A database administrator and the manager of the business unit that uses a customer data set disagree about who may grant access to it. According to sound governance, who should decide the access rules?
Select an answer to reveal the explanation.
Short Explanation
The owner of the car decides who gets the keys; the valet just parks it. Same here: the business manager who owns the data sets the access rules, and the database administrator carries them out. If you hand the decision to whoever holds the admin rights, you've confused technical access with authority, and that's the trap.
Full Explanation
Governance separates the authority to decide how information is protected from the responsibility to operate the controls. The data owner, usually a business manager accountable for the data and the processes that use it, determines its classification and who should have access, because the owner understands its business value and the consequences of misuse. The custodian, in this case the database administrator, implements and maintains those decisions technically, including granting and revoking access as the owner directs. Giving the decision to the database administrator confuses technical capability with business authority and leaves access rules without business accountability. The security manager sets standards and advises on appropriate protections, but deciding access to a specific data set belongs to its owner; the security role supports and monitors the decision rather than making it. The IT director is accountable for the infrastructure, not for the business purposes the data serves, so making that role the decision maker repeats the custodian error at a higher level. Exam caveat: the owner may delegate day-to-day approval, but accountability stays with the owner. Operational check: confirm that the data inventory lists a named business owner and that access requests for the data set route to that owner for approval.