Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
If you read the question carefully it say mitigate the risk of "CONFIDENTIAL" data. This means already data classification is already done. So it RBAC controls which can mitigate the risk.
If you read the question carefully it say mitigate the risk of "CONFIDENTIAL" data. This means already data classification is already done. So it RBAC controls which can mitigate the risk.
B. Implement role-based access controls. The most effective way to mitigate the risk of confidential data leakage to unauthorized stakeholders is to implement role-based access controls (RBAC). RBAC ensures that access to information is based on the user's role within the organization, limiting access rights for individuals to only what is necessary to perform their jobs. This approach directly addresses the risk of data leakage by preventing unauthorized access to sensitive information and thus reducing the likelihood that confidential data will be accessed by those without the proper authority. (Option A) is important for identifying which data is confidential and requires protection, it doesn't inherently restrict access to that data. (Option C) is a basic security measure but does not consider the varying levels of access needed based on an individual's role. (Option D) is critical for educating employees about the importance of data security but does not provide a systematic, enforceable method of controlling access to data like RBAC does.
Option A is not right. Creating a data classification policy is essential for categorizing and identifying sensitive data, but it doesn't prevent data leakage on its own.