CISSP Asset Security Practice Question
A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Determining the data's classification and ensuring it is labeled appropriately
The data owner is accountable for data classification and assigning protection requirements, while the custodian implements controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Determining the data's classification and ensuring it is labeled appropriately
Why this is correct
The data owner holds ultimate accountability for the data, making them responsible for determining its classification level, such as "confidential," based on its business value, sensitivity, and regulatory compliance requirements. This classification dictates the necessary security controls and handling procedures. Furthermore, the data owner ensures that the data is appropriately labeled to communicate its sensitivity to all users and systems, thereby guiding its protection throughout its lifecycle.
- ✗
Ensuring the data is accurate and complete
Why it's wrong here
Ensuring the data's accuracy, completeness, and overall quality falls primarily under the purview of the data steward. The data steward is responsible for defining and enforcing data quality standards, resolving data discrepancies, and maintaining data integrity throughout its lifecycle. While important for data utility, this function is distinct from the data owner's strategic responsibility for classification and risk acceptance.
- ✗
Implementing technical controls to protect the data
Why it's wrong here
Implementing technical controls to protect the data, such as encryption, access controls, and intrusion detection systems, is the specific responsibility of the data custodian. The data custodian, often an IT department or security team, translates the data owner's classification and the data steward's policies into tangible security measures. Their role is operational, focusing on the secure storage, processing, and transmission of data according to established guidelines.
- ✗
Performing daily backups of the data
Why it's wrong here
Performing daily backups of the data is a critical operational task executed by the data custodian to ensure data availability and recoverability in the event of loss or corruption. This activity is a specific technical control implemented to protect the data's integrity and availability, aligning directly with the custodian's duties. It is a practical application of security policy, not the strategic classification decision made by the data owner.
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
Key term
Data owner
A senior-level person who is accountable for the classification, protection, and appropriate use of a specific set of data within an organization.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.