CISSP Asset Security — Timed 20 Questions

Question 1

A financial institution is implementing a data retention policy to comply with regulatory requirements. The policy must ensure that transaction records are retained for 7 years and then securely destroyed. Which of the following is the BEST approach to implement this policy?

Accepted Answer

Automatically purge records using a data management tool that overwrites data after the retention period. Option B is correct because automated purging using a data management tool that overwrites data ensures that the records are securely destroyed at the end of the retention period, meeting both regulatory compliance and data sanitization requirements. Overwriting (e.g., using DoD 5220.22-M or NIST SP 800-88 standards) prevents data recovery by replacing the storage media's bits with patterns, making it a reliable method for secure destruction in a financial institution's automated environment.

Answer

Encrypt all records and destroy the encryption keys after 7 years

Answer

Move records to a separate archive and delete the directory pointers

Answer

Manually review and delete records after 7 years

Question 2

During a security audit, it is discovered that a company's data classification labels are inconsistently applied across different departments. Which of the following is the BEST long-term solution to ensure consistent data classification?

Accepted Answer

Implement automated data classification tools that apply labels based on content and context. Automated data classification tools use content inspection (e.g., regex patterns, keyword matching) and contextual analysis (e.g., file location, creator, metadata) to consistently apply labels across the enterprise. This eliminates human error and variability between departments, ensuring uniform enforcement of the classification policy without relying on manual interpretation or periodic training.

Answer

Conduct annual retraining on data classification policies

Answer

Adopt a single classification level for all data to eliminate confusion

Answer

Assign a data owner in each department to manually review and classify data

Question 3

An organization wants to protect sensitive data stored on laptops. Which of the following is the MOST effective control to prevent data loss if a laptop is stolen?

Accepted Answer

Full-disk encryption (FDE). Full-disk encryption (FDE) renders the data on the laptop unreadable without the decryption key, even if the storage drive is removed and analyzed. This is the most effective preventive control against data loss from theft because it protects data at rest regardless of physical access to the device.

Answer

BIOS password

Answer

Asset tracking software

Answer

Remote wipe capability

Question 4

A healthcare organization is moving patient records to a cloud storage service. Which of the following is the MOST important requirement to ensure data security and compliance with HIPAA?

Accepted Answer

A signed Business Associate Agreement (BAA) with the cloud provider. Under HIPAA, a covered entity must have a signed Business Associate Agreement (BAA) with any cloud service provider that creates, receives, maintains, or transmits protected health information (PHI). Without a BAA, the provider is not contractually bound to safeguard PHI, making the organization non-compliant regardless of technical controls. While encryption and MFA are important security measures, they cannot substitute for the legal and regulatory requirement of a BAA.

Answer

Multi-factor authentication for all cloud access

Answer

Encryption of data in transit using TLS 1.2

Answer

Encryption of data at rest using AES-256

Question 5

A company is decommissioning a data center and needs to dispose of hard drives that contained highly confidential financial data. Which of the following methods provides the HIGHEST assurance that data cannot be recovered?

Accepted Answer

Shredding the drives into small pieces. Shredding the drives into small pieces physically destroys the platters, making data recovery impossible regardless of the storage technology (e.g., HDD vs. SSD). This method provides the highest assurance because it eliminates any possibility of reading residual magnetic or solid-state data, even with advanced forensic tools like electron microscopy.

Answer

Overwriting the drives with multiple passes of random data

Answer

Degaussing the drives

Answer

Overwriting the drives with a single pass of zeros

Question 6

Which TWO of the following are essential components of a data classification policy? (Select two.)

Accepted Answer

Roles and responsibilities for data classification. Roles and responsibilities are essential because a data classification policy must clearly define who is accountable for classifying data, who can assign classification levels, and who is responsible for maintaining the labels. Without this, classification efforts become inconsistent and unenforceable, leading to security gaps. The CISSP emphasizes that governance requires clear assignment of ownership and decision-making authority for data assets.

Answer

Data retention periods for each classification level

Answer

Methods for secure data destruction

Answer

Encryption standards for each classification level

Question 7

Which THREE of the following are valid considerations when implementing data loss prevention (DLP) controls to protect sensitive data? (Select three.)

Accepted Answer

User training to reduce false positives and increase acceptance. Option B is correct because user training is a critical component of a successful DLP implementation. Without proper training, users may inadvertently trigger false positives by mishandling data or may attempt to bypass controls they perceive as overly restrictive. Training helps users understand classification labels and proper data handling procedures, reducing the operational burden on security teams and increasing overall acceptance of DLP policies.

Answer

Integration with all third-party applications

Answer

Blocking all data transfers to external devices

Question 8

An analyst reviews the exhibit showing Windows security event logs. What activity should be investigated as a potential data exfiltration attempt?

Accepted Answer

The user deleting the PII file at 09:25:00 using cmd.exe. Option C is correct because deleting a PII file via cmd.exe (command-line interface) shortly after reading and writing to it is a classic indicator of data exfiltration. The attacker likely read the sensitive data, wrote a copy or staged it, then used cmd.exe to delete the original file to cover tracks and avoid detection by file access audits. This sequence—read, write, delete via command line—is anomalous for normal user behavior and strongly suggests intentional removal of evidence after data theft.

Answer

The user reading the PII file at 09:23:45

Answer

The sequence of events on the same file by the same user

Answer

The user writing to the PII file at 09:24:10

Question 9

A security engineer reviews the S3 bucket policy in the exhibit. What is the most significant security issue with this configuration?

Accepted Answer

The bucket allows public read access to all objects. The S3 bucket policy in the exhibit grants "Effect": "Allow" with "Principal": "*" and "Action": "s3:GetObject" on the bucket ARN. This configuration effectively makes all objects in the bucket publicly readable over the internet, which is a severe data exposure risk. Option C correctly identifies this as the most significant security issue because it violates the principle of least privilege and can lead to unauthorized access to sensitive data.

Answer

The resource ARN does not specify a version ID

Answer

The policy does not enforce encryption in transit

Answer

The policy lacks an explicit deny statement

Question 10

You are the security architect for a multinational corporation that handles highly sensitive intellectual property (IP) and personally identifiable information (PII) for clients in multiple jurisdictions, including GDPR and CCPA regions. The company recently experienced a data breach where an attacker exfiltrated 50 GB of data from a file server by exploiting a vulnerability in the backup software. The backup software had been configured with default credentials and was accessible from the internet. The security team has implemented compensating controls, but management wants to prevent such incidents in the future. You have been asked to recommend a long-term strategy to protect sensitive data assets. The budget is limited, and the solution must minimize user friction. Current environment: On-premises Active Directory with Windows file servers, some data in AWS S3, and a mix of laptops and mobile devices. The organization uses Microsoft 365 for email and collaboration. Which of the following is the BEST course of action?

Accepted Answer

Deploy a data classification and labeling solution integrated with endpoint and network DLP to automatically detect and protect sensitive data. Option A is correct because data classification and labeling, integrated with endpoint and network DLP, directly addresses the root cause: the inability to distinguish sensitive data from non-sensitive data. By automatically classifying and labeling IP and PII, the organization can enforce policy-based protections (e.g., blocking exfiltration, applying encryption) without relying solely on perimeter controls. This minimizes user friction by automating detection and response, and it scales across on-premises, cloud (AWS S3), and Microsoft 365 environments, aligning with GDPR and CCPA requirements for data protection.

Answer

Implement multi-factor authentication (MFA) for all administrative accounts and backup interfaces

Answer

Encrypt all data at rest using AES-256 and implement strict key management policies

Answer

Segment the backup network from the production network and enforce strict firewall rules

Question 11

Drag and drop the steps for a forensic investigation in the correct order.

Question 12

Match each security policy to its purpose.

Question 13

A company wants to ensure that data is properly classified before storage. Which control should be implemented?

Accepted Answer

Data Classification Policy. A Data Classification Policy is the foundational control that defines the categories (e.g., public, internal, confidential) and handling requirements for data before it is stored. Without a policy, technical controls like encryption or DLP lack the classification labels needed to apply the correct rules. The policy ensures that data owners and custodians consistently label data at creation or ingestion, enabling downstream security controls to function correctly.

Answer

Encryption

Answer

Data Loss Prevention (DLP)

Answer

Access Control Lists (ACLs)

Question 14

A financial institution must retain customer transaction records for 7 years. After that, what is the most appropriate action?

Accepted Answer

Securely delete using overwriting. After the 7-year retention period, the most appropriate action is to securely delete the records using overwriting. This ensures that the data is irrecoverable while maintaining compliance with data disposal policies. Overwriting with multiple passes (e.g., using the Gutmann method or DoD 5220.22-M standard) prevents data remanence, which is critical for financial records.

Answer

Degauss and physically destroy

Answer

Transfer to a third-party storage vendor

Answer

Archive to tape for additional redundancy

Question 15

An organization implements a data masking policy for production databases. Which of the following best describes the primary goal?

Accepted Answer

Reduce the risk of data exposure during testing. Data masking irreversibly replaces sensitive data with realistic but fictitious values, ensuring that production data is not exposed in non-production environments like testing or development. This directly reduces the risk of data exposure during testing, which is the primary goal of a data masking policy. Unlike encryption, masking does not preserve the ability to reverse the transformation, making it ideal for scenarios where the original data is not needed.

Answer

Ensure data availability

Answer

Encrypt data at rest

Answer

Simplify access controls

Question 16

In asset security, which of the following is a primary responsibility of a data owner?

Accepted Answer

Classifying data. The data owner is the senior-level manager who is ultimately accountable for a specific set of data. Their primary responsibility is to determine the data's sensitivity and business value, which directly drives the classification level (e.g., public, internal, confidential, restricted). Classification is the foundational step that dictates all subsequent protection requirements, making it a core duty of the data owner, not a technical implementer.

Answer

Monitoring access logs

Answer

Implementing security controls

Answer

Backing up data

Question 17

A company uses a cloud storage service. Which asset security control is most important to prevent unauthorized access to data?

Accepted Answer

Encryption in transit and at rest. Encryption in transit (e.g., TLS 1.3) and at rest (e.g., AES-256) is the most important asset security control because it renders data unreadable even if the cloud storage service is compromised or an attacker gains access to the underlying infrastructure. Without encryption, all other controls (logging, reviews, scanning) are reactive and cannot prevent a direct breach of the stored data. This aligns with the CISSP principle of defense in depth, where encryption provides a strong preventive layer for data confidentiality.

Answer

Logging and monitoring

Answer

Periodic access reviews

Answer

Regular vulnerability scanning

Question 18

An organization is decommissioning a data center. Which of the following is the most secure method for sanitizing hard drives that will be reused?

Accepted Answer

Overwriting with random data multiple times. Overwriting with random data multiple times (option C) is the most secure method for sanitizing hard drives that will be reused because it ensures that the original data is irrecoverable through any known forensic technique. Unlike physical destruction, which renders the drive unusable, or file deletion and quick format, which only remove file system pointers and leave data intact, multiple-pass overwriting (e.g., using the DoD 5220.22-M standard) writes patterns over every sector, including remapped sectors, making the original data unrecoverable even with advanced magnetic force microscopy.

Answer

Physical destruction

Answer

Deleting all files

Answer

Quick format

Question 19

A data classification scheme includes Public, Internal, Confidential, and Restricted. Which classification requires the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification level in this scheme, indicating data that would cause severe damage to the organization if disclosed. It requires the strongest access controls, encryption (e.g., AES-256 for data at rest, TLS 1.3 for data in transit), and strict need-to-know policies. This aligns with the principle of protecting data based on its sensitivity and the potential impact of unauthorized disclosure.

Answer

Internal

Answer

Public

Answer

Confidential

Question 20

A security analyst discovers that a business unit is storing sensitive data on a file share without classification labels. What is the first step to remediate?

Accepted Answer

Notify the data owner to classify the data. The data owner must classify the data first. Other actions are premature before classification. Encrypting or moving might be appropriate after classification. Deleting without authorization could destroy needed data.

Answer

Move the data to a secure server

Answer

Immediately delete the data

Answer

Encrypt the file share