CISSP Asset Security Practice Test 3 — 15 Questions

Question 1

A company's data classification policy labels information as 'Internal Use Only' and 'Confidential.' An employee emails a 'Confidential' document to an external partner without authorization. Which type of data security objective has been violated?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized parties. Option B is wrong because integrity is about accuracy, not disclosure. Option C is wrong because availability is about access when needed. Option D is wrong because non-repudiation is about proof of origin.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 2

An organization uses a data loss prevention (DLP) system to monitor outbound emails. Which data classification type would the DLP most likely use to detect sensitive information leaving the network?

Accepted Answer

Content-based classification. Content-based classification inspects the actual data within outbound emails—such as credit card numbers, social security numbers, or other regex-defined patterns—to detect sensitive information. DLP systems rely on content analysis (e.g., regular expressions, exact data matching, or fingerprinting) to identify and block policy violations, making this the correct classification type for detecting sensitive data leaving the network.

Answer

Context-based classification

Answer

User-based classification

Answer

Role-based classification

Question 3

A company is implementing a data masking solution for a test database that mirrors production. Which masking technique preserves referential integrity while obfuscating sensitive values?

Accepted Answer

Deterministic encryption. Deterministic encryption (C) is correct because it uses a consistent key and algorithm to always produce the same ciphertext for a given plaintext value, allowing foreign key relationships to be maintained across tables. This preserves referential integrity while obfuscating sensitive data, as the encrypted values can still be joined reliably. Static data masking (B) replaces values with fictional but consistent substitutes, but it does not use encryption and may not guarantee the same level of consistency for complex referential constraints without careful design.

Answer

Hash-based masking

Answer

Static data masking

Answer

Dynamic data masking

Question 4

Which data lifecycle phase involves the process of determining the value of data and assigning appropriate controls to protect it?

Accepted Answer

Classify. The Classify phase is where data is evaluated for its sensitivity and criticality, leading to the assignment of a classification label (e.g., public, internal, confidential, restricted). This classification directly drives the selection of appropriate security controls (encryption, access controls, retention policies) to protect the data throughout its lifecycle. Without classification, controls cannot be properly scoped or enforced.

Answer

Create

Answer

Destroy

Answer

Store

Question 5

A security architect is designing controls for a cloud-based file storage service that stores personally identifiable information (PII). Which control best ensures that data remains encrypted at rest without involving the cloud provider's key management?

Accepted Answer

Client-side encryption. Client-side encryption ensures data is encrypted before it leaves the client device, so the cloud provider never has access to the plaintext or the encryption keys. This guarantees that the data remains encrypted at rest in the cloud storage without relying on the provider's key management infrastructure, meeting the requirement of keeping the provider out of the key management loop.

Answer

Tokenization of PII fields

Answer

Transport Layer Security (TLS) for data in transit

Answer

Server-side encryption with customer-managed keys

Question 6

A government agency's data retention policy requires that classified documents be destroyed after 10 years. Which method ensures both the information and the media are completely destroyed in a way that is verifiable and auditable?

Accepted Answer

Incineration in a certified facility. Incineration in a certified facility is the only option that completely destroys both the information and the physical media, leaving no residue that could be reconstructed. For classified government documents, the destruction must be verifiable and auditable, which a certified incineration facility provides through documented chain-of-custody and destruction certificates. This method ensures the media is physically reduced to ash, eliminating any possibility of data recovery, unlike logical or magnetic techniques.

Answer

Overwriting the data seven times

Answer

Degaussing the storage media

Answer

Deleting all files and emptying the recycle bin

Question 7

Which TWO of the following are principles of the data minimization concept under privacy regulations such as GDPR?

Accepted Answer

Collect only the personal data that is directly relevant and necessary for the specified purpose. Option B is correct because data minimization under GDPR (Article 5(1)(c)) requires that personal data collected be 'adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.' This principle directly mandates collecting only the data that is directly relevant and necessary for the specified purpose, preventing over-collection and reducing privacy risk.

Answer

Ensure personal data is accurate and kept up to date

Answer

Store personal data for as long as possible for future analysis

Answer

Provide individuals with access to their data upon request

Question 8

Which TWO of the following are valid types of data classification labels commonly used in commercial organizations?

Accepted Answer

Confidential. Commercial classification often uses labels like Public, Internal, Confidential, and Restricted. A and B are correct. Option C (Top Secret) is government/military classification. Option D (Unclassified) is government. Option E (For Official Use Only) is also government.

Answer

Top Secret

Answer

Unclassified

Answer

For Official Use Only

Question 9

Which THREE of the following are key considerations when implementing a data retention policy for an organization subject to multiple legal jurisdictions?

Accepted Answer

Varying statutory retention periods across jurisdictions. Option A is correct because different legal jurisdictions impose distinct statutory retention periods for various data types (e.g., GDPR requires retention no longer than necessary, while HIPAA mandates 6 years for medical records). A data retention policy must account for these varying minimums to ensure compliance across all applicable laws. Failing to reconcile conflicting periods can lead to legal penalties or data deletion before a jurisdiction’s requirement is met.

Answer

The organization's ability to delete data after the minimum retention period

Answer

The data owner's personal preference for deletion timelines

Question 10

Refer to the exhibit. An analyst attempts to read /data/confidential. What will be the outcome?

Accepted Answer

Access is denied because Analysts are explicitly denied. The policy explicitly denies the 'Analysts' group access to /data/confidential. In RBAC or DAC-based file systems (e.g., Linux ACLs or Windows NTFS), an explicit deny entry overrides any conflicting allow entry, regardless of the order of evaluation. Since the analyst is a member of the 'Analysts' group, the deny rule applies, and access is denied.

Answer

Access is granted because no 'combine' method is specified, so permit wins

Answer

The policy is ambiguous and will result in an error

Answer

Access is granted because Analysts are in the 'allowed' list

Question 11

Refer to the exhibit. The file data.txt contains PII. What is the most likely security issue indicated by the logs?

Accepted Answer

The file is being accessed by multiple IPs, potentially indicating data exfiltration. The log shows the same file data.txt being accessed from multiple distinct IP addresses (10.0.0.1, 10.0.0.2, 10.0.0.3) with HTTP 200 success responses. This pattern of repeated successful reads from different sources is a classic indicator of data exfiltration, where an attacker or malicious insider is copying sensitive PII to multiple external hosts. The HTTP 200 status confirms the file was successfully retrieved each time, ruling out corruption or access failures.

Answer

The HTTP 200 status indicates the file is corrupted

Answer

The file permissions restrict access to root only

Answer

The file is being overwritten by unauthorized users

Question 12

Refer to the exhibit. A legal hold exception preserves FinancialRecords FIN-001 and FIN-002. What is the correct action for FinancialRecords that are not under legal hold?

Accepted Answer

They should be archived after 2555 days. The exhibit shows a retention policy for FinancialRecords with a retention period of 2555 days (7 years). Legal hold exceptions preserve FIN-001 and FIN-002, but records not under legal hold must follow the standard retention policy. The correct action is to archive them after 2555 days, as archiving retains data for compliance or future reference without indefinite preservation, aligning with the policy's lifecycle.

Answer

They should be audited and then preserved indefinitely

Answer

They should be deleted after 2555 days

Answer

They should be deleted after 365 days

Question 13

A financial institution is implementing a data loss prevention (DLP) solution to protect customer financial information. The DLP system must detect and block the transmission of credit card numbers via email. Which of the following is the BEST approach to ensure accurate detection while minimizing false positives?

Accepted Answer

Apply a regular expression that validates the Luhn algorithm in addition to pattern matching. Option A is correct because combining a regular expression for credit card number patterns with Luhn algorithm validation significantly reduces false positives. The Luhn algorithm checks the mathematical validity of the number (e.g., checksum), ensuring that random digit sequences matching the pattern are not flagged as credit card numbers. This dual-layer approach is a standard DLP best practice for accurately detecting sensitive data like credit card numbers.

Answer

Hash all outbound emails and compare against a database of known credit card hashes

Answer

Use a simple regular expression matching patterns like '\d{4}-\d{4}-\d{4}-\d{4}'

Answer

Rely on machine learning classifiers trained on past credit card data

Question 14

A multinational corporation must ensure that data leaving the organization's network is classified and labeled appropriately. Which of the following is the MOST effective method to enforce consistent labeling across all data types?

Accepted Answer

Implement automated data classification tools that scan for sensitive content and apply labels. Automated data classification tools (e.g., Microsoft Purview, Symantec DLP) use content inspection, pattern matching, and machine learning to scan data at rest, in use, and in transit. They apply consistent labels based on predefined policies (e.g., regex for PII, fingerprinting for IP), ensuring uniform labeling across all data types without relying on human consistency or manual effort.

Answer

Appoint data stewards in each department to manually review and label data

Answer

Require all employees to complete annual training on data classification

Answer

Encrypt all data in transit and at rest to prevent unauthorized access

Question 15

Refer to the exhibit. An organization uses this ACL on the external interface of a border router to control access to internal services. A security analyst discovered that an attacker from the Internet was able to SSH into the internal server at 192.168.1.100. Which of the following is the MOST likely reason for this security gap?

Accepted Answer

The ACL permits SSH from any source in 10.0.0.0/8 to the internal host, allowing an external attacker to spoof an internal IP. Option C is correct because the ACL permits SSH (TCP port 22) from any source within the 10.0.0.0/8 range to the internal host 192.168.1.100. Since 10.0.0.0/8 is a private RFC 1918 address space, an external attacker can spoof a source IP in that range, bypassing the intended restriction that only internal hosts should use those addresses. The ACL does not validate the source IP's legitimacy, so a spoofed packet from the Internet matching the permit rule will be allowed through.

Answer

The final permit ip any any rule allows all traffic, bypassing the other rules

Answer

The ACL permits HTTP traffic to host 10.0.0.1 which could be used as a pivot

Answer

The ACL is applied inbound on the external interface, so it should block all external traffic, but the permit rules override