Data Classification and Handling

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Data Classification and Handling

Key Takeaways Explain This Topic AI

Classification assigns value and sensitivity so the organization can match controls to risk, not the reverse.

Handling rules must cover labeling, storage, transmission, access, sharing, retention, and disposal across every copy.

The data owner sets classification and acceptable risk; the data custodian operates the technical controls.

Security+ scenarios reward the least restrictive control that still meets the data owner's stated requirement.

Classification follows the data: exports, screenshots, backups, and reports inherit the source's sensitivity.

Last updated: June 2026

Why Classification Comes First

Data protection on the CompTIA Security+ SY0-701 exam starts with knowing what data you hold, where it lives, who owns it, and what happens if it is disclosed, altered, or destroyed. Data classification is the process of assigning each data set a sensitivity label so the organization can apply proportionate controls. You never pick a control first and then find data for it; you classify, then select the cheapest control that still meets the owner's requirement. Objective 3.3 expects you to recognize this mapping in word problems.

Classification considers three impacts mapped to the CIA triad : confidentiality (who may see it), integrity (how bad is unauthorized change), and availability (cost of an outage). A public price sheet has near-zero confidentiality impact but real integrity impact, because a tampered price could cost revenue. That nuance is exactly what a tricky exam stem tests.

Common Classification Schemes

Labels vary by sector. Security+ uses two patterns and asks you to match sensitivity to handling, not memorize one taxonomy.

• Commercial label Government label Typical handling controls
• Public Unclassified Approved release process, integrity review
• Internal / Private Controlled Unclassified (CUI) Access control, no public posting
• Confidential Confidential Encryption, limited sharing, DLP monitoring
• Restricted / Critical Secret / Top Secret Need-to-know, strong encryption, audit logging, strict retention

Data may also be tagged by type : regulated (PCI cardholder data, PHI under HIPAA), intellectual property/trade secret, legal (privileged), financial, or human-readable PII. A record can carry several tags at once, and the strictest applicable rule wins.

A practical exam tactic: scan the stem for the most sensitive element in a data set. A spreadsheet of mostly internal numbers that also contains one column of Social Security numbers must be handled at the highest applicable level — the regulated PII column drags the whole file up to confidential or restricted. Aggregation can raise sensitivity too: individually harmless fields (name, ZIP code, date of birth) become high-risk PII when combined, because they enable re-identification.

Roles and Responsibilities

Security+ separates accountability (cannot be delegated) from responsibility (operational, can be delegated). Confusing these is a frequent trap.

Role Responsibility

Data owner Senior/business role; accountable for classification, access rules, retention, and acceptable residual risk

• Data controller Determines why and how personal data is processed (a privacy/regulatory term)
• Data processor Processes data on the controller's behalf under contract (e.g., a SaaS vendor)
• Data custodian Implements and operates storage, backup, encryption, and ACLs
• Data steward Maintains data quality, metadata, and labeling consistency
• User Handles data per policy and reports suspected exposure
• Labeling, Sovereignty, and Geolocation

Labeling (visual markings, file metadata tags, or document headers) lets both humans and automated tools such as DLP enforce handling. Data sovereignty means data is subject to the laws of the country where it physically resides; data residency/geolocation requirements force data to stay in a defined region. A scenario that says "EU customer records must remain on EU servers" is testing sovereignty, not encryption.

Handling Controls by Activity

• Activity Control examples
• Creation Default labels, approved repositories, templates
• Storage Encryption at rest, ACLs, tokenization, database permissions
• Transmission TLS, SFTP, IPsec VPN, secure email gateway
• Use Least privilege, masking, screen privacy filters, logging
• Sharing Owner approval, NDA/DUA, expiring links
• Disposal Secure erase, shredding, crypto-shredding, certificate of destruction
• Worked Scenario

A product team exports support cases to a spreadsheet holding names, emails, notes, and partial account IDs. Even though the source ticketing system is protected, the export is a new copy of confidential data and must be reclassified, stored in an approved workspace, restricted to the project team, given a retention/expiration date, and securely deleted when analysis ends. Better still: export only needed columns and mask identifiers ( data minimization applied at the handling layer).

Common Exam Traps

"It is only a copy, so it is not sensitive" — copies inherit the source's classification.

"The IT admin decides classification" — the data owner decides; IT (custodian) implements.

"Encrypt everything and you are done" — encryption is one control; access, retention, and sharing still apply.

"Public data needs no protection" — public data still needs integrity and an approved release path.

Quick Drill

Published brochure → public.

Employee phone directory → internal.

Customer contract with pricing → confidential.

Encryption private-key backup → restricted.

Draft earnings before release → restricted (material non-public information).

Data States Drive Handling Too

Every handling decision also depends on the data's state, a theme that recurs across this chapter. Data at rest (stored on disk, in a database, or on a backup) needs encryption and access control; data in transit (moving across a network) needs TLS or a VPN tunnel; data in use (loaded into memory during processing) needs runtime protections. When a stem describes a laptop being lost, it is testing the at-rest control; when it describes traffic captured on public Wi-Fi, it is testing the in-transit control. Tie the recommended control back to the state the scenario describes and you will avoid mismatched answers.