A senior engineer reviews the classification plan and notices that every internal-facing use case has been marked low risk by default. What is wrong with this approach?
Select an answer to reveal the explanation.
Short Explanation
You can't call every internal tool low risk by default. An internal system touching sensitive HR or financial data can be just as risky as a customer-facing one.
Full Explanation
Blanket-assigning a tier based on audience alone substitutes a single assumption for the actual classification dimensions, ignoring impact, regulation, data sensitivity, automation level, user population, and the fact that internal tools can vary widely in risk.
The option saying internal-facing tools should always be excluded from the governance inventory entirely is wrong because internal-facing status does not exempt a use case from inventory registration.
The option saying low risk is not a valid classification tier and should never be used is wrong because low risk is legitimate when it reflects genuine assessment, not a default label.
The option saying only externally facing use cases can legally be classified at all is wrong because classification requirements apply to internal and external use cases alike.
For the exam, flag any classification shortcut that skips the actual dimensions as a governance gap.