mediumMultiple SelectObjective-mapped
Key Elements of a Data Classification Policy
Which TWO of the following are key elements of a data classification policy?
Quick Answer
The answer is classification categories and handling and labeling procedures. Classification categories, such as public, internal, or confidential, are essential because they establish the tiers of sensitivity that drive all subsequent security controls. Handling and labeling procedures are equally critical, as they translate those categories into enforceable operational steps for marking, storing, transmitting, and disposing of data, ensuring consistent protection in line with frameworks like NIST SP 800-53 and ISO 27001. On the CompTIA SecurityX CAS-004 exam, this question tests your understanding that a policy is incomplete without both the taxonomy and the actionable rules; a common trap is selecting only the categories while overlooking the procedures that make them enforceable. To remember this, think of a library: the categories are the shelf labels, but the handling procedures are the checkout and return rules—without both, the system fails.
⚠ Common exam trap
The CAS-004 exam often tests the distinction between policy elements and implementation controls, so the trap here is confusing operational procedures (handling/labeling) and classification categories (the core of a classification policy) with technical security controls like encryption algorithms or backup schedules, which belong in separate policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Handling and labeling procedures
Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Handling and labeling procedures
Why this is correct
Procedures for handling each classification level are essential.
- ✓
Classification categories (e.g., public, internal, confidential)
Why this is correct
Classification categories define the levels of data sensitivity.
- ✗
Acceptable use guidelines for company devices
Why it's wrong here
This is part of an acceptable use policy.
- ✗
Backup frequency and retention periods
Why it's wrong here
This is part of a backup and recovery policy.
- ✗
Encryption algorithms and key lengths
Why it's wrong here
This is part of a cryptographic policy.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team is developing a data classification policy. Which TWO of the following elements should be included in the policy to ensure effective data governance?
medium- ✓ A.Handling requirements for each classification level, including storage and transmission
- B.Data retention and disposal schedules
- C.Encryption algorithms to be used for data at rest
- D.Data loss prevention (DLP) rules
- ✓ E.Criteria for classifying data into categories such as public, internal, confidential
Why A: A data classification policy must define handling requirements for each classification level, specifying how data should be stored, transmitted, and accessed. This ensures consistent protection controls are applied based on sensitivity, which is a core governance principle. Without these requirements, data may be mishandled, leading to compliance violations or data breaches.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.