CISSP Asset Security Practice Question
A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data custodian
The data custodian is responsible for the day-to-day management and security of data, including implementing controls, backups, and access management, on behalf of the data owner.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data steward
Why it's wrong here
A data steward is primarily concerned with the quality, integrity, and usability of data within specific domains. Their role involves defining data standards, ensuring data accuracy, managing metadata, and resolving data inconsistencies, which are crucial for data governance but distinct from the hands-on implementation of security controls. While they contribute to overall data protection by ensuring data reliability, they do not typically perform the operational security tasks of a DBA.
- ✗
Data owner
Why it's wrong here
The data owner, often a senior manager or business unit head, holds ultimate accountability for the protection and classification of specific data assets. They are responsible for determining the data's sensitivity, approving access policies, and ensuring compliance with regulations, but they delegate the operational tasks of implementing and maintaining security controls to others. Their role is strategic and accountability-focused, not tactical or hands-on in system administration.
- ✓
Data custodian
Why this is correct
The data custodian, such as a Database Administrator (DBA), is responsible for the practical implementation and maintenance of security controls and data management tasks. They perform day-to-day operations like backups, access control enforcement, patching, and monitoring, ensuring the data's confidentiality, integrity, and availability as directed by the data owner. This role involves the technical execution of policies and procedures to safeguard the data assets.
- ✗
Data processor
Why it's wrong here
A data processor, as defined by regulations like GDPR, is typically a third-party entity or organization that processes personal data on behalf of a data controller (or data owner). Their role involves handling data according to the controller's instructions, often under a contractual agreement. A DBA, being an internal employee directly managing an organization's databases, operates within the organization's control and is not considered a separate 'data processor' in this regulatory context, even though they technically 'process' data.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Data custodian
A data custodian is the person or team responsible for the safe handling, storage, and transport of data on behalf of the data owner.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.