CompTIA CySA+ (CS0-001) — Question 245

A cybersecurity analyst has identified a new mission-essential function that utilizes a public cloud-based system. The analyst needs to classify the information processed by the system with respect to CIA. Which of the following should provide the CIA classification for the information?

Answer options

• A. The cloud provider
• B. The data owner
• C. The cybersecurity analyst
• D. The system administrator

Correct answer: B

Explanation

The data owner is ultimately responsible for the classification of data, as they understand the sensitivity and importance of the information being processed. The cloud provider may offer tools and services, but they do not determine how the data should be classified. The cybersecurity analyst can assist in the process, but they do not own the data. The system administrator manages the system but does not classify the information.