SY0-701 Question 217
Single answerData types: Regulated , Trade secret , Intellectual property , Legal information , Financial information , Human and non-human-readableA security administrator is helping a company classify data before migrating several repositories to a cloud collaboration platform. The company stores: source code for a proprietary product, merger-and-acquisition documents prepared by outside counsel, quarterly earnings spreadsheets, exported database backups containing customer Social Security numbers, and machine-generated application logs in JSON format. Management wants the administrator to identify which data set is most clearly subject to specific regulatory handling requirements if exposed. Which of the following should the administrator classify as regulated data first?
- A
Source code for the company's unreleased product
- B
Merger-and-acquisition documents prepared by legal counsel
- C
Quarterly earnings spreadsheets used by the finance department
- D
Database backups containing customer Social Security numbers
- E
Application logs stored in JSON format
Show answer and explanation
Correct answer: D
Explanation
The best answer is the database backups containing customer Social Security numbers because this is the option most clearly tied to regulated data handling requirements. In Security+, candidates are expected to distinguish among data types such as regulated data, trade secrets, intellectual property, legal information, financial information, and human-readable versus non-human-readable data. Source code is generally intellectual property and may also be a trade secret. M&A documents are legal information and may involve attorney-client privilege. Earnings spreadsheets are financial information. JSON logs describe a data format and may be machine-oriented, but format alone does not create a regulatory category.
By contrast, Social Security numbers are a classic example of sensitive personally identifiable information. Organizations handling this type of data commonly face requirements under state breach-notification laws, privacy laws, contractual obligations, and sector-specific standards. Best practices from NIST guidance, such as NIST SP 800-122 on protecting PII and NIST SP 800-53 control families for access control, audit, and data protection, support prioritizing strong safeguards for this data. In a real migration, the administrator should identify regulated datasets first so the organization can apply appropriate encryption, access restrictions, retention rules, monitoring, and incident-response procedures before moving them.
- A. Incorrect.
Incorrect. Proprietary source code is typically classified as intellectual property and may also be a trade secret if it derives independent economic value from not being generally known. It is highly sensitive and should be protected, but it is not inherently regulated in the same way as personal data governed by privacy laws and breach-notification requirements.
- B. Incorrect.
Incorrect. M&A documents from legal counsel are legal information and may be highly confidential or privileged. They require strong access controls and careful handling, but they are not, by default, the most clearly regulated category among the choices unless they also contain regulated personal or financial data subject to a specific law.
- C. Incorrect.
Incorrect. Quarterly earnings spreadsheets are financial information and can be sensitive, especially before public release. However, internal financial records are not as clearly subject to specific privacy-oriented regulatory handling requirements as records containing Social Security numbers. This option is plausible because financial data is sensitive, but the question asks for the data set most clearly regulated if exposed.
- D. Correct.
Correct. Customer Social Security numbers are personally identifiable information and are commonly subject to federal, state, and industry-specific legal and regulatory requirements for protection, retention, disclosure, and breach notification. Backups containing this data should be prioritized as regulated data because exposure can trigger statutory obligations and significant harm to affected individuals.
- E. Incorrect.
Incorrect. JSON logs are an example of non-human-readable or machine-oriented structured data, although they can often still be read by humans with tools. Their format does not by itself determine regulatory status. Logs become regulated only if they contain regulated elements such as PII, PHI, payment card data, or other protected content.