Data Types and Classifications

Question 1 of 6

A hospital's database contains patient names, diagnoses, treatment records, and payment records for healthcare services. A security analyst exports this data to a CSV file for analysis. Which data classifications apply to this CSV file? (Select the BEST answer.)

A. Public / Unclassified — the CSV format makes it machine-readable and not immediately sensitive B. PHI and PII — health information linked to identifiable individuals; payment records for healthcare services are also PHI under HIPAA C. Trade secret — the hospital's patient data is proprietary and gives it competitive advantage D. Financial information only — the payment records make this a financial data issue, not a health data issue

Question 2 of 6

An organization's authentication server — used by all employees to log in — experiences a hardware failure, causing 4 hours of downtime. Employees cannot access any internal systems during this period. Which data classification level is MOST relevant to the authentication database, and why?

A. Confidential — because authentication credentials must be kept strictly private B. Sensitive — because employee account data is PII and must be protected from disclosure C. Critical — because the primary concern is availability; unavailability immediately disrupts all operations D. Public / Unclassified — authentication systems are part of the public-facing infrastructure

Question 3 of 6

A technology company has developed a proprietary algorithm for its AI product. The company has decided NOT to file a patent because doing so would require public disclosure of the algorithm's implementation. Instead, the company keeps the implementation details strictly confidential. How should this algorithm be classified?

A. Trade secret — its entire value comes from remaining unknown; secrecy is the protection mechanism, not legal registration B. Intellectual property only — all algorithms are automatically protected by copyright law C. Public / Unclassified — since the algorithm is not legally registered, it has no formal protection D. Regulated data — software algorithms are governed by export control regulations

Question 4 of 6

A security analyst is reviewing a JSON file intercepted on the network. The file contains: user_id, email, date_of_birth, and zip_code fields for 50,000 customers. The analyst notes that the individual fields appear benign. Which data security concept explains why this JSON file still requires strong protection?

A. Non-human-readable format — JSON requires specialized tools to read, reducing risk B. The aggregation problem — combining email + DOB + ZIP code creates PII that can identify individuals even if each field alone is not sensitive C. Trade secret protection — customer email addresses are proprietary data owned by the organization D. Critical classification — JSON files storing customer data are always critical due to their size

Question 5 of 6

An executive at a publicly traded company emails a document containing preliminary merger acquisition plans to a colleague. The document is marked "For Internal Use Only." A security auditor flags this as a classification concern. Which classification level is MOST appropriate for pre-announcement merger plans?

A. Public / Unclassified — the company is publicly traded, so financial information is public B. Sensitive — the standard internal-use classification is sufficient for financial planning documents C. Critical — merger data must always be available to the executive team D. Confidential / Restricted — pre-announcement merger plans are highly sensitive, require explicit authorization to access, and premature disclosure could violate securities law

Question 6 of 6

Which of the following is the BEST example of data that is classified as both PHI and regulated data?

A. An employee's home address stored in the HR system B. A patient's name, diagnosis, and insurance payment records stored in a hospital's billing system C. A company's proprietary manufacturing process documented internally D. A government court case record accessible to the public via the court's website

Matching

1. Company marketing brochures, public website content, and published press releases — freely distributable with no viewing restrictions; integrity controls still apply to prevent unauthorized modification

2. The real-time transaction database that processes every customer payment — if unavailable for even 60 seconds, all transactions fail; availability is the primary security driver

3. Pre-announcement merger acquisition documents — accessible only to the executive team and legal counsel; requires explicit individual authorization; premature disclosure could violate securities law

4. Government intelligence reports requiring formal security clearance; unauthorized disclosure carries criminal penalties; access limited by formal legal vetting process; non-disclosure agreements required

1. 2. 3. 4.

A. Public / Unclassified

B. Critical

C. Confidential

D. Private / Classified / Restricted

Data Types and Classifications Quiz

Matching