CISSP Asset Security — 10 Questions

Question 1

A government contractor handles classified information up to the Secret level. The company's data classification policy recently changed, requiring that all documents marked as 'Confidential' be reclassified as 'Secret' after review. Who is ultimately accountable for ensuring that reclassification is performed correctly?

Accepted Answer

Data owner. The data owner is the senior-level manager accountable for data classification and protection. They have the authority and responsibility to assign classification levels and ensure data is properly classified.

Answer

Data custodian

Answer

Data subject

Answer

Data steward

Question 2

An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?

Accepted Answer

Cross-cut shredding. Cross-cut shredding reduces paper to small particles, making reconstruction extremely difficult and is a common method for destroying paper records.

Answer

Overwriting with random patterns multiple times

Answer

Cryptographic erasure

Answer

Degaussing with a strong magnetic field

Question 3

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

Accepted Answer

Data processor. A data processor processes personal data on behalf of the data controller (the company). The logistics provider handles data for shipping but does not determine purposes or means.

Answer

Data controller

Answer

Data custodian

Answer

Data subject

Question 4

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 5

An organization wants to implement a data classification scheme for internal use. Which of the following is an example of a commercial data classification label?

Accepted Answer

Private. Commercial classification labels often include 'Internal' or 'Confidential/Restricted' for internal business data, as opposed to government labels like 'Top Secret'.

Answer

Unclassified

Answer

Top Secret

Answer

Confidential

Question 6

A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?

Accepted Answer

Data custodian. The data custodian is responsible for the day-to-day management and security of data, including implementing controls, backups, and access management, on behalf of the data owner.

Answer

Data steward

Answer

Data owner

Answer

Data processor

Question 7

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

Accepted Answer

Collecting location data only when the app is actively in use. Data minimization requires collecting only the data necessary for the specified purpose. Collecting location data only when the app is actively in use reduces unnecessary data collection.

Answer

Encrypting location data both at rest and in transit

Answer

Anonymizing location data after collection

Answer

Obtaining explicit consent from users before collection

Question 8

A financial institution is preparing to dispose of magnetic tape backups containing transaction records. The tapes are no longer needed for retention. Which sanitization method is most effective for rendering the data unrecoverable on magnetic tape?

Accepted Answer

Degaussing. Degaussing uses a strong magnetic field to erase data on magnetic media, including tapes, and is highly effective for sanitization.

Answer

Cryptographic erasure

Answer

Overwriting with zeros

Answer

Physical destruction by incineration

Question 9

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

Accepted Answer

Archive. The archive phase moves data from active use to long-term storage for retention purposes, often for compliance or historical reference.

Answer

Use

Answer

Destroy

Answer

Store

Question 10

A company's software asset management team discovers an unauthorized copy of a licensed application installed on several employee workstations. What is the primary risk associated with this finding?

Accepted Answer

Legal liability for software piracy. Unauthorized software can expose the organization to legal liability for copyright infringement, security vulnerabilities due to lack of patching, and compliance issues.

Answer

Reduction in employee productivity

Answer

Increased storage consumption

Answer

Incompatibility with other systems