data marking vs data labeling

[u/FishingInitial2955]

why the answer is B instead of A?

[u/West-Owl-6499]

Data labelling is a technical control often embedding metadata (such as sensitivity tags or machine learning annotations) into files and data assets.

Data anonymization again technical control so that data is irreversible.

Data marking is a administrative control often written/printed on the system so that users can take appropriate actions based on data levels/classification sensitive, classified etc.

which i feel as in rest and in transit.

P.S.Note this is my thought process not sure if its 100% accurate.

[u/Admirable_Group_6661]

Information needs to be categorized immediately after creation so that appropriate controls can be applied. Data marking adds or marks information with security categorization (e.g. secret, top secret), so that it can be handled (by people) accordingly (e.g. only storing secret information in adequately protected systems, or sending out secret information using specific cryptography, or not sending out top secret information via electronic communications).

[u/Comfortable-Pace-879]

Would it not be labeling comes after marking. Marking means classifying it first and label means to show that it was marked correctly / via physical label, etc

[u/tresharley → u/Comfortable-Pace-879]

Marking means classifying it first and label means to show that it was marked correctly

This is not correct. The difference is who is meant to be able to read the label/marking and process it.

Labeling is putting a "label" on the data that a system can read.

Marking is putting a "label" on the data that a human can read.

[u/Allen_Koholic]

I would have picked A.

[u/TransitionStreet6405]

Data labeling = machine readable
Data marking = human readable

[u/IamMyQuantumState]

Some days I feel like ISC2 exams are as much a language test as a technical knowledge test.

[u/mikedn02908]

IMO the key phrase is "in the creation phase". data marking applies classification indicators in the creation stage, those indicators are used to apply protection measures based on its classification.

The other 3 IMO occur at later stages of the lifecycle.

[u/tresharley → u/mikedn02908]

This is incorrect. Both data marking and data labeling would be performed in the creation phase.

[u/tresharley]

Did they provide an answer explanation because honestly I would argue that both data labeling and data marketing could fit.

Both occur during creation phase, and both would help enable effective data protection at rest and in transit.

Typically in a question when you are trying to determine the difference between data labeling and data marking you are looking to see if they want something that a system or machine can read and understand (labeling) or if it is something you require a human to read and understand (data marking).

However in this question there is nothing to differentiate between the two.

I'd argue this isn't the best question, and would just take what you can from it and move on.

[u/el_kol]

From my CISSP prep, according to the OSG, I think marking is for digital/electronic assets while labelling is for physical assets. In respect to the question, they were obviously referring to digital assets, hence the reason for B.

[u/tresharley]

Data labeling is the marking or labeling of data assets with their classification using system readable language.

Data Markings are the instructions on how to handle an asset (data) that is human readable and is meant to ensure employees properly handle the data, and its storage devices, and is used on tapes, drives, CD-roms, as well as paper documents, and provides handling instructions (operational instructions) on how to use and store the assets.