CISSP Asset Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Name and email address

  Why it's wrong here

  These elements, while clearly identifying an individual, are generally classified as non-sensitive PII. Their disclosure primarily facilitates direct communication or marketing efforts rather than enabling immediate financial fraud or identity theft on their own. While important to protect, they do not inherently carry the same high risk of severe personal harm as sensitive identifiers.

• ✗

  Job title

  Why it's wrong here

  A job title, by itself, is typically not considered Personally Identifiable Information (PII), let alone sensitive PII. It describes a role or position within an organization and does not uniquely identify a specific individual without additional contextual data. Its disclosure usually carries minimal risk of personal harm or identity compromise.

• ✗

  Phone number

  Why it's wrong here

  While a phone number is a form of PII that can be used to contact or identify an individual, it is generally not categorized as sensitive PII. Its unauthorized disclosure primarily leads to nuisance calls or targeted marketing, rather than directly enabling severe financial fraud or identity theft. Unlike sensitive identifiers, it does not typically serve as a primary key for accessing critical personal accounts.

• ✓

  Social Security number

  Why this is correct

  A Social Security number (SSN) is unequivocally considered sensitive PII due to its direct linkage to an individual's financial, medical, and governmental records. Its compromise presents an extremely high risk of identity theft, financial fraud, and other severe personal harm. Consequently, SSNs require the most stringent security controls and regulatory protections to safeguard individuals from significant adverse impacts.

Go deeper

Related to this question