100-160 Question 208
Select 2During a routine security assessment, your organization identifies sensitive customer data stored in an unencrypted database. As part of remediation, you are asked to classify the data to determine the appropriate security measures. Which of the following classifications and actions are most appropriate in this situation?
- A
Classify the data as public and implement basic access controls.
- B
Classify the data as confidential and enforce encryption at rest and in transit.
- C
Classify the data as sensitive and restrict access to authorized personnel only.
- D
Classify the data as critical and implement a disaster recovery plan for the database.
- E
Classify the data as proprietary and ensure it is only accessible within the organization.
Show answer and explanation
Correct answers: B, C
Explanation
Sensitive customer data, such as PII, must be classified appropriately to ensure compliance with security standards and regulatory requirements. Confidentiality and access control are key principles in this context, making classifications like 'confidential' and 'sensitive' the most appropriate. These classifications guide the implementation of encryption and access restrictions to protect the data from unauthorized access or disclosure.
- A. Incorrect.
Classifying sensitive customer data as public is incorrect, as public data does not require strict access controls or encryption. This would expose the data to unnecessary risk.
- B. Correct.
Classifying the data as confidential is appropriate because sensitive customer data often includes PII (Personally Identifiable Information), which requires encryption during storage and transmission to ensure security.
- C. Correct.
Classifying the data as sensitive and restricting access to authorized personnel aligns with best practices for protecting customer data from unauthorized access.
- D. Incorrect.
While disaster recovery plans are important, classifying customer data as critical focuses on availability rather than confidentiality, which is not the primary concern here.
- E. Incorrect.
Classifying the data as proprietary is not the best fit, as proprietary data typically refers to intellectual property or internal business information, not customer data.