Determine How to Classify Data CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare provider is subject to HIPAA and must ensure that all protected health information (PHI) is classified and protected. They are implementing a data classification program. What is the primary regulatory driver for classifying PHI?

   • ATo comply with HIPAA requirements for safeguarding PHI and ensuring appropriate access controls.
   • BTo reduce the cost of storing PHI by identifying and deleting unnecessary records.
   • CTo ensure that PHI is encrypted at rest and in transit.
   • DTo enable the organization to share PHI with business associates without restrictions.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization has a mix of structured data in SQL databases and unstructured data in network shares and Microsoft 365. The security team needs to build a complete data inventory to support a new classification initiative. They have limited staff and need to prioritize the most efficient method. What should they do first?

   • AFocus only on the SQL databases because they contain the most critical data, and ignore the unstructured shares.
   • BDeploy an automated discovery tool that scans both structured and unstructured sources and produces a unified inventory.
   • CUse a data loss prevention (DLP) tool to monitor data in motion and infer the inventory from that traffic.
   • DAsk each department to manually list their data assets and submit the inventory to the security team.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of aligning data classification policies with broader governance and compliance frameworks?

   • ATo ensure that classification supports organizational objectives and regulatory obligations
   • BTo reduce the number of classification levels
   • CTo make classification mandatory for all data
   • DTo eliminate the need for data owners
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational company operates in the EU and the US. It must comply with GDPR for EU personal data and with various US state privacy laws. The current classification scheme uses four levels: Public, Internal, Confidential, and Restricted. The legal team has determined that EU personal data must be treated as 'Restricted' regardless of its content, while US state privacy laws allow a more granular approach. The company wants to avoid over-classifying data, which would increase operational overhead. What is the best approach to align the classification scheme with these regulatory drivers?

   • AAdopt a single global classification scheme with 'Restricted' for all personal data, regardless of jurisdiction.
   • BUse the existing four-level scheme but add a metadata field for 'Regulatory Jurisdiction' to differentiate EU vs. US personal data.
   • CCreate a separate classification scheme for EU data and another for US data, with different labels and criteria.
   • DClassify all data as 'Confidential' by default and then reclassify based on user requests.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is rolling out a data classification program. They want to ensure that new files created by employees are automatically classified at the point of creation, and that the classification is applied consistently across all file types. They use Microsoft 365 and have an on-premises file server. What should they implement?

   • AA policy that only classifies files when they are accessed, not at creation.
   • BA manual process where employees right-click each file and select a classification label from a dropdown menu.
   • CAn automated labeling policy in Microsoft 365 that applies labels based on content patterns, and a similar tool for on-premises files.
   • DA script that runs nightly to scan all files and apply labels based on file extension.
   Reveal Solution Discussion Select an answer first