CISA Question 100

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  C. Have IT security staff conduct targeted training for data owners (Correct) Why it's correct: Data owners are officially accountable for determining and assigning data classification levels; targeted training equips them with the exact skills and criteria required to fix recurring misclassification errors. Example: IT security leading a specialized workshop for departmental managers on how to correctly tag restricted financial records versus internal memos.

• Chose B4

  When data is often classified incorrectly, relying solely on awareness, training, or policy publication may not be enough, especially in a small organization that might have limited resources or expertise. Automatic document classification uses technology (such as data loss prevention tools or content scanners) to analyze the actual content of documents and classify them accordingly. This approach: Reduces human error, Ensures consistency in classification, Helps enforce classification policies more effectively. Why not the others? A. Conduct awareness presentations and seminars for information classification policies ➤ Important, but human error and misunderstanding may still persist without automated support. C. Have IT security staff conduct targeted training for data owners ➤ Useful but may not fully resolve the problem if the process is inherently error-prone. D. Publish the data classification policy on the corporate web portal ➤ Passive communication; unlikely to change behavior on its own.

• Chose C1

  classification = data owners