Examkin

Question

Difficulty: HardData Governance, Classification, and Privacy Controls

An e-commerce enterprise is updating its security governance framework to ensure compliance with international data protection regulations. During an internal audit, the security manager discovers that database administrators (DBAs) are currently responsible for setting data sensitivity classification tags, defining retention periods, and approving access permissions for customer profile databases. Which of the following actions should the organization take to align with data governance best practices?

  1. Reassign data classification authority and access approval decisions to business leaders acting as data owners, while retaining DBAs as data custodians responsible for technical controls.Answer
  2. B
    Formally designate the database administrators as data owners so that operational staff with direct database access retain exclusive control over classification schemas and authorization policies.
  3. C
    Deploy an inline database firewall to dynamically assign classification tags based on query traffic, replacing administrative role definitions with automated detective controls.
  4. D
    Mandate multifactor authentication for database entry points, as identity verification mechanisms automatically establish data classification levels and access governance.

Answer

The organization should reassign data classification authority and access approval decisions to business leaders acting as data owners, while retaining DBAs as data custodians responsible for technical controls.
In enterprise security governance, data owners are business unit leaders or managers accountable for the data, defining its classification tier, setting retention policies, and approving access permissions. Data custodians (such as database administrators or system engineers) carry out technical implementation tasks, maintaining hardware, configuring database permissions, and running backups in accordance with the data owner's policies. Reassigning classification and authorization authority to business leaders restores proper separation of duties and administrative accountability.

Step-by-Step Solution

1
Analyze the existing deficiency in the organizational data governance framework.
Identified that DBAs (technical personnel) are performing business governance functions like defining data sensitivity labels and approving access requests.
Technical personnel should manage infrastructure implementation, whereas business leadership understands data value and regulatory context.
2
Differentiate between the roles of Data Owner and Data Custodian.
The Data Owner is accountable for data classification, governance policy, retention rules, and access approval. The Data Custodian is responsible for technical execution (maintaining databases, applying access control lists, running backups).
Separation of duties ensures business accountability drives security policy while technical teams enforce technical safeguards.
3
Select the governance remediation action that aligns responsibilities correctly.
Transfer classification authority to business unit leaders (Data Owners) and maintain DBAs as technical implementers (Data Custodians).
This establishes clear accountability and ensures compliance with standard Security+ data governance frameworks.

Key Concept

Data Owner vs. Data Custodian Responsibilities
Estimated Time:1m 30s
Rate this question

Topics

Data Governance, Classification, and Privacy Controls

More questions from this topic