Determine How to Classify Data CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm is implementing a new data classification policy. The policy requires that every data asset have a designated owner who is responsible for assigning the initial classification and reviewing it annually. The firm has many data assets, and the IT department is already overloaded. What is the best way to assign ownership?

   • AAssign the IT department as the owner for all data assets because they manage the infrastructure.
   • BAssign business unit managers as data owners for the data their teams create and use, with IT acting as stewards.
   • CUse an automated tool to assign ownership based on file access patterns, with no human review.
   • DLet the compliance team own all data assets because they understand regulatory requirements.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization is planning to implement data classification and needs to inventory all data assets. They have data in on-premises file servers, cloud storage, and SaaS applications like Salesforce. What is the best way to discover data across these diverse environments?

   • AManually document all data assets by interviewing department heads.
   • BUse a single data discovery tool that has connectors for on-premises, cloud, and SaaS environments.
   • CFocus only on on-premises data because it is more critical than cloud data.
   • DUse a cloud access security broker (CASB) that can discover data in SaaS applications and cloud storage, and a separate tool for on-premises file servers.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization has a large volume of unstructured data in shared drives and email. They need to classify this data to identify sensitive information such as credit card numbers and social security numbers. The volume is too large for manual review. What is the most effective approach?

   • AClassify all unstructured data as 'Confidential' by default to ensure nothing is missed.
   • BHire temporary staff to manually review and classify all files.
   • CUse a data classification tool that uses pattern matching and machine learning to automatically detect and label sensitive data.
   • DUse a database scanning tool to find sensitive data in the unstructured files.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company is updating its data classification policy to align with a new cybersecurity framework that requires data to be classified based on the impact of a breach. The current scheme uses four levels: Public, Internal, Confidential, and Restricted. The company also has contractual obligations with clients that require certain data to be labeled as 'Client Confidential'. How should the company reconcile these requirements?

   • AUse 'Restricted' for all client data to ensure the highest level of protection.
   • BReplace the existing four-level scheme with a new scheme that includes 'Client Confidential' as a separate level.
   • CCreate a separate classification scheme for client data and a different one for internal data.
   • DMap 'Client Confidential' to the existing 'Confidential' level and add a metadata tag for the client contract.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is starting a cyber resiliency program and wants to ensure that data is protected according to its value and sensitivity. The CISO has asked the governance team to define a data classification framework. What is the primary purpose of data classification in this context?

   • ATo reduce storage costs by identifying and deleting redundant data.
   • BTo assign a monetary value to each data asset for insurance purposes.
   • CTo categorize data based on its sensitivity and criticality, enabling appropriate security controls and access restrictions.
   • DTo satisfy external auditors by having a documented classification policy.
   Reveal Solution Discussion Select an answer first