What is the purpose of classifying media in terms of data handling?

• A. It determines the encryption for all data.
• B. It determines who may access the media based on the owner's discretion.
• C. It determines the sensitivity of the data contained on the media.
• D. It determines the color of the media.

Answer: (C)

Classifying media by data handling focuses on tagging the data on the media with its level of sensitivity so you know what protections are required. That label guides the security controls you apply: who can access the media, how it should be stored and transmitted, whether encryption or additional safeguards are needed, how long it must be retained, and how it must be disposed of. In PCI contexts, media that contains payment card data is considered highly sensitive, so it requires stronger protections than less sensitive data.

Encryption for all data isn’t the goal of classification; encryption decisions should be driven by the data’s sensitivity, not applied universally. Access based on the owner’s discretion isn’t how access controls are set in practice—permissions are policy and role-based, not unilateral. The color of the media has no security impact.