A Security Analyst Is Classifying Data Based on Input from Data

question 295

Multiple Choice

A security analyst is classifying data based on input from data owners and other stakeholders. The analyst has identified three data types: Financially sensitive data Project data Sensitive project data The analyst proposes that the data be protected in two major groups, with further access control separating the financially sensitive data from the sensitive project data. The normal project data will be stored in a separate, less secure location. Some stakeholders are concerned about the recommended approach and insist that commingling data from different sensitive projects would leave them vulnerable to industrial espionage. Which of the following is the BEST course of action for the analyst to recommend?

• A) Conduct a quantitative evaluation of the risks associated with commingling the data and reject or accept the concerns raised by the stakeholders.
• B) Meet with the affected stakeholders and determine which security controls would be sufficient to address the newly raised risks.
• C) Use qualitative methods to determine aggregate risk scores for each project and use the derived scores to more finely segregate the data.
• D) Increase the number of available data storage devices to provide enough capacity for physical separation of non-sensitive project data.

---

Definitions:

Law

In a general sense, law refers to the system of rules that are created and enforced through social or governmental institutions to regulate behavior, ensuring order and justice.

Supply

The total amount of a good or service available for purchase at any given price level in a given market.

Excess Demand

A situation where the demand for a good or service surpasses its supply at the current price, often leading to price increases.

Quantity Demanded

The total amount of a good or service that consumers are willing and able to purchase at a given price within a certain time period.