CRISC Question 394

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  Maintain and review the classified data inventory this step is important for monitoring and managing classified data, but it comes after the classification policy is in place. Without a classification policy, you wouldn't know how to organize or prioritize the data inventory

• Chose B2

  B. Maintain and review the classified data inventory. The FIRST step in managing the risk associated with the leakage of confidential data is to "B. Maintain and review the classified data inventory." This involves identifying and categorizing the types of confidential data that the organization handles. By maintaining an up-to-date inventory of classified data, the organization gains a clear understanding of what types of data need protection and the potential risks associated with their leakage. This inventory serves as a foundation for subsequent risk assessment and mitigation efforts. While the other options (conducting an awareness program, implementing mandatory encryption, defining and implementing a data classification policy) are important steps as well, they should come after establishing a clear understanding of the data that needs protection through the maintenance and review of a classified data inventory.

• 1

  There are automated controls to protect against data leakage. i guess systems cant be trained but can implement controls based on data classification policy. I go with D.