Exam CGEIT topic 1 question 270 discussion

C. A mandate for periodic employee training on how to classify corporate data files

Before implementing the change to use cloud-based file storage for non-sensitive corporate data, the data management policy should include a requirement to scan approved cloud-based apps for inappropriate content (Option B). This helps ensure that the data stored in the cloud remains compliant with the organization's policies and standards. While all the options may be important considerations, scanning approved cloud-based apps for inappropriate content is particularly relevant in the context of maintaining data integrity, security, and compliance. This helps prevent the storage of inappropriate or sensitive content in the cloud, which could pose legal, security, or reputational risks to the organization.

This question is tricky and is asking - Before this change is implemented, what should be included in the data management policy? So regardless of data goes to cloud what needs to happen prior to that, so the answer given seems right.

C makes more sense for the question asked. Employees need to have good understanding where to store what.

C makes sense to me because based on the training provided, employees will classify corporate data, leading to the non-sensitive files being given access for storage on the cloud. D does not make sense based on the question asked.