Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CCSP > Data Classification > Flashcards

Data Classification Flashcards

1
Q

What is the most important step in properly handling and controling data?

A

Assigning responsibilities according to who has possession and legal ownership of it, which are usually associated with named roles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What role collects and creates the data?

A

Data owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who is usually the data owner?

A

Cloud customer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Many international treaties/frameworks refer to the data owner as…

A

The data controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who is the person/entity tasked with daily maintenance and administration of the data?

A

Data custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The _____ applies the proper security controls and processes as directed by the data owner.

A

data custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who might be the data custodian?

A

Database administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who is tasked with ensuring the data’s context and meaning are understood and data is used properly?

A

Data stewards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Who manipulates, stores, or moves data on behalf of the data owner?

A

Data processor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Copying, printing, destroying, and utilizing data is called…

A

Processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

From an international perspective, who is the data processor?

A

The Cloud Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

T/F Data processors can be third parties

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

______ remain legally responsible for all data they own.

A

Data owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

T/F System owners are always data owners.

A

False - not necessarily

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  • Regulatory compliance
  • Business function
  • Functional unit
  • Project
    All drive _____
A

Data categorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who is in the best position to categorize the data?

A

Data owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Who is responsible for data classification?

A

Data owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data classification types:

A
  • Sensitivity
  • Jurisdiction
  • Criticality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data classification is often based on…

A

Organizational policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is it called when data shared between orgs must be normalized and translated so that it’s meaningful to both parties?

A

Data mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data classifications and labels are carried through mapping to ensure…

A

That data used in another context does not lose its security controls and oversight.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q
  • Date of creation
  • Date of scheduled destruction/disposal
  • Confidentiality level
  • Handling directions
  • Dissemination/distribution instructions
  • Access limitations
  • Source
  • Jurisdiction
  • Applicable regulation
A

Information a label includes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Why are labels often used as part of data management tools?

A

For lifecycle and security controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a key technology component and capability in the data lifecycle?

A

Automated labeling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What helps an org track where their data is flowing, what ports/protocols are in use, how data is secured, and what controls are in place?
Data flow diagrams
26
What is it called when an org is creating an initial data inventory, doing electronic discovery, or using data mining tools to discover trends in data already in the inventory?
Data discovery
27
What is a listing of traits and characteristics about specific data elements or sets?
Metadata
28
Sorted data by meaningful attributes.
Structured data
29
Relational databases are a type of _______?
Structured data
30
Unsorted data, like email content, is considered ______?
Unstructured data
31
T/F It's easier to perform data discovery on unstructured data.
False - easier on structured data b/c it's already arranged.
32
________ uses tags or other elements to create fields and records w/in data w/out requiring rigid structure.
Semi-structured data
33
What are some examples of semi-structured data?
XML and JSON
34
What two things are key to designing and security data discovery and usage models?
Understanding how data will be used and analyzed.
35
Data mining, real-time, and business intelligence.
3 types of data analytics methods
36
The actions that authorized users can take and how those rights are set, applied, modified, and removed.
Data rights
37
What rights are critical to ensuring that use of IRM does not disrupt the business while still being effective?
Provisioning
38
What describes what can/cannot be done with data and who can/cannot perform certain actions?
Access Models
39
_____ describe the rights a user has to content and _____ are used to validate the identify of the user/computer.
Licenses and certificates
40
- Rudimentary reference checks - Online reference checks - Local agent checks - Support-based licensing
4 ways IRM can be applied
41
- Replication restrictions - Jurisdictional conflicts - Agent/enterprise conflicts - Mapping identity and access management (IAM and IRM) - API conflicts
Challenges faced by employing IRM in the cloud
42
- Persistent protection - Dynamic policy control - Automatic expiration - Continuous auditing - Replication restrictions - Remote rights revocation
Things IRM should provide, regardless of content/format
43
What is an ACL?
Access control list
44
Retention periods are often expressed in days for _____ and years for _____.
Ephemeral data (logs) and business data
45
- Retention periods - Regulation and compliance - Data classification - Retention - Data deletion - Archiving and retrieval - Monitoring, maintenance, and performance
Things data retention policies should address.
46
Who will delete the data, requirements for deletion, procedure documentation to show how secure deletion occurs/is validated, and compliance/legal requirements.
Things policies for data deletion should specify
47
_____ involves identification/collection/production of data related to a case, and _____ ensure data required for a case is collected and preserved.
E-discovery and legal holds
48
A legal hold occurs when an organization is notified that:
1. A law enforcement/regulatory entity is commencing and investigation 2. A private entity is commencing litigation against the org
49
What rule dictates that a legal hold notice has primacy, even over federal laws like HIPPA?
Federal Rules of Evidence
50
What can be used to regularly review, inventory, and inspect the usage and condition of owned data?
Data audit
51
Audit periods/scope/responsibilities, processes/procedures, regulations, and monitoring/maintenance/enforcement are things to consider when conducting _____.
Data audits
52
1. It's not often a priority. 2. It's mundane/repetitive. 3. Reviewer needs to understand the operation. 4. It's expensive.
Challenges in reading and analyzing logs
53
What are the 3 areas to consider for audit mechanism planning and implementation in cloud environments?
1. Log collection 2. Log correlation 3. Packet capture
54
You can only perform packet capture in what environment?
IaaS
55
1. Physical destruction 2. Degaussing 3. Overwriting 4. Crypto-Shredding
on-premise data destruction options
56
What is the only data destruction option in the cloud?
Crypto-shredding
57
1. Process for disposal 2. Applicable regulations 3. Clear direction on when data should be destroyed
3 things a data disposal policy should include
58
Encrypting data with a strong encryption engine, then encrypting those keys with a different encryption engine, and then destroying those keys is called?
Crypto-shredding
59
What allows data to be destroyed while leaving media intact by using multiple passes of random characters written to location where data resides?
Overwriting
60
Applying strong magnetic fields to hardware and media where data resides is called?
Degaussing
61
T/F Degaussing does not work with solid-state drives like SSD, flash media, and thumb drives.
True
62
Burning, melting, impact, industrial shredding data is called?
Physical destruction of media and hardware
63
T/F Hardware/media can always be sanitized by simply deleting the data?
False - deleting doesn't erase data, it just removes the logical pointers to the data
64
In SaaS and PaaS environments, data destruction can only be approached through:
Contractual requirements
65
What is data left over after sanitization and disposal methods have been attempted?
Data remanence

CCSP (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions