Agree with comments above. Answer should be B. SSO is the wrong answer.

Answer should be B. Even if internal users use SSO, they should not have access to those data By default if it is restricted for them.

B. Governs all other options and its enforced. Research suggests: CISA Review Manual, 27th Edition, page 2301 CISA Review Questions, Answers & Explanations Database - 12 Month Subscription2 but I have no access to this material to confirm.

B. Enforce an internal data access policy: This is directly relevant to controlling access to confidential information. Enforcing an internal data access policy ensures that only authorized personnel have access to sensitive information, based on their role and need-to-know basis. This policy would include mechanisms like access controls, user authentication, and authorization levels, which are essential to safeguard confidential data.

B. Enforce an internal data access policy Enforcing an internal data access policy is crucial in controlling who can access what information within a business application system. This policy should define the roles and responsibilities of users, specify what data they are allowed to access based on their role, and establish protocols for granting, reviewing, and revoking access rights. Such a policy is central to maintaining the confidentiality of information by ensuring that only authorized individuals have access to sensitive data.

B. Enforce an internal data access policy Enforcing an internal data access policy is crucial for controlling who has access to confidential information and under what circumstances. This policy should define roles, responsibilities, and permissions for different users or groups within the organization. It should specify what data can be accessed, by whom, and for what purposes. This approach ensures that only authorized personnel have access to sensitive information, reducing the risk of unauthorized retrieval.

It should be B

Confidential information stored in a business application system is typically protected through the implementation and enforcement of a robust data access policy. This policy outlines who has access to what data under what circumstances, thereby preventing unauthorized retrieval of confidential information.

Segregation of duties is a security control that divides the responsibilities for processing and accessing confidential information among different individuals. This makes it more difficult for unauthorized individuals to gain access to confidential information.

More inclined to go with A. Segregation of Duties is preventative in nature. Access Policy, assuming administrative, would be more deterrent in nature.

Should be B

Both implementing segregation of duties and enforcing an internal data access policy are appropriate measures to prevent unauthorized retrieval of confidential information stored in a business application system, but implementing segregation of duties is generally considered the more effective control.

Should be D

B is the only answer that inherently provides confidentiality

Defintely access control policy.

Enforce an internal data access policy

I also stand by Answer B: Enforce internal data classification Single Sign-on does not satisfy the protection of data as it just allows a single point of sign-on with authorization to access applications.