Examkin

Question

Difficulty: MediumData Governance, Classification, and Privacy Controls

An online travel reservation platform is updating its data governance framework to comply with international privacy mandates. The database administration team is responsible for configuring encryption at rest, managing daily database backups, and maintaining schema performance for stored customer passport records. However, executive management must formally designate the individual accountable for determining the data classification tier, defining regulatory retention periods, and authorizing access rights to this sensitive dataset. Which of the following roles is directly responsible for establishing these governance policies?

  1. A
    Data custodian
  2. Data ownerAnswer
  3. C
    Security control assessor
  4. D
    System administrator

Answer

The data owner is the role responsible for establishing classification levels, determining retention periods, and approving access authorization policies for the dataset.
The data owner is the business entity or manager directly accountable for a specific dataset. They determine data classification tiers, specify retention requirements according to business and legal needs, and authorize who should be granted access permissions. Technical roles enforce these directives once established.

Step-by-Step Solution

1
Analyze the operational responsibilities described in the scenario
The scenario distinguishes between technical management (configuring encryption, managing backups, maintaining schemas) and policy governance (classifying data, setting retention policies, approving access).
CompTIA Security+ objectives separate technical implementation roles from business governance and accountability roles.
2
Evaluate the role accountable for policy-level data decisions
The data owner (often a department head or business unit manager) holds ultimate accountability for the data asset, including determining classification levels, defining lifecycle policies, and granting access.
Data owners understand the business impact and legal requirements of the specific dataset they oversee.
3
Differentiate the data owner from technical custodians and administrative roles
Data custodians handle technical execution and day-to-day operational protection of data as instructed by the data owner.
Confusing technical execution with business accountability is a common operational misconception in security governance.

Key Concept

Data owner vs. Data custodian roles and governance responsibilities
Estimated Time:1m 15s
Rate this question

Topics

Data Governance, Classification, and Privacy Controls

More questions from this topic