Lesson 16

Which label in a typical confidentiality-based classification scheme is reserved for data whose disclosure poses minimal risk to an organization?

• Confidential

• Public (unclassified)

• Restricted

• Critical

Under the GDPR, the entity that decides why and how personal data are processed is called the:

• Data subject

• Data processor

• Data controller

• Supervisory authority

Which of the following is an example of regulated data in the United States financial sector?

• Medical imaging files covered by HIPAA

• Credit-card numbers subject to PCI DSS

• Trade-secret manufacturing formula

• Employee social-media posts

Replacing a primary-account number in a payment system with a randomly generated reference value is an example of:

• Masking

• Hashing

• Tokenization

• Obfuscation

Data contained in CPU registers while a spreadsheet is open is considered to be:

• Data at rest

• Data in motion

• Data in use

• Data tokenized

Which access-control model limits permissions exclusively according to job function in order to enforce least privilege?

• Discretionary access control (DAC)

• Mandatory access control (MAC)

• Role-based access control (RBAC)

• Rule-based access control (RULeBAC)

The GDPR “right to be forgotten” is formally implemented through which data-subject right?

• Right of access

• Right to rectification

• Right to erasure

• Right to data portability

A company operating in the EU must transfer payroll records to a U.S. processor. Which concept requires the processor to offer equivalent privacy safeguards?

• Data sovereignty

• Trade-secret protection

• Segment routing

• Token-bucket policing

Which privacy role is typically fulfilled by a cloud-backup provider acting on instructions from a customer?

• A. Data controller

• B. Data steward

• C. Data processor

• D. Data subject

Which of the following personnel policies is specifically intended to prevent shoulder-surfing and unauthorized viewing of printed material?

• Clean desk policy

• Acceptable-use policy

• Insider-threat monitoring policy

• Separation-of-duties policy