ISC2 CC Security Principles Practice Question
What is the primary goal of data classification?
⚠ Common exam trap
Many exam-takers confuse the primary goal of classification (determining appropriate security controls) with secondary benefits like cost reduction or compliance with a specific function (marketing) — candidates pick a plausible-sounding but narrow outcome instead of the core security purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To determine the appropriate level of security controls
Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements so that appropriate security controls (encryption, access control, retention, handling procedures) can be applied proportionally. Its primary purpose is to ensure that protection levels match the data's risk profile. This is the foundational step in any data governance or security program.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To improve data access speed
Why it's wrong here
Improving access speed is a performance concern addressed by indexing, caching or storage tiering, not by labelling data according to sensitivity and handling requirements. Classification exists to determine protection levels, retention and sharing rules. Speed optimisation would be the right focus when tuning query latency or throughput, which is unrelated to the primary goal here.
- ✗
To comply with marketing requirements
Why it's wrong here
Marketing requirements concern promotional use of data, not its protection. Classification instead assigns sensitivity labels so controls match data value; regulatory or contractual obligations, such as GDPR or PCI DSS, drive the scheme, not campaign or audience targeting needs.
- ✓
To determine the appropriate level of security controls
Why this is correct
Data classification assigns sensitivity labels that directly dictate which security controls apply, satisfying the stem's requirement for a primary goal. By categorising information according to its value and sensitivity, organisations can apply proportionate protection, ensuring Microsoft Entra ID access policies and encryption align with each data type's risk profile.
- ✗
To reduce storage costs
Why it's wrong here
Storage cost reduction comes from tiering, deduplication and lifecycle policies, not classification itself. Classification identifies data sensitivity so appropriate handling and protection controls apply; cost savings may follow indirectly, but they are not its primary purpose.
Go deeper
Related to this question
Learn chapter
Security Governance and Compliance
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.