CCSP Cloud Data Security Practice Question
A healthcare organization stores electronic protected health information (ePHI) in a cloud environment. They need to implement data discovery and classification to meet HIPAA requirements. Which two techniques are most appropriate for identifying ePHI in unstructured data stored in cloud object storage? (Choose two.)
⚠ Common exam trap
The trap here is assuming that metadata or file extensions are sufficient for data discovery, when in fact content inspection is required to reliably identify ePHI in unstructured data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regular expression pattern matching for known ePHI formats.
Regular expression pattern matching and NLP are both content inspection techniques that can identify ePHI in unstructured data. Pattern matching catches formatted identifiers, while NLP detects medical context. Together they provide a robust discovery strategy. Encryption, manual review, and metadata tagging do not effectively identify ePHI content at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Regular expression pattern matching for known ePHI formats.
Why this is correct
Regular expressions can identify structured ePHI such as Social Security numbers, medical record numbers, and dates of birth in text files. This is a common technique in data discovery tools to flag potential ePHI. It is effective for known patterns but may produce false positives, so it is often combined with other methods.
- ✗
Full-disk encryption of the storage volumes.
Why it's wrong here
Full-disk encryption protects data at rest but does not help identify or classify ePHI. It renders data unreadable if the disk is stolen, but it does not scan content or determine whether files contain ePHI. Encryption is a security control, not a discovery technique, so it does not meet the requirement.
- ✓
Natural language processing (NLP) to detect medical terminology and context.
Why this is correct
NLP can analyze unstructured text to identify medical terms, diagnoses, and contextual clues that indicate ePHI. It complements pattern matching by catching ePHI that doesn't follow strict formats, such as narrative clinical notes. This improves accuracy in classifying unstructured data like physician notes or discharge summaries.
- ✗
Metadata tagging based on file extensions and folder names.
Why it's wrong here
Metadata tagging relies on existing labels, which may be missing or inaccurate. File extensions and folder names do not reliably indicate ePHI content; a .txt file could contain anything. This method is weak for discovery because it does not inspect content, leading to false negatives and non-compliance.
- ✗
Manual review of every file by a compliance officer.
Why it's wrong here
Manual review is impractical for large volumes of cloud data and does not scale. While it can be accurate for small sets, it is error-prone and slow. It is not a technique for automated discovery and classification, and it cannot keep up with dynamic cloud storage, making it unsuitable for ongoing HIPAA compliance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.