Data Protection
What this domain tests
Data Protection tests whether you can classify data, assign ownership, and select the right technique - encryption, masking, tokenization, DLP - across the lifecycle from creation to disposal.
Core rules
- Classification drives handling: typically public, internal, confidential, restricted. Labels must map to written handling rules for storage, transmission and sharing.
- Roles: the data owner is the accountable business authority; the steward manages definitions and quality; the custodian applies the technical safeguards.
- Three states: at rest (encryption, key management), in transit (TLS, IPsec), in use (secure enclaves, access controls, privacy-preserving computation). Backups and archives are also at rest and are frequently forgotten.
- De-identification: masking hides characters irreversibly for display; tokenization substitutes a surrogate value held in a vault and is reversible; pseudonymization replaces identifiers but remains personal data because re-identification is possible with additional data; anonymization is irreversible and falls outside personal-data rules only if truly non-reversible.
- DLP inspects content at endpoint, network egress and cloud, then alerts or blocks. It is not an encryption tool.
- Retention and disposal: schedules tied to legal and business need; sanitization per NIST SP 800-88 levels (clear, purge, destroy) or crypto-erase by destroying keys.
- Backups: 3-2-1 rule, tested restores, and at least one immutable or offline copy against ransomware.
Worked example
A team copies production PII into a test database. Correct approach: replace names, emails and card numbers with consistent tokens from a vault so referential integrity survives, restrict the test database to the test subnet, and log all access. Reasoning: testers need realistic structure, not real identities; tokenization preserves joins; encrypting the test database while leaving the key in the same environment would still expose the data to anyone with test access.
Traps that cost marks
- Hashing values that must later be recovered - hashing is one-way and is for verification.
- Calling pseudonymized data anonymous; it remains personal data.
- Assuming DLP stops copies already moved to personal cloud storage, which needs CASB or egress control.
- Tracking data classification but never applying handling rules.