigns classification; the owner enforces access controls.
   • CBoth roles are interchangeable and can be performed by the same person without issue.
   • DThe owner defines classification and access rules; the custodian implements and maintains them.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A non-profit organization publishes a list of donors on its website, but also maintains a database of donor email addresses for sending receipts. The organization is considering whether to classify the donor list as public and the email addresses as PII. What is the primary risk if the email addresses are classified as public?

   • AThe donor list would become more difficult to publish
   • BThe email addresses could be used for phishing or spam, causing harm to the donors
   • CThe organization would be unable to send receipts to donors
   • DThe email addresses would be subject to stricter retention requirements
   Reveal Solution Discussion Select an answer first