easyMultiple Select
CCSP Practice Question: A cloud architect is designing a data…
A cloud architect is designing a data classification scheme for a financial services firm. The data includes public marketing materials, internal emails, customer account numbers, and credit card information. Which two data categories should be classified as 'restricted' under PCI DSS and other regulations?
⚠ Common exam trap
ISC2 often tests the misconception that all internal communications (like emails) are automatically 'restricted' under PCI DSS, when in fact only data containing specific regulated elements (e.g., PANs, SAD) qualifies for that classification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Credit card information
Credit card information (B) is correctly classified as restricted because PCI DSS explicitly governs cardholder data, including the Primary Account Number (PAN) and sensitive authentication data, requiring strong encryption, masking, and strict access controls. Customer account numbers (D) also belong in the restricted category because they are regulated non-public personal information (NPI) under financial privacy laws such as GLBA, and their exposure can enable identity theft or account takeover. Public marketing materials (A) are intended for open distribution and carry no confidentiality requirement, so they are not restricted. Internal emails (C) may contain sensitive content, but as a general category they are typically classified as internal or confidential rather than restricted, since not every internal email includes regulated data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Public marketing materials
Why it's wrong here
Public marketing materials are deliberately published, so they carry no confidentiality, integrity or contractual obligation under PCI DSS. Restricted classification is reserved for cardholder data and similarly regulated records. Marketing content would instead sit at the lowest tier, typically labelled public, where disclosure causes no regulatory or financial harm.
- ✓
Credit card information
Why this is correct
PCI DSS mandates the strictest protection for cardholder data, including the primary account number. Credit card information therefore belongs in the restricted category, alongside customer account numbers, because its exposure triggers regulatory breach notification and heavy penalties.
- ✗
Internal emails
Why it's wrong here
Internal emails warrant a confidential or internal tier, not restricted; PCI DSS scopes cardholder data, and routine correspondence is not a regulated data element. Restricted is reserved for customer account numbers and credit card data. Internal emails would be the correct classification when the scheme's top tier covers only severe regulatory or contractual exposure.
- ✓
Customer account numbers
Why this is correct
Customer account numbers are personally identifiable financial data, so PCI DSS and privacy regulations demand restricted handling. They require encryption, strict access control and audit logging, unlike public marketing materials or internal emails, which sit at lower classification tiers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.