hardMultiple ChoiceObjective-mapped
CISSP Practice Question: During a security audit, it is discovered that a…
During a security audit, it is discovered that a company's data classification labels are inconsistently applied across different departments. Which of the following is the BEST long-term solution to ensure consistent data classification?
⚠ Common exam trap
Candidates often choose annual retraining (A) as a 'best practice' for policy adherence, but the question specifically asks for the 'BEST long-term solution' to ensure consistency, which requires automation to remove human subjectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement automated data classification tools that apply labels based on content and context
Automated data classification tools use content inspection (e.g., regex patterns, keyword matching) and contextual analysis (e.g., file location, creator, metadata) to consistently apply labels across the enterprise. This eliminates human error and variability between departments, ensuring uniform enforcement of the classification policy without relying on manual interpretation or periodic training.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct annual retraining on data classification policies
Why it's wrong here
While annual retraining can improve user awareness of data classification policies, it does not inherently guarantee consistent application across diverse data sets or prevent human error. Manual classification, even by trained personnel, remains susceptible to subjective interpretation, oversight, and the sheer volume of data, leading to ongoing inconsistencies. This approach fails to provide a scalable or error-proof mechanism for maintaining accurate data classification over time.
- ✓
Implement automated data classification tools that apply labels based on content and context
Why this is correct
Automated data classification tools leverage machine learning, regular expressions, and predefined policies to scan, identify, and label data based on its content (e.g., PII, PCI data) and context (e.g., location, creator, access patterns). This significantly reduces human error and subjectivity, ensuring consistent, scalable, and real-time application of classification labels across vast and dynamic data repositories. Such tools enforce organizational policies uniformly, enhancing compliance and security posture effectively.
- ✗
Adopt a single classification level for all data to eliminate confusion
Why it's wrong here
Adopting a single classification level for all data, while seemingly simplifying policy, is highly impractical and detrimental to both security and business operations. It inevitably leads to either over-protecting non-sensitive data, incurring unnecessary costs and hindering productivity, or, more critically, under-protecting genuinely sensitive information, exposing the organization to severe data breaches and regulatory non-compliance. A nuanced, multi-tiered classification scheme is essential to align security controls with actual data value and risk.
- ✗
Assign a data owner in each department to manually review and classify data
Why it's wrong here
While assigning data owners is crucial for accountability, relying solely on manual review and classification by these individuals is not a scalable or consistently reliable solution. Data owners, despite their expertise, face challenges with the sheer volume and velocity of data, potential for human error, subjective interpretations of policy, and time constraints. This manual approach introduces inconsistencies across departments and fails to provide the continuous, granular classification required for effective data protection in modern enterprises.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.