CISSP Asset Security — 10 Questions

Question 1

A financial institution is implementing a data retention policy to comply with regulatory requirements. The policy must ensure that transaction records are retained for 7 years and then securely destroyed. Which of the following is the BEST approach to implement this policy?

Accepted Answer

Automatically purge records using a data management tool that overwrites data after the retention period. Option B is correct because automated purging using a data management tool that overwrites data ensures that the records are securely destroyed at the end of the retention period, meeting both regulatory compliance and data sanitization requirements. Overwriting (e.g., using DoD 5220.22-M or NIST SP 800-88 standards) prevents data recovery by replacing the storage media's bits with patterns, making it a reliable method for secure destruction in a financial institution's automated environment.

Answer

Encrypt all records and destroy the encryption keys after 7 years

Answer

Move records to a separate archive and delete the directory pointers

Answer

Manually review and delete records after 7 years

Question 2

During a security audit, it is discovered that a company's data classification labels are inconsistently applied across different departments. Which of the following is the BEST long-term solution to ensure consistent data classification?

Accepted Answer

Implement automated data classification tools that apply labels based on content and context. Automated data classification tools use content inspection (e.g., regex patterns, keyword matching) and contextual analysis (e.g., file location, creator, metadata) to consistently apply labels across the enterprise. This eliminates human error and variability between departments, ensuring uniform enforcement of the classification policy without relying on manual interpretation or periodic training.

Answer

Conduct annual retraining on data classification policies

Answer

Adopt a single classification level for all data to eliminate confusion

Answer

Assign a data owner in each department to manually review and classify data

Question 3

An organization wants to protect sensitive data stored on laptops. Which of the following is the MOST effective control to prevent data loss if a laptop is stolen?

Accepted Answer

Full-disk encryption (FDE). Full-disk encryption (FDE) renders the data on the laptop unreadable without the decryption key, even if the storage drive is removed and analyzed. This is the most effective preventive control against data loss from theft because it protects data at rest regardless of physical access to the device.

Answer

BIOS password

Answer

Asset tracking software

Answer

Remote wipe capability

Question 4

A healthcare organization is moving patient records to a cloud storage service. Which of the following is the MOST important requirement to ensure data security and compliance with HIPAA?

Accepted Answer

A signed Business Associate Agreement (BAA) with the cloud provider. Under HIPAA, a covered entity must have a signed Business Associate Agreement (BAA) with any cloud service provider that creates, receives, maintains, or transmits protected health information (PHI). Without a BAA, the provider is not contractually bound to safeguard PHI, making the organization non-compliant regardless of technical controls. While encryption and MFA are important security measures, they cannot substitute for the legal and regulatory requirement of a BAA.

Answer

Multi-factor authentication for all cloud access

Answer

Encryption of data in transit using TLS 1.2

Answer

Encryption of data at rest using AES-256

Question 5

A company is decommissioning a data center and needs to dispose of hard drives that contained highly confidential financial data. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Shredding the drives into small pieces. Shredding the drives into small pieces physically destroys the platters, making data recovery impossible regardless of the storage technology (e.g., HDD vs. SSD). This method provides the highest assurance because it eliminates any possibility of reading residual magnetic or solid-state data, even with advanced forensic tools like electron microscopy.

Answer

Overwriting the drives with multiple passes of random data

Answer

Degaussing the drives

Answer

Overwriting the drives with a single pass of zeros

Question 6

Which TWO of the following are essential components of a data classification policy? (Select two.)

Accepted Answer

Roles and responsibilities for data classification. Roles and responsibilities are essential because a data classification policy must clearly define who is accountable for classifying data, who can assign classification levels, and who is responsible for maintaining the labels. Without this, classification efforts become inconsistent and unenforceable, leading to security gaps. The CISSP emphasizes that governance requires clear assignment of ownership and decision-making authority for data assets.

Answer

Data retention periods for each classification level

Answer

Methods for secure data destruction

Answer

Encryption standards for each classification level

Question 7

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. Option B is correct because user training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices

Question 8

An analyst reviews the exhibit showing Windows security event logs. What activity should be investigated as a potential data exfiltration attempt?

Accepted Answer

The user deleting the PII file at 09:25:00 using cmd.exe. Option C is correct because deleting a PII file via cmd.exe (command-line interface) shortly after reading and writing to it is a classic indicator of data exfiltration. The attacker likely read the sensitive data, wrote a copy or staged it, then used cmd.exe to delete the original file to cover tracks and avoid detection by file access audits. This sequence—read, write, delete via command line—is anomalous for normal user behavior and strongly suggests intentional removal of evidence after data theft.

Answer

The user reading the PII file at 09:23:45

Answer

The sequence of events on the same file by the same user

Answer

The user writing to the PII file at 09:24:10

Question 9

A security engineer reviews the S3 bucket policy in the exhibit. What is the most significant security issue with this configuration?

Accepted Answer

The bucket allows public read access to all objects. The S3 bucket policy in the exhibit grants "Effect": "Allow" with "Principal": "*" and "Action": "s3:GetObject" on the bucket ARN. This configuration effectively makes all objects in the bucket publicly readable over the internet, which is a severe data exposure risk. Option C correctly identifies this as the most significant security issue because it violates the principle of least privilege and can lead to unauthorized access to sensitive data.

Answer

The resource ARN does not specify a version ID

Answer

The policy does not enforce encryption in transit

Answer

The policy lacks an explicit deny statement

Question 10

You are the security architect for a multinational corporation that handles highly sensitive intellectual property (IP) and personally identifiable information (PII) for clients in multiple jurisdictions, including GDPR and CCPA regions. The company recently experienced a data breach where an attacker exfiltrated 50 GB of data from a file server by exploiting a vulnerability in the backup software. The backup software had been configured with default credentials and was accessible from the internet. The security team has implemented compensating controls, but management wants to prevent such incidents in the future. You have been asked to recommend a long-term strategy to protect sensitive data assets. The budget is limited, and the solution must minimize user friction. Current environment: On-premises Active Directory with Windows file servers, some data in AWS S3, and a mix of laptops and mobile devices. The organization uses Microsoft 365 for email and collaboration. Which of the following is the BEST course of action?

Accepted Answer

Deploy a data classification and labeling solution integrated with endpoint and network DLP to automatically detect and protect sensitive data. Option A is correct because data classification and labeling, integrated with endpoint and network DLP, directly addresses the root cause: the inability to distinguish sensitive data from non-sensitive data. By automatically classifying and labeling IP and PII, the organization can enforce policy-based protections (e.g., blocking exfiltration, applying encryption) without relying solely on perimeter controls. This minimizes user friction by automating detection and response, and it scales across on-premises, cloud (AWS S3), and Microsoft 365 environments, aligning with GDPR and CCPA requirements for data protection.

Answer

Implement multi-factor authentication (MFA) for all administrative accounts and backup interfaces

Answer

Encrypt all data at rest using AES-256 and implement strict key management policies

Answer

Segment the backup network from the production network and enforce strict firewall rules