CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A financial services company implements a policy requiring every dataset stored in its cloud environment to be labeled as Public, Internal, Confidential, or Restricted, with each label carrying specific handling and encryption requirements. A dataset containing customer Social Security numbers and account balances would most appropriately be labeled as which classification?
- AInternal
- BRestricted
- CPublic
- DConfidential
Show answer & explanationAnswer & explanation
Correct answer: B. Restricted
Restricted is typically the highest classification level, reserved for the most sensitive data such as Social Security numbers and financial account details, where unauthorized disclosure would cause severe harm; it requires the strictest access controls and encryption.
Why the other options are wrong
- A. Internal data is meant for general employee use but is not highly sensitive personal or financial data.
- C. Public data has no confidentiality requirements and can be freely shared, unlike SSNs and account data.
- D. Confidential data is sensitive but Restricted is reserved specifically for the most critical data like SSNs and financial records requiring maximum protection.
Data Classification
The process of categorizing data based on sensitivity level to determine appropriate handling, access, and encryption requirements.
- Common levels: Public, Internal, Confidential, Restricted
- Higher classification requires stricter access controls and encryption
- Helps organizations prioritize protection resources appropriately
Memory trick: PICR: Public is free, Internal is fine, Confidential is careful, Restricted is remote-locked