easyMultiple Select
SSCP Practice Question: Which TWO of the following are key components of…
Which TWO of the following are key components of a data classification policy? (Select the two best answers.)
⚠ Common exam trap
SSCP often tests the distinction between policy components and technical controls, so candidates may mistakenly select encryption or firewall rules as part of the policy when they are actually implementation details derived from it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Classification labels
A data classification policy must define the classification labels (e.g., Public, Internal, Confidential, Restricted) that are applied to data so that handling requirements can be tied to each level, making option C correct. It must also assign data custodian responsibilities, since custodians are the roles accountable for implementing the handling, storage, and protection controls mandated for each classification level, making option D correct. Encryption algorithm selection (A) is a technical control chosen during implementation, not a defining component of the classification policy itself. Firewall rules (B) are network security controls unrelated to how data is categorized. Backup schedules (E) are operational procedures typically documented in a backup or business continuity policy, not in the data classification policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encryption algorithm selection
Why it's wrong here
Choosing an encryption algorithm is a cryptographic control applied after classification, not a component that defines sensitivity labels or handling requirements. It is tempting because encryption often protects classified data, and would be correct in a question about selecting controls for a specific data category.
- ✗
Firewall rules
Why it's wrong here
Firewall rules control network traffic, not the labelling of data by sensitivity, so they cannot define classification tiers, handling or retention rules. They are tempting because firewalls enforce access control, and would be the right answer in a question about network segmentation or perimeter security design.
- ✓
Classification labels
Why this is correct
Classification labels are the tangible tags (such as Public, Internal, Confidential) applied to data assets. Without defined labels, a classification policy cannot be enforced or communicated, making them a core structural component of the policy.
- ✓
Data custodian responsibilities
Why this is correct
Data custodian responsibilities assign the operational duties — storage, backup, access enforcement — for classified data. A policy naming sensitivity tiers but not who safeguards them is unenforceable, so custodian duties are an essential component.
- ✗
Backup schedules
Why it's wrong here
Backup schedules define recovery point and recovery time objectives, not data sensitivity tiers or handling rules, so they cannot satisfy a classification policy's labelling and protection requirements. It is tempting because backups are a genuine security control, and scheduling them correctly would be the right answer to a question about business continuity or disaster recovery planning.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.