ISC2 CC Security Principles Practice Question
A company stores customer PII including social security numbers and medical records. Under privacy principles, these data elements are best described as:
⚠ Common exam trap
Many exam-takers confuse broad data classification terms like 'confidential' with the specific regulatory category of 'sensitive PII,' which carries distinct legal and compliance obligations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitive PII
Sensitive PII is the correct classification because it includes data elements like Social Security numbers and medical records that, if disclosed, could cause significant harm, discrimination, or identity theft. Under privacy frameworks such as NIST SP 800-122 and GDPR, these are explicitly categorized as sensitive PII requiring stricter protection. Unlike general confidential data, sensitive PII has specific regulatory and compliance implications, including breach notification laws and mandatory safeguards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidential data
Why it's wrong here
Confidential data is a general business sensitivity tier, not the privacy-law category the question asks for. Social security numbers and medical records constitute sensitive personal data or personally identifiable information under privacy principles. Confidential data would be the answer for proprietary business information rather than regulated personal data.
- ✗
Internal data
Why it's wrong here
Internal data is a handling or sharing label, not a privacy classification. Social security numbers and medical records are regulated sensitive personal data, so they demand the strictest protection tier. Internal data would fit routine business material such as internal memos or non-sensitive operational records.
- ✓
Sensitive PII
Why this is correct
Sensitive PII covers data elements whose exposure causes heightened harm, such as social security numbers and medical records, which is precisely what the stem lists. Ordinary PII alone would not capture the elevated protection these identifiers and health data demand under privacy principles.
- ✗
Public data
Why it's wrong here
Public data is freely disclosable with no harm from release. Social security numbers and medical records are regulated sensitive personal data requiring strict protection. It is tempting only if one assumes customer data is harmless, but public data would describe published marketing material or open datasets.
Go deeper
Related to this question
Learn chapter
Security Governance and Compliance
Key term
PII
PII stands for Personally Identifiable Information, which is any data that can be used to identify a specific individual.
Key term
Privacy
Privacy in IT is the control over how personal data is collected, stored, used, and shared by systems and organizations.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.