200-201 Security Policies and Procedures Practice Question
An organization classifies data into Public, Internal, Confidential, and Restricted tiers. A developer needs to place a dataset containing customer payment card numbers into the correct tier and apply the required handling controls. According to common data classification practices, which tier and control combination is most appropriate?
⚠ Common exam trap
The trap here is assuming that because only employees use the data it can be labeled Internal, when regulatory sensitivity rather than audience determines the classification tier.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restricted, with encryption, strict need-to-know access, and audit logging
Payment card numbers are regulated under PCI DSS and represent a high-impact asset if disclosed, so they belong in the most restrictive tier the organization defines. Restricted classification paired with encryption, need-to-know access, and audit logging satisfies both internal policy and regulatory expectations. Lower tiers such as Internal, Confidential, or Public would apply weaker controls than the data warrants and could create compliance exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restricted, with encryption, strict need-to-know access, and audit logging
Why this is correct
Restricted is the highest sensitivity tier and is appropriate for regulated data such as payment card numbers, which PCI DSS requires to be encrypted and tightly access-controlled. Applying encryption, least-privilege access, and audit logging aligns with both the classification scheme and regulatory expectations. This combination protects the data and provides the accountability needed if a breach occurs.
- ✗
Confidential, with encryption at rest and in transit
Why it's wrong here
Confidential is a protected tier, but payment card data typically warrants the highest sensitivity label because of PCI DSS requirements and the direct financial fraud risk if exposed. Treating it as merely Confidential could result in weaker controls than the organization applies to its most sensitive assets. The Restricted tier, with the strictest handling rules, is the more defensible classification for cardholder data.
- ✗
Internal, because the data is used only by employees
Why it's wrong here
Internal data is meant for general employee use and carries minimal handling restrictions. Payment card numbers are regulated under PCI DSS and require strong protection regardless of who accesses them. Classifying them as Internal would understate the risk and likely violate contractual and regulatory obligations, leaving sensitive financial data without the encryption and access controls it demands.
- ✗
Public, because the numbers are only partial card values
Why it's wrong here
Even partial card values, such as the first six and last four digits, can be sensitive and are subject to PCI DSS scope considerations. Public classification implies no handling restrictions, which would expose the data to unnecessary risk and likely breach compliance requirements. Choosing Public would ignore the regulatory and fraud implications of storing any cardholder data elements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.