Examkin

Question

Difficulty: MediumData Privacy and Compliance Regulations

An IT technician conducting a file server audit discovers an unencrypted shared directory containing employee Social Security numbers, dates of birth, and personal home addresses. Which of the following data classifications best describes this information, and what security control must be implemented to maintain compliance?

  1. Personally Identifiable Information (PII); access must be restricted using access control lists and data must be encrypted.Answer
  2. B
    Protected Health Information (PHI); the folder must be configured with HIPAA audit logging and biometric authentication.
  3. C
    Cardholder Data (CHD); all files must be permanently sanitized to meet PCI-DSS post-authorization storage regulations.
  4. D
    Publicly Accessible Data; no encryption or access control is necessary because these fields are standard corporate directory items.

Answer

Personally Identifiable Information (PII); access must be restricted using access control lists and data must be encrypted.
The correct response accurately identifies Social Security numbers, birth dates, and home addresses as Personally Identifiable Information (PII). PII encompasses any data that can directly or indirectly identify an individual. Compliance guidelines mandate restricting access to authorized personnel and encrypting the data at rest to prevent unauthorized disclosure.

Step-by-Step Solution

1
Analyze the types of data discovered during the server audit (Social Security numbers, dates of birth, home addresses).
Identified the records as data elements that can be traced directly back to specific individuals.
Determining the data type is necessary to apply the correct privacy framework and compliance requirements.
2
Match the data elements to the correct compliance data classification.
Classified the data as Personally Identifiable Information (PII).
PII includes any information that can reasonably be used to distinguish or trace an individual's identity.
3
Select the mandatory security controls required for safeguarding PII.
Enforce strict access control lists (ACLs) and enable data encryption at rest.
Unencrypted PII in shared network folders creates significant legal liabilities and compliance violations under privacy regulations.

Key Concept

Personally Identifiable Information (PII) Identification and Protection
Rate this question

Topics

Data Privacy and Compliance Regulations

More questions from this topic