Examkin

Question

Difficulty: HardData Governance, Classification, and Privacy Controls

A multinational logistics enterprise is restructuring its security operations to satisfy data governance requirements. During an internal security management review, the audit team observes that database administrators (DBAs) are currently determining data sensitivity labels, authorizing access permissions, and establishing data retention schedules for supply chain relational databases. Executive leadership mandates that operational technical management must be separated from business data accountability. Which of the following structural adjustments best aligns with standard data governance role definitions?

  1. Designate business department heads as Data Owners accountable for establishing classification tiers and retention policies, while DBAs act as Data Custodians responsible for implementing technical controls and maintaining data integrity.Answer
  2. B
    Designate DBAs as Data Owners to centralize technical schema oversight, while appointing business department heads as Data Custodians responsible for performing routine database backup operations.
  3. C
    Designate DBAs to perform user authentication checks, while delegating data access authorization governance to third-party data processors during routine system operations.
  4. D
    Reclassify all DBA technical permissions as administrative deterrent controls to automate data classification decisions within SIEM incident response playbooks.

Answer

Designate business department heads as Data Owners accountable for establishing classification tiers and retention policies, while DBAs act as Data Custodians responsible for implementing technical controls and maintaining data integrity.
The correct option properly distinguishes between business accountability and technical execution. The Data Owner is typically a business executive or manager who understands the business value of the data, determines sensitivity labels, defines access constraints, and sets retention requirements. The Data Custodian is a technical role (such as a DBA or system administrator) responsible for implementing technical controls, managing storage systems, maintaining backups, and enforcing the access rules defined by the Data Owner.

Step-by-Step Solution

1
Analyze the organizational issue described in the scenario.
Database administrators (technical staff) are improperly exercising authority over business-level decision-making, such as classification and retention policy creation.
Effective data governance requires separation of duties between business decision-making and technical execution.
2
Evaluate data governance role definitions according to security management frameworks.
Data Owners hold ultimate business accountability for data classification, privacy requirements, and lifecycle rules. Data Custodians handle technical implementation, system administration, storage, and security control enforcement.
Matching administrative oversight to business leadership and technical implementation to DBAs satisfies standard governance models.
3
Select the option that correctly separates business accountability from technical administration.
Assigning business department heads as Data Owners and DBAs as Data Custodians properly aligns roles.
This structure ensures business aligned control over data sensitivity while leaving hands-on technical management to IT specialists.

Key Concept

Data Governance Roles (Data Owner vs. Data Custodian)
Rate this question

Topics

Data Governance, Classification, and Privacy Controls

More questions from this topic