Examkin

Question

Difficulty: MediumData Governance, Classification, and Privacy Controls

A global telecommunications provider is updating its data governance framework and enterprise Data Loss Prevention (DLP) policy across cloud and on-premises environments. Match each data classification tier on the left with its corresponding mandatory technical and privacy handling control on the right.

  • Restricted (High Sensitivity / PII & Payment Data)Mandatory AES-256 encryption at rest, TLS 1.3 in transit, strict DLP blocking for external export, and Data Protection Impact Assessment (DPIA) enforcement.
  • Confidential / Proprietary (Medium-High Sensitivity / Source Code & IP)Encryption at rest and in transit, strict Role-Based Access Control (RBAC), repository digital watermarking, and non-disclosure agreement (NDA) validation.
  • Internal Use Only (Low-Medium Sensitivity / Operations & Directories)Authenticated enterprise single sign-on (SSO) access controls without mandatory external transfer blocking, monitored via standard audit logging.
  • Public (Low Sensitivity / Published Service Catalogs)Unrestricted read access without confidentiality protection requirements, monitored primarily for unauthorized integrity modifications.

Answer

Restricted matches mandatory AES-256/TLS 1.3 encryption, DLP blocking, and DPIA enforcement; Confidential/Proprietary matches encryption, strict RBAC, watermarking, and NDA validation; Internal Use Only matches enterprise SSO access controls and audit logging; Public matches unrestricted access focused on integrity monitoring.
Each data classification tier dictates specific technical, operational, and legal protection levels. Restricted data demands rigorous privacy and encryption controls due to regulatory obligations (e.g., GDPR, PCI DSS). Confidential data protects business-critical intellectual property using access governance and tracking. Internal data relies on authentication to prevent unauthorized public disclosure. Public data prioritizes availability and integrity over confidentiality.

Step-by-Step Solution

1
Evaluate the sensitivity tier of Restricted data (PII and financial records).
Identify controls targeted at regulatory compliance and maximum privacy impact.
Restricted data requires the highest level of technical controls (AES-256, TLS 1.3, DLP export prevention, and formal DPIAs).
2
Evaluate Intellectual Property and Source Code (Confidential/Proprietary).
Match with trade secret protection controls.
Confidential technical assets demand strict RBAC, encryption, digital watermarking, and legal non-disclosure safeguards.
3
Differentiate Internal Use Only data from Public data.
Internal data requires SSO identity verification, whereas Public data focuses purely on integrity monitoring.
Public data requires no confidentiality protection, while internal operations data must be restricted to authenticated employees.

Key Concept

Data Classification Tiers and Handling Controls
Estimated Time:2m 0s
Rate this question

Topics

Data Governance, Classification, and Privacy Controls

More questions from this topic