Question

Difficulty: MediumData Governance, Classification, and Privacy Controls

A financial software company is formalizing its data governance roles to align with security frameworks and compliance standards. The security steering committee must separate technical operational management from executive business governance. Which of the following responsibilities fall directly under the role of the Data Custodian? (Select TWO.)

  1. Applying technical access controls, database encryption baselines, and regular backup operationsAnswer
  2. B
    Determining formal sensitivity classification levels and approving user access requests for corporate datasets
  3. Maintaining storage infrastructure integrity by executing routine system patching and backup restoration testingAnswer
  4. D
    Establishing business data retention requirements and defining legal compliance rules for customer records

Answer

The duties belonging to the Data Custodian are implementing technical security controls (such as encryption, access lists, and backups) and maintaining the operational health and integrity of storage repositories (such as executing patches and restoration tests).
The Data Custodian is responsible for the technical administration, operational safeguarding, and hands-on maintenance of data systems. This includes applying technical controls like access control lists, maintaining encryption at rest, running routine backups, applying software patches, and regularly testing data restoration procedures.

Step-by-Step Solution

1
Differentiate between Data Owner accountability and Data Custodian operational duties
Recognized that Data Owners decide business policy, classification, and access rights, whereas Data Custodians execute hands-on technical management.
CompTIA Security+ distinguishes between the business authority (Owner) and the technical maintainer (Custodian).
2
Evaluate options for technical hands-on execution vs policy creation
Selected options involving technical controls implementation, backup operations, and storage system maintenance.
Technical configuration, backup maintenance, and storage patching directly fulfill the operational mandate of a custodian.

Key Concept

Data Role Separation (Data Owner vs. Data Custodian)
Estimated Time:1m 30s
Rate this question