CCSP Cloud Data Security Practice Question
A company is planning to implement data classification for its cloud environment. Which TWO components are essential for an effective data classification scheme? (Select TWO.)
⚠ Common exam trap
CCSP often tests the difference between the classification scheme itself and the controls that enforce it, causing candidates to select encryption or DLP as 'essential components' when they are actually downstream controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A process to tag resources with the appropriate classification labels
Option B is correct because an effective data classification scheme requires a repeatable process to tag resources with the appropriate classification labels, so that the assigned sensitivity level is actually recorded and travels with the data or resource for later policy enforcement. Option E is correct because classification cannot function without a defined taxonomy of labels, such as public, internal, confidential, and restricted, which establishes the categories and criteria that everything else maps to. Together, the label scheme (E) and the tagging process (B) form the foundational components of classification. Option A is not essential to the classification scheme itself; encryption at rest is a protective control that may be applied based on classification, not a component required to classify data. Option C is also a downstream control, since access policies consume classification labels rather than define the scheme. Option D is likewise an enforcement mechanism, and automated DLP scanning depends on classification being established first rather than being essential to creating it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encryption at rest for all classified data
Why it's wrong here
Encryption at rest protects data confidentiality but does not itself assign or maintain classification labels; it is a control applied after data is classified. Classification schemes require defined categories and labelling criteria. Encryption would be the answer if the question asked how to protect data once its classification level is known.
- ✓
A process to tag resources with the appropriate classification labels
Why this is correct
Tagging resources with classification labels is the operational mechanism that actually applies the scheme to data at scale. Without an enforced tagging process, labels remain theoretical and cannot drive protection, access, or retention controls, so the classification scheme is never realised across the cloud estate.
- ✗
Access control policies based on classification
Why it's wrong here
Access control policies based on classification are a downstream consumer of labels, not a component that establishes the scheme itself. An effective scheme needs defined classification categories and consistent labelling criteria applied to data. This option would be correct if the question asked how classification levels are enforced once assigned.
- ✗
Automated DLP scanning to enforce classification
Why it's wrong here
Automated DLP scanning enforces handling rules on data already classified; it detects and blocks flows rather than defining the taxonomy or labelling data. A classification scheme requires defined categories and labelling criteria. DLP would be the answer if the question asked how to monitor or prevent exfiltration of data at a given classification.
- ✓
A classification scheme with defined labels (e.g., public, internal, confidential, restricted)
Why this is correct
Defined labels such as public, internal, confidential, and restricted establish the taxonomy that determines handling rules, access controls, and protection levels. Without a consistent label set, tagging and enforcement have no shared vocabulary, so classification cannot be applied or audited meaningfully across the environment.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.