100-160 Question 209
Single answerA cybersecurity analyst is conducting a security assessment of an organization’s IT systems. During the process, they identify that sensitive customer data is being stored in a shared folder without any encryption or proper access controls. Which data classification and recommended action should the analyst prioritize in this scenario?
- A
Classify the data as Public and move it to a secure shared folder.
- B
Classify the data as Confidential and implement encryption and strict access controls.
- C
Classify the data as Restricted and delete it immediately to prevent exposure.
- D
Classify the data as Internal Use Only and log the activity for future review.
Show answer and explanation
Correct answer: B
Explanation
Sensitive customer data should be classified as Confidential because it involves information that could result in significant harm if exposed. The best practice is to secure this data by implementing encryption and strict access controls to prevent unauthorized access. Proper classification and handling ensure compliance with organizational policies and data protection regulations.
- A. Incorrect.
Public data does not include sensitive customer information and does not require encryption or strict access controls. This option is incorrect.
- B. Correct.
Confidential data typically includes sensitive customer information such as personal or financial details. The appropriate action is to classify it correctly and apply encryption and access controls to prevent unauthorized access. This option is correct.
- C. Incorrect.
Restricted data classification is usually applied to highly sensitive data (e.g., government secrets). Deleting customer data without proper authorization may result in data loss and other consequences. This option is incorrect.
- D. Incorrect.
Internal Use Only data does not generally include sensitive customer information and may not require encryption. Logging activity without securing the data leaves it vulnerable. This option is incorrect.