Information Security Risk Management →mediumMultiple ChoiceObjective-mapped

CISM Information Security Risk Management Practice Question

Exhibit

Refer to the exhibit.

{
  "dataClassification": {
    "public": {
      "description": "Information that can be disclosed to anyone",
      "handling": "No special protection required"
    },
    "internal": {
      "description": "Information for internal use only",
      "handling": "Must be stored on internal systems, encrypted in transit"
    },
    "confidential": {
      "description": "Sensitive information with legal or contractual obligations",
      "handling": "Must be encrypted at rest and in transit, access on a need-to-know basis"
    },
    "highlyConfidential": {
      "description": "Information that could cause severe reputational damage if disclosed",
      "handling": "All 'confidential' protections plus multifactor authentication, data loss prevention, and quarterly access reviews"
    }
  }
}

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

⚠ Common exam trap

A common pitfall in ISACA CISM exams is the distinction between 'Confidential' and 'HighlyConfidential' classifications. Candidates often overclassify sensitive data like salary information as 'HighlyConfidential', but the minimum violated requirement is typically 'Confidential' when the data is not top-secret.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Confidential handling requirements

The email containing employee salaries was sent to all staff, which is a violation of the 'Confidential' handling requirement. Confidential data, such as salary information, must be restricted to authorized recipients only, and mass distribution to all staff exceeds that authorization. The exhibit likely classifies salary data as 'Confidential', not 'HighlyConfidential', making option B the correct minimum violated requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
HighlyConfidential handling requirements
Why it's wrong here
While salaries might be highly confidential, the minimum violated is confidential.
✓
Confidential handling requirements
Why this is correct
Salaries are confidential; email lacks encryption and need-to-know.
✗
Internal handling requirements
Why it's wrong here
Internal allows internal use but still need-to-know? Actually internal says 'internal use only' but may not require encryption; but salaries are more sensitive.
✗
Public handling requirements
Why it's wrong here
Public data can be disclosed.

Go deeper

CISM Information Security Risk Management Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question