An organization has an initiative to implement database encryption to strengthen privacy controls. Which of the following is the MOST useful information for prioritizing database selection?

Question

Options

• ADatabase administration audit logs
• BHistorical security incidents
• CPenetration test results
• DAsset classification scheme

• A
  8% (3)
• B
  15% (6)
• C
  5% (2)
• D
  73% (29)

Explanation

An asset classification scheme categorizes databases by the sensitivity of the data they hold (e.g., public, internal, confidential, restricted). This directly identifies which databases contain the most sensitive personal data and therefore represent the highest privacy risk if compromised-making it the most logical starting point for prioritizing encryption efforts. Databases classified at the highest sensitivity level should be encrypted first. Database administration audit logs (A) track who accessed data but do not indicate sensitivity. Historical security incidents (B) show past breaches but may not reflect current risk levels. Penetration test results (C) reveal technical vulnerabilities but do not rank databases by the value or sensitivity of the data they protect.

No community discussion yet for this question.