nerdexam
Adobe

AD0-E605 · Question #79

An architect for a healthcare organization has been given the following requirements from the organization's compliance and legal team regarding web analytics data collection: 1. The data collected on

The correct answer is A. Create two sandboxes, one which will collect the RHD data and one to collect the non-RHD data;. Separating RHD and non-RHD data into two sandboxes is the only configuration that prevents identity graph stitching from contaminating the personalization-safe sandbox. In AEP, sandboxes maintain completely isolated identity graphs - so the non-RHD sandbox holds only ECID-based p

Data Governance and Privacy

Question

An architect for a healthcare organization has been given the following requirements from the organization's compliance and legal team regarding web analytics data collection: 1. The data collected on the organization's home page cannot collect any known identifiers and will not be considered Restricted Healthcare Data (RHD). 2. Once the user authenticates to the website, known identifiers can be collected, but any linked data to the known healthcare identifier will be considered RHD. 3. Onsite personalization can only be done using non-RHD data. Below is a sample web analytics record from the Organization's home page: { "eventType": "web.webpagedetails.pageViews", "_id": "ABC-123", "timestamp": "2023-09-27T15:02:07.977Z", "web": { "webPageDetails": { "name": "Homepage", "siteSection": "Home" } }, "identityMap": { "ECID": [ { "id": "12345678" } ] } } And an example of a web analytics record once a user authenticates: { "eventType": "web.webpagedetails.pageViews", "_id": "ABC-1234", "timestamp": "2023-09-27T15:03:07.977Z", "web": { "webPageDetails": { "name": "Customer Login", "siteSection": "Healthcare Authenticated" } }, "identityMap": { "ECID": [ { "id": "12345678" } ], "CustomerHealthCareID": [ { "id": "ABC" } ] } } Assume that all web analytics data will be enabled for Profile with ECID as the Primary Identity. Given the above requirements and the organization's desire to personalize its website visitor's experience, how would the Platform be configured to accommodate both requirements?

Options

  • ACreate two sandboxes, one which will collect the RHD data and one to collect the non-RHD data;
  • BCreate one sandbox and apply the RHD label to only the known customer identifiers
  • CCreate one sandbox with two datasets, one which will be labeled as RHD and one that will be
  • DConfigure one sandbox and use data retention policies to separate RHD and non-RHD data

How the community answered

(35 responses)
  • A
    77% (27)
  • B
    3% (1)
  • C
    9% (3)
  • D
    11% (4)

Explanation

Separating RHD and non-RHD data into two sandboxes is the only configuration that prevents identity graph stitching from contaminating the personalization-safe sandbox. In AEP, sandboxes maintain completely isolated identity graphs - so the non-RHD sandbox holds only ECID-based profiles from the homepage, while the RHD sandbox holds authenticated profiles with CustomerHealthCareID. Because onsite personalization draws from the non-RHD sandbox, it never touches healthcare-linked data, satisfying both compliance and personalization requirements simultaneously.

Why the distractors fail:

  • B (labels on identifiers in one sandbox): Data governance labels restrict downstream activation, but they don't stop the identity service from stitching the homepage ECID to the authenticated CustomerHealthCareID within the same sandbox - the unified profile itself becomes RHD-tainted, making personalization non-compliant.
  • C (two datasets in one sandbox): Same stitching problem - AEP's identity graph merges records across datasets within a sandbox when they share an ECID, so the "non-RHD" dataset's profiles still get linked to RHD records.
  • D (data retention policies): Retention policies govern how long data is stored, not how identities are resolved or how data is classified - they don't provide any compliance boundary between RHD and non-RHD.

Memory tip: In AEP, labels = access control, sandboxes = identity isolation. Whenever a compliance requirement says "personalization must never touch RHD," that's a signal you need sandbox-level separation, because no label or dataset configuration can stop the identity graph from merging records that share the same ECID within a single sandbox.

Topics

#data labels#RHD classification#sandbox configuration#healthcare compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AD0-E605 Practice