nerdexam
CompTIA

SY0-301 · Question #360

End-user awareness training for handling sensitive personally identifiable information would include secure storage and transmission of customer:

The correct answer is A. Date of birth. Date of birth is classified as sensitive PII because it is a static, unalterable identifier commonly used for identity verification and authentication. Training on sensitive PII handling specifically calls out date of birth for secure storage and transmission requirements.

Security program management and oversight

Question

End-user awareness training for handling sensitive personally identifiable information would include secure storage and transmission of customer:

Options

  • ADate of birth.
  • BFirst and last name.
  • CPhone number.
  • DEmployer name.

How the community answered

(55 responses)
  • A
    93% (51)
  • B
    4% (2)
  • C
    2% (1)
  • D
    2% (1)

Why each option

Date of birth is classified as sensitive PII because it is a static, unalterable identifier commonly used for identity verification and authentication. Training on sensitive PII handling specifically calls out date of birth for secure storage and transmission requirements.

ADate of birth.Correct

Date of birth is designated as sensitive PII by NIST SP 800-122 because, unlike publicly available information, it is a persistent personal identifier that cannot be changed if compromised and is routinely used in combination with name and SSN for identity verification, fraud, and account recovery. Secure storage and encrypted transmission are required to prevent its exploitation.

BFirst and last name.

First and last name alone are generally considered non-sensitive PII because they are publicly available and do not by themselves enable identity theft or fraud without additional identifiers.

CPhone number.

A phone number is a lower-sensitivity identifier that is frequently shared publicly and, while it warrants some protection, is not classified at the same sensitivity level as date of birth for identity verification purposes.

DEmployer name.

Employer name is publicly available information that does not uniquely identify an individual or provide meaningful leverage for fraud or identity theft on its own.

Concept tested: Sensitive PII classification and handling requirements

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf

Topics

#PII#personally identifiable information#security awareness training#data classification

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice