5 Data Protection Architecture Free Online FlashCards

What does a data classification label communicate?

Data classification labels indicate information sensitivity and the safeguards and handling requirements it needs.

What should an organization assess when classifying data?

Assess potential harm to confidentiality, integrity, and availability to determine appropriate protection.

Which impact levels does NIST FIPS 199 use?

NIST FIPS 199 uses low, moderate, and high impact levels for confidentiality, integrity, and availability.

Where should data classification labels be applied?

Apply labels consistently to databases, files, exports, backups, logs, and cloud storage so controls cover every copy.

How does data minimization reduce protection burdens?

Collect and copy only the information needed for the task; reducing data reduces the amount that must be protected.

Which data states should an encryption architecture protect?

Protect data in transit, at rest, and, where feasible, during processing using methods suited to the workload and threat model.

Does encryption alone prevent unauthorized data exposure?

No. Encryption does not replace authentication, authorization, secure configuration, or monitoring; an authorized or compromised application may access decrypted data.

How should access to encryption keys be controlled?

Restrict key use to authorized identities and workloads, and audit key operations.

What does key rotation fail to guarantee by itself?

Rotation limits continued use of a key, but does not erase plaintext copies or make old ciphertext inaccessible if old keys remain recoverable.

What details should a retention rule define?

Specify the data covered, retention start point, period, responsible owner, and disposal method.

How can a legal hold affect ordinary data deletion?

A legal hold or other preservation duty may suspend ordinary deletion until the hold is released.

Which data locations must retention and deletion controls cover?

Deletion must account for replicas, exports, caches, logs, snapshots, archives, and backups—not only the primary database.