CSA Exam CCZT Topic 4 Question 15 Discussion

Actual exam question for CSA's CCZT exam

Question #: 15
Topic #: 4

[All CCZT Questions]

What should an organization's data and asset classification be based on?

ALocation of data

BHistory of data

CSensitivity of data

DRecovery of data
Data and asset classification should be based on the sensitivity of data, which is the degree to which the data requires protection from unauthorized access, modification, or disclosure. Data sensitivity is determined by the potential impact of data loss, theft, or corruption on the organization, its customers, and its partners. Data sensitivity can also be influenced by legal, regulatory, and contractual obligations.
Reference=
Certificate of Competence in Zero Trust (CCZT) prepkit, page 10, section 2.1.1
Identify and protect sensitive business data with Zero Trust, section 1
Secure data with Zero Trust, section 1
SP 800-207, Zero Trust Architecture, page 9, section 3.2.1

Show Suggested Answer

Suggested Answer: C

Proper risk management should be a key component of any ZT project, especially during implementation and adjustments, because it helps to identify, analyze, evaluate, and treat the potential risks that may affect the ZT and ZTA objectives and outcomes. Proper risk management also helps to prioritize the ZT and ZTA activities and resources based on the risk level and impact, and to monitor and review the risk mitigation strategies and actions.

Reference=Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance,Zero Trust Training (ZTT) - Module 9: Risk Management

by Leslee at May 09, 2024, 07:29 PM

Limited Time Offer

25%

Off

Get Premium CCZT Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Mozell

12 days ago

Wait, is 'location of data' even an option? That's like classifying files based on whether they're stored in the cloud or on-premises. Sensitivity is where it's at, folks.

upvoted 0 times

...

Curt

16 days ago

History of data? Really? That doesn't seem relevant at all for determining how to classify and protect it. C is the obvious choice here.

upvoted 0 times

...

Wynell

23 days ago

Haha, recovery of data? What, are we supposed to base our security on how easy it is to restore the information? Nah, sensitivity is clearly the way to go.

upvoted 0 times

...

2 months ago

The sensitivity of the data is definitely the most important factor for data classification. It makes sense to prioritize protecting the most sensitive information.

upvoted 0 times