Start Here
Six review stations, each a different way to practice Chapter 10. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or the exam.
What this chapter asked you to be able to do
- Classify data by sensitivity level (public, internal, confidential, critical/restricted) and choose handling controls that match the risk.
- Explain the security challenges and controls for the three data states: at rest, in transit, and in use.
- Differentiate the data protection techniques (encryption, tokenization, masking, anonymization, pseudonymization) and apply each to the right scenario.
- Describe how data loss prevention (DLP) protects data across endpoints, networks, and cloud services.
- Explain data retention and secure destruction, including degaussing, shredding, and cryptographic erasure.
- Identify the privacy roles (controller, processor, steward, data protection officer) and the obligations set by GDPR, CCPA/CPRA, and HIPAA.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Matching Scenarios to a Data State
Data exists in three states, and each one faces a different threat and needs a different control. Read each scenario and choose the state the data is in, then check your answer.
Reference: the three data states
| State | Where the data is | Primary threat | Primary control |
|---|---|---|---|
| At rest | Disk, database, tape, or archive | Unauthorized physical or system access | Encryption, access controls, physical security |
| In transit | Moving across networks or between cloud regions | Man-in-the-middle interception | TLS encryption, VPN, mutual authentication |
| In use | Processed in memory or displayed on screen | Process compromise, memory attacks, unauthorized viewing | Application access controls, memory protection, secure enclaves |
Classifying Data by Sensitivity Level
Classification ties the strength of protection to the harm that disclosure would cause. Read each example and choose the sensitivity level it fits, then check your answer.
Matching a Description to a Data Protection Technique
Encryption, tokenization, masking, anonymization, and pseudonymization each protect data in a different way, with different tradeoffs. Read each description and choose the technique it defines, then check your answer.
Reference: protection techniques compared
| Technique | Purpose | Reversible | Use case |
|---|---|---|---|
| Encryption | Make data unreadable without a key | Yes, with the key | Protect data in all states; still processable |
| Tokenization | Replace sensitive data with a random token | No practical relationship | Payment cards, medical IDs; no computational value |
| Masking | Hide sensitive data in displays | Yes, if you can reach the underlying data | User interfaces; see partial values only |
| Anonymization | Remove all links to individuals | No | Research, analytics; some re-identification risk |
| Pseudonymization | Replace identifiers with pseudonyms | Yes, with the mapping key | Data sharing; keep data utility |
When in doubt, treat data as pseudonymized rather than anonymized, since proving true anonymization is difficult.
Matching Privacy Roles and Regulations
Privacy compliance depends on clear roles and on the regulations that set the rules. Read each description and choose the role or regulation it names, then check your answer.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.