easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A company has implemented data classification…
A company has implemented data classification labels such as 'Public', 'Internal', 'Confidential', and 'Restricted'. Which control is most appropriate for protecting 'Confidential' data?
⚠ Common exam trap
The trap here is that candidates often pick data masking (Option A) thinking it protects confidentiality, but masking is a de-identification technique for specific use cases like testing, not a primary control for protecting classified data in production.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption at rest and in transit
Encryption at rest and in transit is the most appropriate control for protecting 'Confidential' data because it renders the data unreadable to unauthorized parties both when stored on disk (e.g., AES-256) and when transmitted over networks (e.g., TLS 1.3). This directly enforces confidentiality by ensuring that even if an attacker gains access to the storage medium or intercepts network traffic, the data remains protected. Data classification labels like 'Confidential' require strong cryptographic controls to meet the principle of least privilege and compliance mandates such as GDPR or HIPAA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data masking for all users
Why it's wrong here
Data masking for all users is an overly aggressive control that would severely impede legitimate business operations. While masking can protect sensitive data for specific use cases (e.g., testing, analytics), applying it universally would prevent authorized personnel from accessing the unmasked information necessary for their roles, directly undermining the utility of classified data and operational efficiency. It fails to align with a granular data classification scheme that dictates varying access levels based on sensitivity.
- ✓
Encryption at rest and in transit
Why this is correct
Encryption at rest and in transit is a foundational security control directly supporting data classification by ensuring confidentiality throughout the data lifecycle. Encryption at rest protects data stored on various media from unauthorized access, even if the storage device is compromised. Encryption in transit safeguards data as it traverses networks, preventing eavesdropping or interception, thereby maintaining the integrity and confidentiality of classified information during transmission between systems or users.
- ✗
Removing all access controls to streamline sharing
Why it's wrong here
Removing all access controls completely undermines the purpose of data classification, which is to apply appropriate security based on data sensitivity. Such an action would eliminate the ability to restrict access to sensitive information, leading to widespread unauthorized disclosure and a catastrophic loss of confidentiality and integrity. This approach directly contradicts fundamental security principles and the very concept of protecting classified data.
- ✗
Public posting on the company website
Why it's wrong here
Publicly posting classified data on a company website is fundamentally antithetical to data classification and security objectives. This action would make sensitive information universally accessible, directly violating confidentiality requirements and exposing the company to significant risks, including competitive disadvantage, regulatory non-compliance, and reputational damage. It negates any effort to protect data based on its sensitivity level.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
HIPAA
HIPAA is a U.S. law that sets national standards for protecting sensitive patient health information from being disclosed without the patient's consent or knowledge.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.