Topic 12 Practice Test 1 covers Data Protection Strategies for CompTIA Security+ SY0-701 and maps to objective 3.3: Compare and contrast concepts and strategies to protect data. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
Which term describes data actively being processed in memory or by an application?
- Data in use
- Restricted classification
- Data at rest
- Intellectual property
Correct Answer: A
Correct Answer
Answer A is correct because Data in use means data actively being processed in memory or by an application. That is the function the question is testing. Restricted classification would instead be used for a highly controlled classification for information whose exposure could cause severe harm or violate obligations.
Incorrect Answers
Answer B is incorrect because Restricted classification refers to a highly controlled classification for information whose exposure could cause severe harm or violate obligations. The scenario instead requires data actively being processed in memory or by an application, which is why Data in use is the better answer; this option serves the different function defined above.
Answer C is incorrect because Data at rest refers to data stored on media such as disks, databases, backups, or removable storage. The concept is valid, but it does not match this stem. The required function is data actively being processed in memory or by an application, which maps to Data in use.
Answer D is incorrect because Intellectual property refers to creations or proprietary information protected by legal or business rights. The question is not asking for this function. It is testing data actively being processed in memory or by an application, so Data in use is the stronger fit.
Question 2
Which term describes use of one-way digests to validate that data has not been modified?
- Data at rest
- Data masking
- Intellectual property
- Data hashing
Correct Answer: D
Correct Answer
Answer D is correct because Data hashing means use of one-way digests to validate that data has not been modified. That is the function the question is testing. Data at rest would instead be used for data stored on media such as disks, databases, backups, or removable storage.
Incorrect Answers
Answer A is incorrect because Data at rest refers to data stored on media such as disks, databases, backups, or removable storage. This could be appropriate elsewhere, but the required function is use of one-way digests to validate that data has not been modified; that makes Data hashing the precise choice.
Answer B is incorrect because Data masking refers to obscuring portions of sensitive data while preserving a usable representation. The question is not asking for this function. It is testing use of one-way digests to validate that data has not been modified, so Data hashing is the stronger fit.
Answer C is incorrect because Intellectual property refers to creations or proprietary information protected by legal or business rights. The key mismatch is functional: Data hashing addresses use of one-way digests to validate that data has not been modified, the need stated by the question.
Question 3
To protect confidentiality of stored or transmitted information, which security approach should be selected?
- Sensitive classification
- Data in use
- Data encryption
- Intellectual property
Correct Answer: C
Correct Answer
Answer C is correct because Data encryption means use of cryptography to make information unreadable without authorized key material. The deciding point is functional fit: this option covers the stated need, while Sensitive classification addresses a label indicating information requires protection because unauthorized disclosure or modification could cause harm.
Incorrect Answers
Answer A is incorrect because Sensitive classification refers to a label indicating information requires protection because unauthorized disclosure or modification could cause harm. The scenario instead requires use of cryptography to make information unreadable without authorized key material, which is why Data encryption is the better answer; this option serves the different function defined above.
Answer B is incorrect because Data in use refers to data actively being processed in memory or by an application. The question is not asking for this function. It is testing use of cryptography to make information unreadable without authorized key material, so Data encryption is the stronger fit.
Answer D is incorrect because Intellectual property refers to creations or proprietary information protected by legal or business rights. This could be appropriate elsewhere, but the required function is use of cryptography to make information unreadable without authorized key material; that makes Data encryption the precise choice.
Question 4
To protect high-value information that can enable fraud or privacy harm, which security approach should be selected?
- Permission restriction
- Restricted classification
- Data tokenization
- Financial information
Correct Answer: D
Correct Answer
Answer D is correct because Financial information means data relating to payments, accounts, transactions, or financial status. This is the precise fit for the scenario. Restricted classification serves the different purpose of a highly controlled classification for information whose exposure could cause severe harm or violate obligations.
Incorrect Answers
Answer A is incorrect because Permission restriction refers to limiting data access according to identity, role, need, and least privilege. The scenario instead requires data relating to payments, accounts, transactions, or financial status, which is why Financial information is the better answer; this option serves the different function defined above.
Answer B is incorrect because Restricted classification refers to a highly controlled classification for information whose exposure could cause severe harm or violate obligations. That concept can be valid in another scenario, but this question is testing data relating to payments, accounts, transactions, or financial status; Financial information therefore fits the requirement more directly.
Answer C is incorrect because Data tokenization refers to substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. The concept is valid, but it does not match this stem. The required function is data relating to payments, accounts, transactions, or financial status, which maps to Financial information.
Question 5
What is a highly controlled classification for information whose exposure could cause severe harm or violate obligations?
- Financial information
- Data tokenization
- Data sovereignty
- Restricted classification
Correct Answer: D
Correct Answer
Answer D is correct because Restricted classification means a highly controlled classification for information whose exposure could cause severe harm or violate obligations. The deciding point is functional fit: this option covers the stated need, while Data sovereignty addresses the principle that data is subject to laws and governance requirements based on jurisdiction.
Incorrect Answers
Answer A is incorrect because Financial information refers to data relating to payments, accounts, transactions, or financial status. That concept can be valid in another scenario, but this question is testing a highly controlled classification for information whose exposure could cause severe harm or violate obligations; Restricted classification therefore fits the requirement more directly.
Answer B is incorrect because Data tokenization refers to substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. The question is not asking for this function. It is testing a highly controlled classification for information whose exposure could cause severe harm or violate obligations, so Restricted classification is the stronger fit.
Answer C is incorrect because Data sovereignty refers to the principle that data is subject to laws and governance requirements based on jurisdiction. The concept is valid, but it does not match this stem. The required function is a highly controlled classification for information whose exposure could cause severe harm or violate obligations, which maps to Restricted classification.
Question 6
Two requirements remain open in a data-protection design review: information subject to legal or regulatory handling requirements; obscuring portions of sensitive data while preserving a usable representation. Which TWO options close those specific gaps? Choose TWO.
- Sensitive classification
- Data masking
- Restricted classification
- Data in use
- Regulated data
Correct Answers: B, E
Correct Answers
Answer B is correct because Data masking means obscuring portions of sensitive data while preserving a usable representation. This selection maps directly to one of the named needs. Data in use addresses data actively being processed in memory or by an application, so it does not satisfy the same slot.
Answer E is correct because Regulated data means information subject to legal or regulatory handling requirements. It belongs in the fixed-count answer set because it covers one of the stated requirements. Data in use instead serves data actively being processed in memory or by an application and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Sensitive classification means a label indicating information requires protection because unauthorized disclosure or modification could cause harm. The required choices are Data masking, Regulated data. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer C is incorrect because Restricted classification means a highly controlled classification for information whose exposure could cause severe harm or violate obligations. The scenario calls for Data masking, Regulated data. Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because Data in use means data actively being processed in memory or by an application. The required choices are Data masking, Regulated data. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 7
Which term describes substitution of sensitive values with non-sensitive tokens linked through a protected mapping system?
- Data encryption
- Data tokenization
- Regulated data
- Public classification
Correct Answer: B
Correct Answer
Answer B is correct because Data tokenization means substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. The deciding point is functional fit: this option covers the stated need, while Public classification addresses a classification for information approved for unrestricted external disclosure.
Incorrect Answers
Answer A is incorrect because Data encryption refers to use of cryptography to make information unreadable without authorized key material. The scenario instead requires substitution of sensitive values with non-sensitive tokens linked through a protected mapping system, which is why Data tokenization is the better answer; this option serves the different function defined above.
Answer C is incorrect because Regulated data refers to information subject to legal or regulatory handling requirements. This could be appropriate elsewhere, but the required function is substitution of sensitive values with non-sensitive tokens linked through a protected mapping system; that makes Data tokenization the precise choice.
Answer D is incorrect because Public classification refers to a classification for information approved for unrestricted external disclosure. This could be appropriate elsewhere, but the required function is substitution of sensitive values with non-sensitive tokens linked through a protected mapping system; that makes Data tokenization the precise choice.
Question 8
To ensure only approved users and services can read or modify protected information, which security approach should be selected?
- Data tokenization
- Data masking
- Permission restriction
- Data in transit
Correct Answer: C
Correct Answer
Answer C is correct because Permission restriction means limiting data access according to identity, role, need, and least privilege. The requirement maps directly to this function, whereas Data masking is aimed at obscuring portions of sensitive data while preserving a usable representation.
Incorrect Answers
Answer A is incorrect because Data tokenization refers to substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. This could be appropriate elsewhere, but the required function is limiting data access according to identity, role, need, and least privilege; that makes Permission restriction the precise choice.
Answer B is incorrect because Data masking refers to obscuring portions of sensitive data while preserving a usable representation. This could be appropriate elsewhere, but the required function is limiting data access according to identity, role, need, and least privilege; that makes Permission restriction the precise choice.
Answer D is incorrect because Data in transit refers to data moving across a network or communication channel. The scenario instead requires limiting data access according to identity, role, need, and least privilege, which is why Permission restriction is the better answer; this option serves the different function defined above.
Question 9
A review during a data-protection design review identifies two gaps. One requires classification for information approved for unrestricted external disclosure. The other requires data moving across a network or communication channel. Which TWO options should be included in the remediation plan? Choose TWO.
- Public classification
- Intellectual property
- Data in transit
- Data hashing
- Sensitive classification
Correct Answers: A, C
Correct Answers
Answer A is correct because Public classification means a classification for information approved for unrestricted external disclosure. It belongs in the fixed-count answer set because it covers one of the stated requirements. Sensitive classification instead serves a label indicating information requires protection because unauthorized disclosure or modification could cause harm and cannot replace this function.
Answer C is correct because Data in transit means data moving across a network or communication channel. One required function is exactly what this option provides. Sensitive classification may be useful elsewhere, but it is used for a label indicating information requires protection because unauthorized disclosure or modification could cause harm.
Incorrect Answers
Answer B is incorrect because Intellectual property means creations or proprietary information protected by legal or business rights. The scenario calls for Data in transit, Public classification. Selecting this option would leave one of those required functions uncovered. For example, Public classification is required for a classification for information approved for unrestricted external disclosure.
Answer D is incorrect because Data hashing means use of one-way digests to validate that data has not been modified. The required choices are Data in transit, Public classification. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Sensitive classification means a label indicating information requires protection because unauthorized disclosure or modification could cause harm. Every answer slot must map to a stated requirement. The correct set is Data in transit, Public classification, so this option cannot replace one of those selections.
Question 10
To limit access and distribution to approved recipients, which security approach should be selected?
- Confidential classification
- Intellectual property
- Trade secret
- Data at rest
Correct Answer: A
Correct Answer
Answer A is correct because Confidential classification means a restrictive classification for information intended only for specifically authorized users or groups. This matches the requirement as written. Intellectual property can be valid in another context, but it is used for creations or proprietary information protected by legal or business rights.
Incorrect Answers
Answer B is incorrect because Intellectual property refers to creations or proprietary information protected by legal or business rights. The question is not asking for this function. It is testing a restrictive classification for information intended only for specifically authorized users or groups, so Confidential classification is the stronger fit.
Answer C is incorrect because Trade secret refers to confidential business information that derives value from not being generally known. The concept is valid, but it does not match this stem. The required function is a restrictive classification for information intended only for specifically authorized users or groups, which maps to Confidential classification.
Answer D is incorrect because Data at rest refers to data stored on media such as disks, databases, backups, or removable storage. That concept can be valid in another scenario, but this question is testing a restrictive classification for information intended only for specifically authorized users or groups; Confidential classification therefore fits the requirement more directly.
Question 11
To protect proprietary methods, formulas, designs, or business knowledge, which security approach should be selected?
- Permission restriction
- Trade secret
- Data sovereignty
- Public classification
Correct Answer: B
Correct Answer
Answer B is correct because Trade secret means confidential business information that derives value from not being generally known. That is the function the question is testing. Data sovereignty would instead be used for the principle that data is subject to laws and governance requirements based on jurisdiction.
Incorrect Answers
Answer A is incorrect because Permission restriction refers to limiting data access according to identity, role, need, and least privilege. The question is not asking for this function. It is testing confidential business information that derives value from not being generally known, so Trade secret is the stronger fit.
Answer C is incorrect because Data sovereignty refers to the principle that data is subject to laws and governance requirements based on jurisdiction. The key mismatch is functional: Trade secret addresses confidential business information that derives value from not being generally known, the need stated by the question.
Answer D is incorrect because Public classification refers to a classification for information approved for unrestricted external disclosure. The question is not asking for this function. It is testing confidential business information that derives value from not being generally known, so Trade secret is the stronger fit.
Question 12
Two requirements remain open in a data-protection design review: information subject to legal or regulatory handling requirements; label indicating information requires protection because unauthorized disclosure or modification could cause harm. Which TWO options close those specific gaps? Choose TWO.
- Public classification
- Sensitive classification
- Regulated data
- Data tokenization
- Data encryption
Correct Answers: B, C
Correct Answers
Answer B is correct because Sensitive classification means a label indicating information requires protection because unauthorized disclosure or modification could cause harm. One required function is exactly what this option provides. Data encryption may be useful elsewhere, but it is used for use of cryptography to make information unreadable without authorized key material.
Answer C is correct because Regulated data means information subject to legal or regulatory handling requirements. One required function is exactly what this option provides. Data encryption may be useful elsewhere, but it is used for use of cryptography to make information unreadable without authorized key material.
Incorrect Answers
Answer A is incorrect because Public classification means a classification for information approved for unrestricted external disclosure. The scenario calls for Sensitive classification, Regulated data. Selecting this option would leave one of those required functions uncovered. For example, Regulated data is required for information subject to legal or regulatory handling requirements.
Answer D is incorrect because Data tokenization means substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. Every answer slot must map to a stated requirement. The correct set is Sensitive classification, Regulated data, so this option cannot replace one of those selections.
Answer E is incorrect because Data encryption means use of cryptography to make information unreadable without authorized key material. The question requires exactly 2 selections: Sensitive classification, Regulated data. This option falls outside that required set. For example, Regulated data is required for information subject to legal or regulatory handling requirements.
Question 13
An architect working on a data-protection design review needs one capability that provides use of cryptography to make information unreadable without authorized key material and another that provides use of one-way digests to validate that data has not been modified. Which TWO selections are the best match? Choose TWO.
- Regulated data
- Data in transit
- Data encryption
- Data hashing
- Public classification
Correct Answers: C, D
Correct Answers
Answer C is correct because Data encryption means use of cryptography to make information unreadable without authorized key material. The fixed-count item needs this function in the answer set. Regulated data covers information subject to legal or regulatory handling requirements, a different requirement.
Answer D is correct because Data hashing means use of one-way digests to validate that data has not been modified. The fixed-count item needs this function in the answer set. Regulated data covers information subject to legal or regulatory handling requirements, a different requirement.
Incorrect Answers
Answer A is incorrect because Regulated data means information subject to legal or regulatory handling requirements. Every answer slot must map to a stated requirement. The correct set is Data encryption, Data hashing, so this option cannot replace one of those selections.
Answer B is incorrect because Data in transit means data moving across a network or communication channel. The required choices are Data encryption, Data hashing. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Public classification means a classification for information approved for unrestricted external disclosure. The question requires exactly 2 selections: Data encryption, Data hashing. This option falls outside that required set. For example, Data encryption is required for use of cryptography to make information unreadable without authorized key material.
Question 14
To apply stronger handling controls than those used for public information, which security approach should be selected?
- Permission restriction
- Sensitive classification
- Geolocation restriction
- Trade secret
Correct Answer: B
Correct Answer
Answer B is correct because Sensitive classification means a label indicating information requires protection because unauthorized disclosure or modification could cause harm. The deciding point is functional fit: this option covers the stated need, while Trade secret addresses confidential business information that derives value from not being generally known.
Incorrect Answers
Answer A is incorrect because Permission restriction refers to limiting data access according to identity, role, need, and least privilege. That concept can be valid in another scenario, but this question is testing a label indicating information requires protection because unauthorized disclosure or modification could cause harm; Sensitive classification therefore fits the requirement more directly.
Answer C is incorrect because Geolocation restriction refers to a control that limits storage, access, or processing according to geographic location. The concept is valid, but it does not match this stem. The required function is a label indicating information requires protection because unauthorized disclosure or modification could cause harm, which maps to Sensitive classification.
Answer D is incorrect because Trade secret refers to confidential business information that derives value from not being generally known. This could be appropriate elsewhere, but the required function is a label indicating information requires protection because unauthorized disclosure or modification could cause harm; that makes Sensitive classification the precise choice.
Question 15
Which term describes confidential business information that derives value from not being generally known?
- Trade secret
- Geolocation restriction
- Data tokenization
- Intellectual property
Correct Answer: A
Correct Answer
Answer A is correct because Trade secret means confidential business information that derives value from not being generally known. The requirement maps directly to this function, whereas Intellectual property is aimed at creations or proprietary information protected by legal or business rights.
Incorrect Answers
Answer B is incorrect because Geolocation restriction refers to a control that limits storage, access, or processing according to geographic location. This could be appropriate elsewhere, but the required function is confidential business information that derives value from not being generally known; that makes Trade secret the precise choice.
Answer C is incorrect because Data tokenization refers to substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. The key mismatch is functional: Trade secret addresses confidential business information that derives value from not being generally known, the need stated by the question.
Answer D is incorrect because Intellectual property refers to creations or proprietary information protected by legal or business rights. The question is not asking for this function. It is testing confidential business information that derives value from not being generally known, so Trade secret is the stronger fit.
Question 16
A security plan created during a data-protection design review must provide obscuring portions of sensitive data while preserving a usable representation, substitution of sensitive values with non-sensitive tokens linked through a protected mapping system, and limiting data access according to identity, role, need, and least privilege. Which THREE options should be selected? Choose THREE.
- Permission restriction
- Data in transit
- Data tokenization
- Data in use
- Data masking
- Geolocation restriction
Correct Answers: A, C, E
Correct Answers
Answer A is correct because Permission restriction means limiting data access according to identity, role, need, and least privilege. This selection maps directly to one of the named needs. Geolocation restriction addresses a control that limits storage, access, or processing according to geographic location, so it does not satisfy the same slot.
Answer C is correct because Data tokenization means substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. This option satisfies a specific requirement in the stem; Data in use serves data actively being processed in memory or by an application and therefore is not interchangeable with it.
Answer E is correct because Data masking means obscuring portions of sensitive data while preserving a usable representation. One required function is exactly what this option provides. Geolocation restriction may be useful elsewhere, but it is used for a control that limits storage, access, or processing according to geographic location.
Incorrect Answers
Answer B is incorrect because Data in transit means data moving across a network or communication channel. The required choices are Data tokenization, Data masking, Permission restriction. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Data in use means data actively being processed in memory or by an application. The required choices are Data tokenization, Data masking, Permission restriction. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer F is incorrect because Geolocation restriction means a control that limits storage, access, or processing according to geographic location. The fixed-count answer set is Data tokenization, Data masking, Permission restriction; this option does not fill one of those named functions.
Question 17
Which term describes creations or proprietary information protected by legal or business rights?
- Trade secret
- Data encryption
- Intellectual property
- Geolocation restriction
Correct Answer: C
Correct Answer
Answer C is correct because Intellectual property means creations or proprietary information protected by legal or business rights. The requirement maps directly to this function, whereas Geolocation restriction is aimed at a control that limits storage, access, or processing according to geographic location.
Incorrect Answers
Answer A is incorrect because Trade secret refers to confidential business information that derives value from not being generally known. The concept is valid, but it does not match this stem. The required function is creations or proprietary information protected by legal or business rights, which maps to Intellectual property.
Answer B is incorrect because Data encryption refers to use of cryptography to make information unreadable without authorized key material. The concept is valid, but it does not match this stem. The required function is creations or proprietary information protected by legal or business rights, which maps to Intellectual property.
Answer D is incorrect because Geolocation restriction refers to a control that limits storage, access, or processing according to geographic location. This could be appropriate elsewhere, but the required function is creations or proprietary information protected by legal or business rights; that makes Intellectual property the precise choice.
Question 18
Which term describes data relating to payments, accounts, transactions, or financial status?
- Data in use
- Data tokenization
- Financial information
- Permission restriction
Correct Answer: C
Correct Answer
Answer C is correct because Financial information means data relating to payments, accounts, transactions, or financial status. That makes it the best answer here; Data tokenization addresses substitution of sensitive values with non-sensitive tokens linked through a protected mapping system, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Data in use refers to data actively being processed in memory or by an application. This could be appropriate elsewhere, but the required function is data relating to payments, accounts, transactions, or financial status; that makes Financial information the precise choice.
Answer B is incorrect because Data tokenization refers to substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. The scenario instead requires data relating to payments, accounts, transactions, or financial status, which is why Financial information is the better answer; this option serves the different function defined above.
Answer D is incorrect because Permission restriction refers to limiting data access according to identity, role, need, and least privilege. That concept can be valid in another scenario, but this question is testing data relating to payments, accounts, transactions, or financial status; Financial information therefore fits the requirement more directly.
Question 19
To protect communications with encrypted and authenticated protocols, which security approach should be selected?
- Geolocation restriction
- Data in transit
- Data encryption
- Trade secret
Correct Answer: B
Correct Answer
Answer B is correct because Data in transit means data moving across a network or communication channel. That makes it the best answer here; Geolocation restriction addresses a control that limits storage, access, or processing according to geographic location, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Geolocation restriction refers to a control that limits storage, access, or processing according to geographic location. The key mismatch is functional: Data in transit addresses data moving across a network or communication channel, the need stated by the question.
Answer C is incorrect because Data encryption refers to use of cryptography to make information unreadable without authorized key material. The concept is valid, but it does not match this stem. The required function is data moving across a network or communication channel, which maps to Data in transit.
Answer D is incorrect because Trade secret refers to confidential business information that derives value from not being generally known. The scenario instead requires data moving across a network or communication channel, which is why Data in transit is the better answer; this option serves the different function defined above.
Question 20
An architect working on a data-protection design review needs one capability that provides data relating to payments, accounts, transactions, or financial status and another that provides classification for information approved for unrestricted external disclosure. Which TWO selections are the best match? Choose TWO.
- Public classification
- Financial information
- Data masking
- Restricted classification
- Data tokenization
Correct Answers: A, B
Correct Answers
Answer A is correct because Public classification means a classification for information approved for unrestricted external disclosure. It belongs in the fixed-count answer set because it covers one of the stated requirements. Data masking instead serves obscuring portions of sensitive data while preserving a usable representation and cannot replace this function.
Answer B is correct because Financial information means data relating to payments, accounts, transactions, or financial status. The fixed-count item needs this function in the answer set. Data tokenization covers substitution of sensitive values with non-sensitive tokens linked through a protected mapping system, a different requirement.
Incorrect Answers
Answer C is incorrect because Data masking means obscuring portions of sensitive data while preserving a usable representation. Every answer slot must map to a stated requirement. The correct set is Financial information, Public classification, so this option cannot replace one of those selections.
Answer D is incorrect because Restricted classification means a highly controlled classification for information whose exposure could cause severe harm or violate obligations. The fixed-count answer set is Financial information, Public classification; this option does not fill one of those named functions.
Answer E is incorrect because Data tokenization means substitution of sensitive values with non-sensitive tokens linked through a protected mapping system. The fixed-count answer set is Financial information, Public classification; this option does not fill one of those named functions.
