Which of the following is the best reason an organization should enforce a data classification policy to help protect its most sensitive information?

Question

Options

• AEnd users will be required to consider the classification of data that can be used in documents.
• BThe policy will result in the creation of access levels for each level of classification.
• CThe organization will have the ability to create security requirements based on classification
• DSecurity analysts will be able to see the classification of data within a document before opening it.

• A
  8% (1)
• B
  8% (1)
• C
  85% (11)

Explanation

Enforcing a data classification policy gives organizations a structured framework to apply appropriate security controls - such as encryption, access restrictions, and handling procedures - based on how sensitive the data is, which is the core purpose of classification.

Why the distractors fall short:

• A describes a side effect (user awareness), not a strategic security reason - end users considering classification is a behavior outcome, not the policy's primary value.
• B gets causality backwards: access levels may follow from classification, but creating access tiers is not the reason to enforce the policy itself.
• D describes a metadata/labeling feature (like document headers), which is a minor operational benefit, not the fundamental reason to enforce classification.

Memory tip: Think of data classification as the foundation of a security architecture - you can't apply the right protection until you know what you're protecting and how much it matters. C is correct because it captures this "classification → tailored security requirements" logic, which is the whole point of the policy.

No community discussion yet for this question.