SY0-701 Question 282
Single answerClassificationA healthcare company is rolling out a data handling policy after discovering that employees store patient records, internal HR files, and public marketing materials in the same shared repository. The security manager wants a classification approach that will help staff apply the correct storage, access, and transmission controls based on the sensitivity and business impact of the data. Which of the following should the company do FIRST?
- A
Define data classification categories and criteria, then label data according to sensitivity and handling requirements
- B
Encrypt all files in the repository with the same settings so every document receives equal protection
- C
Move all files to an isolated network segment and restrict access to the IT department only
- D
Create a single retention schedule for all documents to reduce administrative overhead
Show answer and explanation
Correct answer: A
Explanation
The best first step is to establish a formal data classification scheme and label data according to sensitivity and handling requirements. In Security+, classification is used to identify the value and sensitivity of data so organizations can apply proportional protections such as access controls, encryption, transmission restrictions, retention, and destruction procedures. In this scenario, patient records likely require stronger controls than internal business data, while public marketing materials require the least protection. Best practices from security governance frameworks and industry guidance, including NIST recommendations on data categorization and information handling, support defining categories and handling rules before selecting technical controls. Classification informs later decisions such as encryption standards, access permissions, segmentation, and retention policies.
- A. Correct.
Correct. Classification starts with establishing categories such as public, internal, confidential, or restricted, along with criteria that reflect sensitivity, regulatory obligations, and business impact. Once data is classified and labeled, the organization can apply appropriate controls for access, storage, encryption, transmission, and disposal. This is the foundational step because the company currently lacks separation between different data types and needs a consistent way to determine protection requirements.
- B. Incorrect.
Incorrect. Encryption is an important control, but applying the same protection to all files does not address the core classification problem. Public marketing materials do not require the same handling as protected health information or HR records. Classification should drive the selection of controls; otherwise, the organization may overprotect low-value data and still fail to meet specific handling requirements for sensitive data.
- C. Incorrect.
Incorrect. Network segmentation can reduce exposure, but moving all data to an isolated segment and limiting access to IT does not solve the business need for authorized users to work with the information. It also treats all data as if it has the same sensitivity. Classification is intended to enable differentiated access and handling based on data type and impact, not simply broad restriction.
- D. Incorrect.
Incorrect. Retention schedules are part of data lifecycle management, but they are not the first step in addressing mixed sensitivity levels in a shared repository. Different classes of data may require different retention and disposal rules, especially in regulated environments such as healthcare and HR. Without classification, the organization cannot build an appropriate retention policy.