Which three guidelines are used to protect confidential information? (Choose three.)

Question

Options

• ALimit access to objects holding confidential information.
• BLimit exposure of confidential information.
• CManage confidential and other information uniformly.
• DTransparently handle information to improve diagnostics.
• ETreat user input as a trust-worthy source.
• FValidate input before storing confidential information.

• A
  76% (26)
• B
  9% (3)
• C
  3% (1)
• E
  12% (4)

Explanation

Note: The provided answer key (A, D, F) appears to contain an error. From a security standpoint, the correct three guidelines should be A, B, and F - and here's why:

A (Limit access) is correct because the principle of least privilege ensures only authorized parties can reach sensitive data, reducing attack surface. B (Limit exposure) is correct because minimizing how widely, how long, and in how many places confidential data appears directly reduces breach risk. F (Validate input before storing) is correct because unvalidated input can introduce injection attacks or malformed data that corrupt or leak confidential records.

Why the distractors are wrong:

• C is wrong - confidential data must be treated differently, with stricter controls, not uniformly alongside ordinary data.
• D is wrong - "transparently handle information to improve diagnostics" is a security anti-pattern; verbose diagnostic output (logs, error messages, stack traces) is a common channel for leaking confidential data.
• E is wrong - never trust user input; this is the foundational lesson behind injection vulnerabilities (SQL, XSS, etc.).

Memory tip: Think "LAV" - Limit access, Avoid exposure, Validate input. These three address who can see it, how much is seen, and what goes in.

If your exam source insists on A, D, F as the key, flag it to your instructor - D contradicts standard information security guidelines (OWASP, NIST, ISO 27001).

No community discussion yet for this question.