hardMultiple Choice
CAS-004 Practice Question: Refer to the exhibit
Exhibit
{
"dataClassification": {
"levels": ["Public", "Internal", "Confidential", "Critical"],
"default": "Internal",
"rules": [
{"dataType": "PII", "level": "Confidential"},
{"dataType": "PCI", "level": "Critical"}
]
}
}Refer to the exhibit. The data classification policy defines levels and rules. During an audit, a database containing both PII and credit card numbers is found labeled as 'Internal'. Which of the following is the BEST first action?
⚠ Common exam trap
CAS-005 often tests the 'highest sensitivity wins' rule for mixed-data assets, and candidates are tempted by remediation actions (removing data, creating new tiers) that sound proactive but skip the mandatory first step of correcting the classification label.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reclassify the database as 'Critical' to reflect the highest required level
When a database contains data spanning multiple classification levels, the governing principle is that the asset must be classified at the highest sensitivity level of any data it contains. Since credit card numbers (regulated as cardholder data under PCI DSS) are more sensitive than generic PII labeled 'Internal', the database must be reclassified to reflect that highest level. Reclassifying as 'Critical' aligns the label with the actual data sensitivity and triggers the appropriate handling controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accept the risk as the data is not public
Why it's wrong here
Accepting the risk leaves regulated cardholder data under-protected and contradicts the policy's own rules. It is tempting because the data is not public, implying low exposure, and would be correct only if the policy permitted Internal handling for that data type.
- ✗
Remove the credit card numbers from the database
Why it's wrong here
Removing the credit card numbers does not address the core issue: the database is mislabelled as 'Internal' despite containing PII and credit card data that, under the classification policy, likely requires a higher tier such as 'Confidential' or 'Restricted'. This action is tempting because data sanitisation is a legitimate method to reduce compliance scope, and it would be correct if the policy mandated eliminating sensitive fields to keep the database at the 'Internal' level, but here the policy violation stems from incorrect classification, not the data's presence.
- ✗
Create a new classification level for mixed data
Why it's wrong here
Creating a new level bypasses the existing policy rather than applying it, so it is not the first action. It is tempting because mixed PII and card data feels unclassifiable, and would be correct if the policy genuinely lacked a level covering combined data types.
- ✓
Reclassify the database as 'Critical' to reflect the highest required level
Why this is correct
Reclassifying to Critical immediately aligns the database's label with its actual contents, since credit card numbers demand the highest protection level under the policy. This corrects the mislabelling before any further remediation or access review.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.