DA0-002 Data Concepts and Environments Practice Question
A data governance team is drafting a policy for handling personally identifiable information (PII). According to data governance best practices, which document should define the classification levels and handling procedures?
⚠ Common exam trap
It's easy for candidates to confuse the data dictionary (which describes data structure) with the data classification policy (which governs data sensitivity and handling), leading them to select the dictionary as the document that defines classification levels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data classification policy
The data classification policy is the authoritative document that defines classification levels (e.g., public, internal, confidential, restricted) and specifies handling procedures for each category, including PII. This aligns with data governance best practices, as it establishes the rules for labeling, storing, transmitting, and disposing of sensitive data. A data dictionary describes metadata and schema, not classification rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data dictionary
Why it's wrong here
A data dictionary documents technical metadata — field names, data types, formats and lineage — rather than mandating classification tiers or handling rules. It would be the correct artefact when cataloguing schema definitions, whereas policy-level classification belongs in a data classification policy or standard.
- ✓
Data classification policy
Why this is correct
A data classification policy defines the tiers of sensitivity and the handling rules for each, directly satisfying the stem's requirement for a document specifying PII classification levels and procedures. It governs how data is labelled and protected, unlike retention schedules or access-control standards, which address different governance concerns.
- ✗
Data quality report
Why it's wrong here
A data quality report measures accuracy, completeness and consistency of datasets; it defines no classification tiers or handling procedures, so it cannot govern PII. It tempts because quality reporting supports governance oversight, and it would be the right artefact when the requirement is monitoring data fitness rather than prescribing handling rules.
- ✗
Data flow diagram
Why it's wrong here
A data flow diagram maps where data moves between systems and processes; it records no classification tiers or handling rules, so it cannot serve as the governing policy. It is tempting because flow diagrams are genuinely useful for tracing PII propagation during a privacy impact assessment, but the classification scheme itself belongs in a data classification policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DA0-002 question from scratch — 1,004 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DA0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DA0-002 exam.