ITPEC IP October 2019 Question 41
Topic: SecurityAlso asked in Spring 2021
When information is classified and managed according to the protection level in information security, which of the following lists all and only the appropriate methods for the management?
IThe protection level that is assigned to each piece of information is not changed until the information is discarded.IIThe procedure for handling information is defined for each protection level.IIIThe protection level for each piece of information is determined on the basis of standards that the organization establishes.IVThe object that is managed according to the protection level is limited to electronic data and storage media that store it.
Explanation
II and III — handling procedures are set per protection level, and the levels are assigned by the organization's own standards.
- •I: wrong. The value and sensitivity of information change over time (a confidential product plan becomes public at launch), so the assigned level is reviewed and changed when needed, not fixed until disposal.
- •II: right. Each level has its own rules for storage, copying, sending, access and disposal; that is the point of classifying.
- •III: right. The organization decides its classification criteria and applies them to each piece of information.
- •IV: wrong. Paper documents, spoken information and other forms also carry information and must be classified and handled by level, not only electronic data and its media.
Answer (c)
Why not others:
- •(a) I, III — includes I, which freezes the level until disposal, and misses II
- •(b) I, IV — both statements are wrong: the level is not frozen, and classification is not limited to electronic data
- •(d) II, IV — includes IV, which limits classification to electronic data and storage media, and misses III
Key rule: Information classification covers information in every form, ties handling rules to each level, and is reviewed as the information's value changes.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.