A cloud architect is documenting the secure data lifecycle for a new workload. During which phase are controls such as encryption, tokenisation, and data classification labelling first applied to newly generated records?
- AThe Create phase, when the data first comes into existence or is significantly modified Correct
- BThe Store phase, when records are committed to persistent storage such as object or block volumes
- CThe Use phase, when applications and users read and process the data in memory
- DThe Share phase, when the data is exchanged with external parties or other systems
Why A is correct: Create is where data originates or is materially changed, so classification and the resulting protective controls must be set here to govern every later phase.
Why B is wrong: Storage-layer protections do apply during Store, but classification and protective controls are decided at creation; treating Store as the first point leaves data unprotected in transit to storage.
Why C is wrong: Use is tempting because protections are exercised when data is accessed, but applying classification only at Use ignores data created and stored beforehand.
Why D is wrong: Share requires controls like rights management, but it is late in the lifecycle; deferring classification to Share leaves earlier phases ungoverned.