CompTIA Security+ SY0-701 · Free study guide

Objective 3.3 — Select strategies that protect data throughout its lifecycle

Data protection begins with knowing what exists, why it is needed, where it moves, who uses it, and when it should be removed. Classification communicates handling expectations. Labels such as public, private, confidential, sensitive, restricted, or critical only help when definitions and required controls are documented.

Data types drive obligations and impact. Regulated records, financial data, legal material, trade secrets, intellectual property, and operational secrets may need different retention, sharing, integrity, and monitoring rules. Human-readable data is not the only concern: machine-readable tokens or identifiers can still enable access or linkage.

Protect each state

Data at rest resides on storage, backups, endpoints, and databases. Data in transit crosses a connection. Data in use is processed in memory or by an authorized application. Full-disk encryption helps a stolen powered-off device; TLS protects a connection; neither prevents an overprivileged application from reading data in use.

Encryption preserves confidentiality when keys remain protected. Hashing supports integrity comparison, not secrecy. Masking changes what a viewer sees. Tokenization replaces a sensitive value with a reference backed by a controlled mapping. Obfuscation raises interpretation cost but should not be treated as strong cryptography. Segmentation and permission restrictions limit which subjects and systems can reach the data.

Location and sovereignty

Geolocation describes where data or processing resides. Sovereignty means data can be subject to rules associated with a jurisdiction. Geographic restrictions may constrain storage, replication, support access, or processing. A region label alone is not evidence that every backup, log, administrator, or vendor stays within the approved boundary.

Use minimization before adding controls: do not collect or release fields with no approved purpose. Then layer identity, least privilege, encryption, monitoring, and lifecycle rules. Maintain an inventory and lineage so teams can find copies when permissions, retention, or deletion obligations change.

Consider an analytics partner that needs cohort results but not customer contact data. Remove unused identifiers, replace the internal linkage key with a release-specific token, encrypt the transfer and stored copy, restrict a named role, constrain the approved region, log access, and set an expiry. Each measure handles a different failure mode.

Decision rule: classify the data, identify state and location, minimize the set, then choose layered controls with an owned key, access, monitoring, and deletion lifecycle.