Study ISC2 CC data security and logging: symmetric encryption, asymmetric encryption, hashing, classification, retention, destruction, and monitoring.
Data security questions ask how data is protected, handled, retained, destroyed, and monitored. The right answer depends on the data state and the control objective.
| Concept | Use |
|---|---|
| Symmetric encryption | same secret key encrypts and decrypts; efficient for data protection |
| Asymmetric encryption | public/private key pair; useful for key exchange, identity, and signatures |
| Hashing | one-way integrity check; not encryption |
| Requirement | Strong answer |
|---|---|
| sensitive data needs handling rules | classification and labeling |
| data should not be kept forever | retention schedule |
| data must be removed safely | approved destruction or sanitization |
| access must be limited | least privilege and need-to-know |
| activity must be provable | logging, monitoring, retention, and review |
The current CC outline includes safe use of AI tools. Treat public AI prompts as a data-handling risk: do not paste sensitive company, customer, credential, or regulated data into unapproved tools.