nerdexam
Isaca

CRISC · Question #542

Which of the following is the GREATEST risk associated with inappropriate classification of data?

The correct answer is D. Users having unauthorized access to data. The greatest risk associated with inappropriate data classification is users gaining unauthorized access to sensitive information, as security controls are often aligned with data criticality.

Submitted by tom_us· Apr 18, 2026IT Risk Assessment

Question

Which of the following is the GREATEST risk associated with inappropriate classification of data?

Options

  • AInaccurate record management data
  • BInaccurate recovery time objectives (RTOs)
  • CLack of accountability for data ownership
  • DUsers having unauthorized access to data

How the community answered

(30 responses)
  • A
    10% (3)
  • B
    3% (1)
  • C
    3% (1)
  • D
    83% (25)

Why each option

The greatest risk associated with inappropriate data classification is users gaining unauthorized access to sensitive information, as security controls are often aligned with data criticality.

AInaccurate record management data

Inaccurate record management data is a symptom of poor data governance, not the greatest risk directly stemming from inappropriate classification itself.

BInaccurate recovery time objectives (RTOs)

Recovery Time Objectives (RTOs) relate to data availability and recovery, which are distinct from data classification's primary impact on confidentiality and access.

CLack of accountability for data ownership

Data ownership and accountability are crucial for data governance, but inappropriate classification directly impacts who can access the data, which is a more immediate and significant risk.

DUsers having unauthorized access to dataCorrect

Data classification dictates the level of protection a dataset receives; if data is misclassified (e.g., as less sensitive than it is), it may be protected with insufficient controls, allowing unauthorized users to access information they should not see, leading to confidentiality breaches.

Concept tested: Risks of improper data classification

Topics

#Data Classification#Access Control#Information Security Risk#Confidentiality

Community Discussion

No community discussion yet for this question.

Full CRISC Practice