Security+
CompTIA Security+ SY0-801 / All lessons / Domain 3.0: Security Architecture
3Domain 3.0: Security Architecture
Security+ topic 3.3

Data Protection

Data needs protection in all three states: at rest (stored on a disk), in transit (moving over a network), and in use (being processed in memory). Organizations classify data, such as public, confidential, or restricted, so they know how carefully to handle it. Data types include regulated data, trade secrets, and intellectual property, and data sovereignty laws can require data to stay in a certain country. Protection methods include encryption, hashing, masking, tokenization, permission restrictions, and segmentation. Data loss prevention (DLP) watches for sensitive data leaving where it should not.

Data Protection vocabulary

  • Data at rest: Data stored on a drive, database, or backup.
  • Data in transit: Data moving across a network.
  • Data sovereignty: The rule that data is subject to the laws of the country where it is stored.
  • Data loss prevention (DLP): Tools that detect and block sensitive data from leaving the organization.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. A laptop with an encrypted drive is stolen from a car. Which data state was the encryption protecting?

  1. (A) Data in use
  2. (B) Data at rest
  3. (C) Data in transit
  4. (D) Data in motion
Show answer

(B) Data at rest Data stored on a drive is data at rest.

2. A European company is told it must keep its customers' personal data on servers inside the EU. Which of the following concepts is this?

  1. (A) Data sovereignty
  2. (B) Data masking
  3. (C) Data in use
  4. (D) Tokenization
Show answer

(A) Data sovereignty Data being subject to the laws of a location is data sovereignty.

3. A call center screen shows only the last four digits of a customer's card number. Which of the following methods is this?

  1. (A) Hashing
  2. (B) Data masking
  3. (C) Encryption in transit
  4. (D) Steganography
Show answer

(B) Data masking Showing only part of a value is data masking.

4. A tool blocks an employee from emailing a spreadsheet of Social Security numbers outside the company. Which of the following is this tool?

  1. (A) DLP
  2. (B) SIEM
  3. (C) NAC
  4. (D) WAF
Show answer

(A) DLP Data loss prevention detects and blocks sensitive data from leaving.

Open 3.3 in the interactive course