I85PREP
⌘ K
CCDL1 study materials
CCDL1 study resources

CCDL1 practice questions

One question at a time. Build your CCDL1 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Data Governance and Frameworks

Under a data governance framework, which artifact defines the rules that specify acceptable values, formats, and constraints for a data element?

  1. Business glossary term
  2. Data quality rule Correct answer.
  3. Data retention schedule
  4. Data domain charter

Explanation

A data quality rule encodes the concrete constraints a data element must satisfy, such as allowed value ranges, mandatory formats, or referential conditions. Governance frameworks rely on these rules to make quality measurable and auditable. A glossary term defines meaning, not validation logic.

Question 2Data Governance and Frameworks

A governance council needs to establish who is accountable for the accuracy of customer master data. Which role assignment accomplishes this?

  1. Name a data owner accountable for the domain Correct answer.
  2. Record the domain in the enterprise architecture repository
  3. Assign a data steward for remediation tasks
  4. Delegate to the IT operations team

Explanation

Accountability in a governance framework sits with a named data owner who is answerable for a data domain's definition, quality, and appropriate use. Stewards typically execute day-to-day controls under that owner. Recording a domain in an architecture tool documents it but assigns no accountability.

Question 3Data Governance and Frameworks

Which statement best describes the purpose of a data governance operating model?

  1. It records the results of the latest data quality audit
  2. It specifies the physical schema of the data warehouse
  3. It lists the software licenses used across the enterprise
  4. It defines how decisions, roles, and processes are organized to govern data Correct answer.

Explanation

An operating model describes the structure through which governance happens: decision rights, roles, forums, and processes. It answers how and by whom data decisions get made. Schemas, licenses, and audit results are artifacts governed by that model rather than the model itself.

Question 4Data Governance and Frameworks

A retail bank wants to classify data so that protection controls scale with sensitivity. Which classification dimension should drive control selection?

  1. The age of the source system
  2. The business criticality and sensitivity level Correct answer.
  3. The number of downstream reports
  4. The volume of records stored

Explanation

Data classification frameworks assign sensitivity and criticality levels, and controls such as encryption or access review are then applied according to those levels. Volume, system age, and report counts may influence effort but do not define the protection tier.

Question 5Data Governance and Frameworks

In a governance framework, what is the primary function of a business glossary?

  1. Providing agreed business definitions for shared data terms Correct answer.
  2. Storing the lineage of transformation jobs
  3. Enforcing referential integrity in source systems
  4. Automating the deletion of expired records

Explanation

A business glossary captures approved definitions, synonyms, and context so that business and technical stakeholders interpret terms consistently. It is a semantic reference, not an enforcement or automation tool. Lineage and retention are handled by other governance artifacts.

Question 6Data Governance and Frameworks

A governance team must show regulators the full path of a reported figure back to its source systems. Which governance capability provides this?

  1. Data lineage Correct answer.
  2. Data archiving
  3. Data masking
  4. Data virtualization

Explanation

Data lineage records the origin and transformation path of data across systems, enabling traceability from a report back to source. Regulators increasingly expect this evidence as part of data governance. Masking, archiving, and virtualization address protection, retention, and access respectively.

Question 7Data Governance and Frameworks

Which document formally authorizes a data governance program and defines its scope, mandate, and executive sponsorship?

  1. Data dictionary
  2. Issue log
  3. Governance charter Correct answer.
  4. Quality scorecard

Explanation

A governance charter is the founding document that establishes the program's mandate, scope, decision rights, and sponsorship. It gives the program authority to enforce policies. A dictionary, issue log, or scorecard supports operations but confers no mandate.

Question 8Data Governance and Frameworks

A company must retain transaction records for seven years and then dispose of them. Which governance artifact formalizes this requirement?

  1. Conceptual data model
  2. Data retention policy Correct answer.
  3. Access control matrix
  4. Data quality rule

Explanation

A retention policy specifies how long each data category must be kept and the conditions for lawful disposal. It translates legal and business requirements into governed lifecycle rules. The other artifacts address validity, access, or structure.

Question 9Data Governance and Frameworks

A data owner is deciding whether a new analytics use case may process customer location data. Which governance mechanism should record the decision and its rationale?

  1. A data quality dashboard refresh
  2. A data use approval record Correct answer.
  3. A backup restoration test
  4. A schema migration script

Explanation

Data use approvals document the purpose, conditions, and decision for a specific use of data, creating an auditable record of governance judgment. This is central to frameworks that require purpose limitation and accountability. Dashboards, migration scripts, and restore tests are operational artifacts.

Question 10Data Governance and Frameworks

Two departments report different monthly revenue figures because each applies its own definition of 'active customer'. Which governance action most directly resolves the conflict?

  1. Archive historical revenue data
  2. Increase the frequency of data loads
  3. Add more validation rules to the source system
  4. Publish an approved definition in the business glossary and align reports to it Correct answer.

Explanation

Conflicting figures caused by divergent definitions are resolved by agreeing a single approved definition and binding reporting to it. This is a semantic governance fix rather than a technical one. Load frequency, source validation, and archiving do not reconcile meaning.

Question 11Data Governance and Frameworks

A governance council has limited authority and wants domain teams to make data decisions within agreed guardrails. Which operating model fits best?

  1. Outsourced
  2. Centralized
  3. Federated Correct answer.
  4. Ad hoc

Explanation

A federated model distributes decision-making to domain teams while a central function sets standards and guardrails. It balances local responsiveness with enterprise consistency. Centralized models concentrate decisions, ad hoc models lack structure, and outsourcing transfers execution rather than governance design.

Question 12Data Governance and Frameworks

A data steward discovers that a critical attribute has 12 percent missing values. According to typical governance practice, what should happen first?

  1. Change the quality threshold to accept the current rate
  2. Delete the affected records
  3. Exclude the attribute from all reports
  4. Log the issue and assign remediation to the accountable owner Correct answer.

Explanation

Governance frameworks route quality defects through an issue management process that records the problem, assigns ownership, and tracks remediation. Silently changing thresholds or deleting data undermines the control environment. The accountable owner decides the appropriate fix.

Question 13Data Governance and Frameworks

An organization must demonstrate that access to sensitive customer data is granted on business need. Which control most directly provides this evidence?

  1. Annual penetration testing
  2. Daily incremental backups
  3. Periodic access recertification by data owners Correct answer.
  4. Automated index rebuilding

Explanation

Access recertification requires accountable owners to review and confirm entitlements, producing evidence that access remains justified. It is a core governance control for least privilege. Testing, backups, and indexing address security assurance, recovery, and performance respectively.

Question 14Data Governance and Frameworks

A new regulation requires that personal data be deleted on request. Which governance response is most appropriate?

  1. Add a quality rule for email formatting
  2. Amend the retention policy and update lineage to locate all copies Correct answer.
  3. Reclassify all data as public
  4. Increase storage capacity for personal data

Explanation

Honoring deletion requests requires a policy change plus the ability to locate every copy of the data, which lineage and cataloging provide. Together they make deletion feasible and demonstrable. Capacity, formatting rules, and misclassification do not enable compliance.

Question 15Data Governance and Frameworks

A data owner wants to confirm that a proposed machine learning model uses data only for approved purposes. Which governance artifact is most relevant?

  1. The conceptual entity relationship diagram
  2. The capacity planning forecast
  3. The approved data use record and associated conditions Correct answer.
  4. The disaster recovery runbook

Explanation

Approved use records capture the permitted purposes and conditions attached to data, so a reviewer can compare the model's intent against them. Purpose limitation is a foundational governance principle. Diagrams, runbooks, and forecasts say nothing about permissible use.

Question 16Data Governance and Frameworks

A governance lead is designing decision rights and notices that the same person approves data policy and performs the quality checks. Which principle is being violated?

  1. Timeliness
  2. Separation of duties Correct answer.
  3. Interoperability
  4. Data minimization

Explanation

Separation of duties prevents one individual from both setting a control and independently verifying compliance with it. Combining policy approval and quality assurance removes an important check. Minimization, timeliness, and interoperability concern data scope, freshness, and exchange.

Question 17Data Governance and Frameworks

An enterprise wants a single inventory describing what data exists, where it resides, who owns it, and how sensitive it is. Which capability delivers this?

  1. A version control system
  2. A load balancer
  3. A data catalog Correct answer.
  4. A message queue

Explanation

A data catalog provides a searchable inventory of data assets with metadata such as location, ownership, classification, and quality indicators. It is a foundational enabler of governance transparency. The other options are infrastructure components with no metadata inventory role.

Question 18Data Governance and Frameworks

A global firm must reconcile conflicting privacy requirements across jurisdictions while maintaining one governance standard. What is the most sound approach?

  1. Apply the least restrictive requirement everywhere to reduce effort
  2. Apply the strictest applicable requirement as the baseline and document local exceptions Correct answer.
  3. Suspend processing in all regions until rules converge
  4. Let each region set entirely independent rules with no central oversight

Explanation

A common governance pattern sets a baseline that satisfies the most demanding obligation and then documents justified local variations. This preserves enterprise consistency while respecting legal differences. The alternatives either weaken protection, fragment control, or halt operations unnecessarily.

Question 19Data Governance and Frameworks

A governance team wants to measure whether its program is effective over time. Which set of indicators is most appropriate?

  1. Number of servers provisioned and network latency
  2. Count of employees and office locations
  3. Data quality scores, issue closure rates, and policy compliance rates Correct answer.
  4. Volume of marketing emails sent

Explanation

Effective governance measurement combines quality outcomes, the speed of resolving issues, and adherence to policy. These indicators reflect whether controls work and decisions get executed. Infrastructure, headcount, and marketing metrics do not measure governance performance.

Question 20Data Governance and Frameworks

A data domain charter states that the domain owner may approve new data consumers but the council approves cross-domain sharing. A request spans two domains. Who decides?

  1. The requesting analyst's manager
  2. The governance council, because the request crosses domains Correct answer.
  3. The database administrator hosting the data
  4. Each domain owner independently

Explanation

Decision rights defined in the charter allocate cross-domain sharing decisions to the council. Applying the stated rules rather than improvising is the essence of a governed decision process. Individual owners, line managers, and administrators lack that authority.

Question 21Data Governance and Frameworks

A firm discovers that a vendor receives personal data under a contract that does not restrict onward transfer. Which governance gap is most directly implicated?

  1. Inadequate index maintenance
  2. Insufficient network bandwidth
  3. Incomplete entity relationship modeling
  4. Missing third-party data handling obligations Correct answer.

Explanation

Third-party governance requires contracts to impose handling, transfer, and protection obligations on vendors processing data on the firm's behalf. An absent onward-transfer restriction is a contractual control gap. The other items are technical concerns unrelated to vendor obligations.

Question 22Data Governance and Frameworks

An organization adopts a policy that every data element must have exactly one accountable owner. A legacy system contains a field used by three business units. What is the correct governance resolution?

  1. Assign one accountable owner and document the other units as stakeholders Correct answer.
  2. Assign ownership to the unit that created the field historically
  3. Leave the field unowned because usage is shared
  4. Assign joint accountability to all three units equally

Explanation

Single-accountability models require one named owner even when use is shared; other consumers are recorded as stakeholders with input but not accountability. Historical origin or joint accountability would diffuse responsibility. Unowned elements violate the policy outright.

Question 23Data Governance and Frameworks

A regulator asks why a metric changed sharply between quarters. The firm can trace the calculation but not the source data version used. Which governance weakness does this reveal?

  1. Excessive data classification levels
  2. Overly frequent access reviews
  3. Insufficient glossary synonyms
  4. Incomplete lineage capture at the source-to-report boundary Correct answer.

Explanation

Reproducing a reported figure requires lineage that records not only transformations but also the specific source data versions consumed. A gap at the source boundary prevents defensible explanation of changes. Classification, access reviews, and glossary synonyms do not affect reproducibility.

Question 24Data Governance and Frameworks

A governance council must prioritize remediation across domains with limited budget. Which approach best aligns with risk-based governance?

  1. Address only issues raised by senior executives
  2. Rank issues by regulatory exposure and business impact on critical data Correct answer.
  3. Remediate domains alphabetically to ensure fairness
  4. Fix the oldest issues first regardless of impact

Explanation

Risk-based governance directs finite resources to issues with the greatest regulatory and business consequence, especially on critical data elements. Age, alphabetical order, and seniority of the reporter are not risk measures. This prioritization is defensible to auditors and stakeholders.

Question 25Data Governance and Frameworks

A firm wants assurance that its data governance controls operate as designed throughout the year, not just at a point in time. Which mechanism provides this?

  1. A single management self-attestation
  2. Continuous control monitoring with periodic independent testing Correct answer.
  3. An annual employee survey
  4. A one-time external audit

Explanation

Continuous monitoring detects control failures as they occur, while periodic independent testing validates that monitoring itself is reliable. Together they give ongoing assurance. Point-in-time audits, surveys, and lone self-attestations provide weaker and less timely evidence.

Question 26Data Governance and Frameworks

Which artifact defines the roles, decision rights, and escalation paths that govern how data-related decisions are made across an organization?

  1. A data retention schedule
  2. A disaster recovery plan
  3. A data governance operating model Correct answer.
  4. A data quality scorecard

Explanation

An operating model specifies who decides what, at which level, and how disputes escalate, which is the structural core of a governance program. Retention schedules, quality scorecards, and recovery plans are downstream artifacts that operate within that structure rather than defining decision rights.

Question 27Data Governance and Frameworks

An organization wants its governance principles to be durable while detailed rules change with technology and regulation. Which design choice best achieves this?

  1. Freeze all governance documents for a fixed multi-year review cycle
  2. Replace principles with vendor-supplied configuration baselines
  3. Publish high-level principles and maintain tiered standards and procedures beneath them Correct answer.
  4. Delegate all policy authorship to individual project teams

Explanation

A tiered hierarchy lets stable principles anchor lower-level standards and procedures that can be revised quickly as conditions change. Freezing documents, fragmenting authorship, or outsourcing policy to vendor baselines sacrifices either durability or adaptability.

Question 28Data Governance and Frameworks

A data governance program needs a metric that reveals whether stewardship responsibilities are actually being carried out, not merely assigned. Which measure is most fit for that purpose?

  1. Percentage of stewardship tasks completed on schedule Correct answer.
  2. Percentage of critical data elements with a named steward
  3. Number of governance meetings held per quarter
  4. Total number of policies published in the repository

Explanation

Completion of assigned stewardship tasks provides evidence of activity, whereas naming a steward only evidences assignment. Policy counts and meeting counts are activity proxies that can rise without any improvement in stewardship behavior.

Question 29Data Governance and Frameworks

A data governance framework separates the accountability for a data domain from the hands-on curation of its data elements. Which pairing correctly reflects that separation?

  1. Data custodian accountable for the domain; data owner responsible for curation
  2. Data owner accountable for the domain; data custodian responsible for curation
  3. Data steward accountable for the domain; data owner responsible for curation
  4. Data owner accountable for the domain; data steward responsible for curation Correct answer.

Explanation

In the conventional split, the data owner holds accountability for a domain and its decisions, while stewards carry out the day-to-day curation and quality work. Custodians typically handle technical storage and access controls rather than domain accountability.

Question 30Data Governance and Frameworks

A multinational applies a single global data classification scheme, but one jurisdiction forbids exporting certain categories outside its borders. Which governance response best preserves both the global standard and local legal compliance?

  1. Abandon the global scheme and let each country define classification independently
  2. Keep the global scheme as the baseline and add jurisdiction-specific handling rules as a documented local overlay Correct answer.
  3. Classify all data in the restricted jurisdiction as the highest tier to avoid further analysis
  4. Apply the global scheme uniformly and treat the export restriction as an operational inconvenience

Explanation

A baseline-plus-overlay model keeps comparability across the enterprise while allowing binding local requirements to tighten handling where necessary. Abandoning the standard or ignoring the restriction both create either inconsistency or legal exposure, and blanket over-classification destroys the scheme's usefulness.

Question 31Data Classification and Inventory

Which artifact is the authoritative record that defines a data element's name, definition, allowed values, and owning steward within a data catalog?

  1. A network topology diagram
  2. A firewall rule set
  3. A business glossary entry Correct answer.
  4. A backup retention schedule

Explanation

A business glossary entry is the controlled definition artifact that captures a data element's meaning, permitted values, and accountability. It is the reference other classification and inventory artifacts point to when resolving terminology conflicts.

Question 32Data Classification and Inventory

An organization wants to know which systems hold personal data before designing controls. Which inventory practice most directly answers that question?

  1. Reviewing the change management ticket backlog
  2. Running a penetration test against external-facing web servers
  3. Drafting an incident response communications plan
  4. Building a data asset inventory that records where each data category resides Correct answer.

Explanation

A data asset inventory maps data categories to the systems, stores, and processes that hold them, which is exactly the prerequisite for scoping controls. Penetration testing and change review operate on infrastructure and process state, not on data location.

Question 33Data Classification and Inventory

What distinguishes a data classification scheme from a data categorization scheme?

  1. Classification assigns sensitivity levels by impact; categorization groups data by type or subject Correct answer.
  2. Classification is performed by auditors; categorization is performed by system owners
  3. Classification is optional guidance; categorization is a legal mandate in every jurisdiction
  4. Classification is applied only to structured data; categorization applies only to unstructured data

Explanation

Classification ranks data by the harm that disclosure, alteration, or loss would cause, driving control strength. Categorization is descriptive grouping, such as by data subject type or business process, and does not itself set a sensitivity level.

Question 34Data Classification and Inventory

A privacy team needs a record of processing activities that lists purposes, categories of data subjects, and recipients for each processing operation. Which inventory artifact best fits?

  1. An asset depreciation ledger
  2. A service level agreement catalog
  3. A records of processing activities register Correct answer.
  4. A configuration management database

Explanation

A records of processing activities register is purpose-built to capture processing purposes, data subject categories, recipients, and retention for each operation. It is a distinct governance artifact from technical inventories such as a configuration management database.

Question 35Data Classification and Inventory

Which element is essential for a data element to be considered properly registered in a metadata repository?

  1. A screenshot of the source application screen
  2. A copy of the production data sample
  3. An approval email from the vendor
  4. A unique identifier plus a defined owner and definition Correct answer.

Explanation

Registration requires unambiguous identity and accountability, meaning a unique identifier, an assigned owner, and a documented definition. Supporting evidence such as screenshots or samples may be attached but cannot substitute for those core attributes.

Question 36Data Classification and Inventory

During discovery, an analyst finds a column named CUST_REF holding opaque 12-character alphanumeric values. What is the most defensible next step before assigning a classification?

  1. Classify it as public because the values are not human readable
  2. Trace the value to its source system and confirm its meaning with the owning team Correct answer.
  3. Delete the column to eliminate uncertainty
  4. Assign the highest sensitivity level by default and close the record

Explanation

Opaque identifiers must be resolved to a known meaning and source before sensitivity can be judged, because a reference key may point to highly sensitive records. Confirming semantics with the accountable owner prevents both over- and under-classification.

Question 37Data Classification and Inventory

An inventory records that a marketing analytics table is derived from customer order records. Which inventory attribute does this relationship document?

  1. Data residency
  2. Data lineage Correct answer.
  3. Data quality score
  4. Data retention

Explanation

Lineage records the origin and transformation path of data from source to derived asset. It supports impact analysis when a source is reclassified, corrected, or deleted.

Question 38Data Classification and Inventory

A company must demonstrate that a specific dataset is stored and processed only within a given country. Which inventory attribute directly evidences this?

  1. Data refresh frequency recorded per asset
  2. Data residency location recorded per asset Correct answer.
  3. Data volume recorded per asset
  4. Data steward name recorded per asset

Explanation

Residency metadata records the geographic or jurisdictional placement of storage and processing, which is the evidence needed for location-based obligations. Steward, volume, and refresh cadence say nothing about where data resides.

Question 39Data Classification and Inventory

What is the primary purpose of assigning a data owner distinct from a data custodian in an inventory?

  1. The owner writes code while the custodian approves releases
  2. The owner performs backups while the custodian approves retention periods
  3. The owner is accountable for classification decisions while the custodian implements and operates controls Correct answer.
  4. The owner audits the custodian's budget while the custodian approves vendors

Explanation

Accountability and execution are separated so that classification and access decisions rest with the business owner, while technical safeguards are implemented by the custodian. This separation prevents operations staff from unilaterally changing sensitivity levels.

Question 40Data Classification and Inventory

An automated scanner flags a column as containing government identification numbers with high confidence, but the source team confirms the field stores randomly generated test values. What should the inventory record reflect?

  1. The scanner result alone, because automated detection outranks human input
  2. The confirmed business meaning, with the scanner finding retained as supporting evidence and a note explaining the discrepancy Correct answer.
  3. A public classification, because the values are synthetic in this environment
  4. No record at all, because the finding was disputed

Explanation

Inventory records should reflect validated business meaning, with tooling output preserved as evidence and the resolution documented. This keeps the inventory trustworthy and creates an audit trail for future scans.

Question 41Data Classification and Inventory

Which practice best keeps a data inventory accurate as new systems are deployed?

  1. Gating production release on submission of an inventory record for new data stores Correct answer.
  2. Relying on the classification team to monitor network traffic
  3. Collecting inventory data once per year through a manual survey
  4. Asking vendors to self-report their customers' data holdings

Explanation

Embedding inventory registration into the release process makes the record a byproduct of normal delivery, which keeps it current. Periodic surveys and passive monitoring inevitably lag behind actual system changes.

Question 42Data Classification and Inventory

A dataset contains only aggregated counts of transactions by region with no small cells. How should the classification decision treat this relative to the underlying transaction records?

  1. It must carry the identical classification because it was derived from sensitive records
  2. It may warrant a lower sensitivity level because re-identification risk is reduced, subject to documented small-cell thresholds Correct answer.
  3. It must be classified public because no individual records are present
  4. It must be classified at the highest level because aggregation is inherently reversible

Explanation

Aggregation can reduce re-identification risk, so a lower level may be justified when small-cell and differencing risks are controlled and documented. Derivation alone does not force identical classification, but the reduction must be reasoned and recorded.

Question 43Data Classification and Inventory

Which control most effectively prevents unapproved changes to sensitivity labels in a mature data catalog?

  1. Open edit access for all analysts to encourage accuracy
  2. Quarterly full reclassification of every asset
  3. Storing labels only in local spreadsheets owned by each team
  4. Role-based edit rights with an approval workflow and change logging Correct answer.

Explanation

Restricting label changes to authorized roles, requiring approval, and logging every change preserves integrity and provides accountability. Open editing or distributed spreadsheets remove both control and a reliable audit trail.

Question 44Data Classification and Inventory

A team proposes classifying data by the department that created it, such as finance data or HR data. What is the main weakness of this approach?

  1. It requires too many classification levels to be practical
  2. It cannot be applied to unstructured data
  3. It conflicts with the requirement to record a data owner
  4. It does not express the harm from disclosure, so controls cannot be scaled to sensitivity Correct answer.

Explanation

Department-based labeling describes origin rather than impact, so two datasets from the same department with very different harm profiles receive identical treatment. A sensitivity scheme must express the consequence of compromise to drive proportionate controls.

Question 45Data Classification and Inventory

What is the role of a retention schedule within a data inventory?

  1. It defines the encryption algorithm for each column
  2. It defines which users may query each table
  3. It defines how long each data category must be kept and when disposition occurs Correct answer.
  4. It defines the backup window for each server

Explanation

A retention schedule ties each data category to a minimum and maximum retention period and a disposition trigger. Linking it to inventory records lets organizations prove deletion obligations are met.

Question 46Data Classification and Inventory

An analyst must classify a new dataset quickly. Which combination of inputs gives the most reliable first-pass sensitivity rating?

  1. The team's headcount combined with the project budget
  2. The dataset's file size combined with its creation date
  3. Data element definitions from the glossary combined with confirmed lineage from source systems Correct answer.
  4. The number of columns combined with the database vendor

Explanation

Glossary definitions supply the semantic meaning of each element, and lineage confirms which sensitive sources flow into the dataset. Together they support a defensible rating before manual review.

Question 47Data Classification and Inventory

A regulator asks for evidence that personal data was deleted after its retention period. Which inventory capability provides that evidence?

  1. A summary of change tickets raised against the asset
  2. A list of all users with read access to the asset
  3. A copy of the schema definition at creation time
  4. Disposition records linked to inventory assets and retention rules Correct answer.

Explanation

Evidence of deletion requires a disposition record that ties a specific asset to its retention rule and the date disposal occurred. Access lists, schemas, and change tickets document other properties and cannot prove deletion.

Question 48Data Classification and Inventory

Two business units define "customer" differently in their systems. What inventory action resolves the conflict while preserving traceability?

  1. Delete both local definitions and impose one without documentation
  2. Record both definitions as separate unrelated terms with no mapping
  3. Create a glossary term with an approved canonical definition and map each local variant to it Correct answer.
  4. Merge the two systems into one database

Explanation

A canonical glossary term with explicit mappings to local variants establishes shared meaning while preserving each system's context. Undocumented imposition or unmapped duplicates leaves the ambiguity in place.

Question 49Data Classification and Inventory

A discovery scan identifies what appears to be a credential embedded in a configuration table. Which inventory and classification response is most appropriate?

  1. Classify the table as public because configuration tables are generally non-sensitive
  2. Record the credential value verbatim in the inventory description for reference
  3. Record it as a high-sensitivity secret, restrict access, and trigger remediation while preserving the finding in the inventory Correct answer.
  4. Ignore the finding because secrets are outside the scope of data classification

Explanation

Embedded credentials are among the most sensitive items an organization holds, so they warrant the highest handling and prompt remediation. The inventory should record the finding's existence and location without duplicating the secret itself.

Question 50Data Classification and Inventory

An organization operates in multiple jurisdictions with differing breach notification thresholds. How should the classification scheme account for this?

  1. Use the strictest jurisdiction's rules everywhere and discard the others
  2. Define jurisdiction-specific categories that map onto the core sensitivity levels without replacing them Correct answer.
  3. Rely on the legal team to classify datasets case by case at incident time
  4. Create a separate unrelated classification scheme for each jurisdiction

Explanation

Jurisdictional categories layered onto a stable core scheme let the organization express local obligations while keeping a single consistent sensitivity model. Replacing the core scheme per jurisdiction fragments reporting and comparison.