A telecom company classifies customer call-transcript data used to train and prompt its AI systems as highly sensitive. Which data-security practice best reflects appropriate governance at a business-decision level?
Select an answer to reveal the explanation.
Short Explanation
Sensitive data needs a label and a guest list, not a blank check. Classify the call-transcript data by sensitivity and restrict AI access to only the roles with an approved need, and you've made exactly the kind of business-level call a leader should make — no encryption algorithm required.
Full Explanation
Classifying data by sensitivity and restricting AI system access to only the roles and teams with an approved need is a business-level governance decision that matches the level of judgment a non-technical leader is expected to exercise — it addresses who can access sensitive data and why, without prescribing how the technology enforces it. Directing the technical team to use a specific encryption algorithm goes beyond a business decision into technical implementation, which is explicitly outside the scope of what this exam and this role require. Storing data indefinitely for possible future use increases the amount of sensitive data at risk without any defined, approved need, which runs counter to sound data governance. Opening access to any employee with a company email account "for ease of use" undermines the sensitivity classification altogether by ignoring the need-to-know principle. The general principle: sound data governance ties access to classification and defined need, and stays at the level of policy decisions rather than technical configuration.