Examkin

Question

Difficulty: Very hardData Governance, Classification, and Privacy Controls

An enterprise cloud migration team is establishing governance policies for a newly migrated database containing sensitive customer information. During an internal compliance review, auditors discover that while automated backup scripts and database encryption are operational, no formal data retention schedules or sensitivity tiers have been defined for the dataset. The database administrator indicates they only manage infrastructure security safeguards, database schema settings, and daily backups. Which of the following roles is explicitly responsible for assigning the data classification label and approving retention policies for this information asset?

  1. Data ownerAnswer
  2. B
    Data custodian
  3. C
    Security administrator responsible for managing technical preventive controls
  4. D
    Identity manager responsible for user authentication and access verification

Answer

Data owner
The data owner is typically a senior business manager or executive accountable for the overall governance, sensitivity classification, retention rules, and protection policies of an asset. While technical personnel implement controls, the data owner specifies what requirements those controls must satisfy.

Step-by-Step Solution

1
Analyze the operational problem presented in the scenario.
Technical controls (encryption, backups) are functioning, but business governance controls (data classification, retention schedules) are missing.
Governance rules dictate how technical controls must be configured to comply with legal and organizational requirements.
2
Distinguish between technical implementation roles and business accountability roles.
The database administrator is acting as a data custodian focused on hands-on technical management.
Custodians implement security controls and maintain data structure, whereas governance authority resides higher in the business hierarchy.
3
Identify the role accountable for data classification and retention approval.
The data owner has ultimate business accountability for defining sensitivity levels, retention periods, and privacy compliance guidelines.
According to CompTIA Security+ data governance frameworks, data ownership carries the responsibility to categorize information assets and dictate how data custodians must handle them.

Key Concept

Data Roles and Responsibilities (Data Owner vs. Data Custodian)
Estimated Time:2m 0s
Rate this question

Topics

Data Governance, Classification, and Privacy Controls

More questions from this topic