200-201 Question 387
Select 3During a network security audit, you are tasked with identifying protected data being transmitted over the network. Which of the following types of data would typically require protection to meet compliance or regulatory requirements?
- A
Social Security Numbers (SSNs) transmitted in plaintext
- B
Publicly available information such as a company's website URL
- C
Credit card numbers transmitted over an encrypted connection
- D
Employee email addresses shared in an internal company document
- E
Patient health records sent via an unencrypted email
- F
System logs containing non-sensitive server performance metrics
Show answer and explanation
Correct answers: A, C, E
Explanation
Protected data refers to information that requires safeguarding due to its sensitive nature or regulatory requirements, such as Social Security Numbers, credit card details, or patient health records. Identifying such data ensures compliance with cybersecurity policies and prevents unauthorized access or data breaches. Non-sensitive or publicly available data typically does not require the same level of protection.
- A. Correct.
Social Security Numbers (SSNs) are considered sensitive personal information and must be protected during transmission. If transmitted in plaintext, they are at risk of interception and misuse.
- B. Incorrect.
Publicly available information, such as a company's website URL, does not require protection as it is not sensitive or private information.
- C. Correct.
Credit card numbers are classified as sensitive data under compliance regulations like PCI DSS. Even though they are transmitted over an encrypted connection, they are still considered protected data.
- D. Incorrect.
Employee email addresses shared in an internal company document are typically not classified as protected data unless combined with other sensitive information.
- E. Correct.
Patient health records fall under regulations like HIPAA and require protection. Sending them via unencrypted email poses a significant security and compliance risk.
- F. Incorrect.
System logs containing non-sensitive server performance metrics do not generally contain protected data and therefore do not require special handling.