Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Cybersecurity FundamentalsMedium
A company is implementing a new data classification policy to ensure sensitive information receives appropriate protection. The policy defines several categories, including 'Public,' 'Internal,' 'Confidential,' and 'Restricted.' Data labeled 'Restricted' requires the highest level of security. Which of the following is an example of data that would typically be classified as 'Restricted' due to its potential severe impact if compromised?
- ACustomer credit card numbers and financial transaction records
- BCompany-wide meeting minutes without sensitive topics
- CPublicly available marketing brochures
- DEmployee contact lists for internal use
Show answer & explanationAnswer & explanation
Correct answer: A. Customer credit card numbers and financial transaction records
Customer credit card numbers and financial transaction records represent highly sensitive Personally Identifiable Information (PII) and financial data. Their compromise could lead to severe financial damage, identity theft, and regulatory penalties, thus warranting a 'Restricted' classification.
Why the other options are wrong
- B. General meeting minutes are usually 'Internal' or 'Confidential' but rarely 'Restricted' unless they discuss top-secret strategic plans.
- C. Public marketing brochures are designed for public distribution and have minimal impact if compromised.
- D. Employee contact lists are internal but typically not 'Restricted' unless they contain highly sensitive personal details beyond basic contact info.
Data Classification (Restricted)
A category of data classification for information that, if disclosed, altered, or destroyed, would cause severe damage to the organization, requiring the highest level of protection.
- Highest level of sensitivity and impact.
- Often includes PII, financial data, trade secrets, and national security information.
- Requires stringent access controls, encryption, and audit trails.
Memory trick: Restricted is like a 'top secret' vault, only for the most damaging data.