The correct answer is C. Agree on data classification labels with stakeholders.
Before moving proprietary company data to a public cloud storage service, the organization must first determine how the data should be classified. Data classification identifies the sensitivity, ownership, regulatory requirements, and handling requirements of the data. Examples of classification labels may include public, internal, confidential, restricted, private, regulated, or proprietary.
This aligns with CompTIA Security+ SY0-701 concepts related to protecting data, cloud security considerations, and governance. A security engineer cannot properly evaluate cloud risks, encryption needs, access controls, retention rules, compliance requirements, or contractual protections until the organization agrees on what type of data is being moved and how sensitive it is.
Why the other options are incorrect:
A. Create an architecture diagram of cloud storage solutions.
This is useful later, but it should not be the first step. The architecture depends on the data classification and security requirements.
B. Migrate sample data to the cloud to run security tests.
This is premature and risky. Data should not be moved to the cloud before classification, risk analysis, access control requirements, and compliance requirements are understood.
D. Make a backup of the data on cloud-neutral storage.
Backups are important, but they do not address the first security concern: understanding the sensitivity and handling requirements of the proprietary data.
Therefore, the best first action is to agree on data classification labels with stakeholders.
