nerdexam
CompTIA

SY0-501 · Question #499

Ann is the IS manager for several new systems in which the classifications of the systems' data are being decided. She is trying to determine the sensitivity level of the data being processed. Which…

The correct answer is D. Owner. To determine the sensitivity level and classification of data, the IS manager should consult the data owner, who holds ultimate accountability for the data's protection and usage.

Submitted by satoshi_tk· Mar 4, 2026Security program management and oversight

Question

Ann is the IS manager for several new systems in which the classifications of the systems' data are being decided. She is trying to determine the sensitivity level of the data being processed. Which of the following people should she consult to determine the data classification?

Options

  • ASteward
  • BCustodian
  • CUser
  • DOwner

How the community answered

(41 responses)
  • A
    5% (2)
  • B
    7% (3)
  • C
    17% (7)
  • D
    71% (29)

Why each option

To determine the sensitivity level and classification of data, the IS manager should consult the data owner, who holds ultimate accountability for the data's protection and usage.

ASteward

A data steward is typically responsible for data quality, standards, and governance, acting on behalf of the owner, but does not hold the ultimate accountability for initial classification decisions.

BCustodian

A data custodian is responsible for the technical safeguarding and maintenance of data, such as backups and system security, but does not define its sensitivity or classification level.

CUser

A user interacts with the data, but generally lacks the comprehensive organizational view, authority, or accountability required to officially determine its classification and sensitivity.

DOwnerCorrect

The data owner is the individual or entity ultimately accountable for the data, including its classification, protection, and compliance throughout its lifecycle. They are responsible for defining the appropriate classification and protection requirements for the data they own, making them the authoritative source for determining its sensitivity.

Concept tested: Data ownership and classification responsibilities

Source: https://learn.microsoft.com/en-us/training/modules/govern-identity-access-data-privacy-security-operations/3-data-protection

Topics

#data owner#data classification#data governance#roles and responsibilities

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice