200-201 Security Policies and Procedures Practice Question
A new security analyst is reviewing the organization's data classification policy and notices that data labeled 'Restricted' must be encrypted at rest and in transit, while data labeled 'Internal' has no encryption requirement. The analyst asks why the policy distinguishes between these levels. What is the primary purpose of a data classification policy?
⚠ Common exam trap
The trap here is assuming that a data classification policy is about access control lists or legal immunity rather than about mapping data sensitivity to handling requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To define handling requirements based on the sensitivity and value of the data
A data classification policy categorizes information by sensitivity and value so that appropriate controls, such as encryption for 'Restricted' data, can be applied consistently. It supports risk-based decision-making, regulatory compliance, and clear handling procedures. The distinction between 'Restricted' and 'Internal' in the scenario exists precisely to ensure stronger protections are applied where the impact of disclosure is greatest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To provide a legal shield that eliminates liability if data is breached
Why it's wrong here
This is incorrect because no policy eliminates legal liability for a breach. Classification supports compliance and due care, but regulators and courts still evaluate whether reasonable protections were implemented. The scenario asks about the purpose of distinguishing 'Restricted' from 'Internal' data, which is about applying appropriate controls, not about avoiding legal responsibility entirely.
- ✗
To specify which employees are allowed to access the internet from corporate devices
Why it's wrong here
This is incorrect because internet access control is governed by an Acceptable Use Policy or firewall/proxy rules, not by a data classification policy. Classification focuses on labeling and protecting data according to sensitivity. The scenario is about encryption requirements tied to data labels, not about who can browse the web, so this option addresses an unrelated control area.
- ✓
To define handling requirements based on the sensitivity and value of the data
Why this is correct
This is correct because data classification assigns labels such as 'Restricted' or 'Internal' based on sensitivity, and each label maps to specific handling, encryption, and access requirements. The policy in the scenario applies stronger controls to more sensitive data, which is the core function of classification. It enables risk-based protection aligned with business and compliance needs.
- ✗
To ensure all data receives the same level of protection regardless of sensitivity
Why it's wrong here
This is incorrect because a classification policy specifically creates differentiated protection levels based on sensitivity. Applying uniform protection ignores the risk-based approach that classification is designed to achieve, and it would unnecessarily increase cost and complexity for low-sensitivity data. The scenario explicitly shows 'Restricted' requiring encryption while 'Internal' does not, which contradicts uniform protection.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.