CISSP Asset Security — All Questions With Answers

Question 1

A government contractor handles classified information up to the Secret level. The company's data classification policy recently changed, requiring that all documents marked as 'Confidential' be reclassified as 'Secret' after review. Who is ultimately accountable for ensuring that reclassification is performed correctly?

Accepted Answer

Data owner. The data owner is the senior-level manager accountable for data classification and protection. They have the authority and responsibility to assign classification levels and ensure data is properly classified.

Answer

Data custodian

Answer

Data subject

Answer

Data steward

Question 2

An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?

Accepted Answer

Cross-cut shredding. Cross-cut shredding reduces paper to small particles, making reconstruction extremely difficult and is a common method for destroying paper records.

Answer

Overwriting with random patterns multiple times

Answer

Cryptographic erasure

Answer

Degaussing with a strong magnetic field

Question 3

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

Accepted Answer

Data processor. A data processor processes personal data on behalf of the data controller (the company). The logistics provider handles data for shipping but does not determine purposes or means.

Answer

Data controller

Answer

Data custodian

Answer

Data subject

Question 4

A healthcare organization must decommission an old server containing patient health information (PHI) stored on solid-state drives (SSDs). Standard overwriting techniques are ineffective for SSDs due to wear-leveling and bad block mapping. Which sanitization method is most appropriate for these drives?

Accepted Answer

Physical destruction such as shredding or pulverizing. Physical destruction (e.g., shredding or pulverizing) is recommended for SSDs because overwriting may not reach all cells, and degaussing does not affect flash memory.

Answer

Cryptographic erasure by deleting the encryption key

Answer

Degaussing with a high-coercivity degausser

Answer

Overwriting with the DoD 5220.22-M 7-pass standard

Question 5

An organization wants to implement a data classification scheme for internal use. Which of the following is an example of a commercial data classification label?

Accepted Answer

Private. Commercial classification labels often include 'Internal' or 'Confidential/Restricted' for internal business data, as opposed to government labels like 'Top Secret'.

Answer

Unclassified

Answer

Top Secret

Answer

Confidential

Question 6

A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?

Accepted Answer

Data custodian. The data custodian is responsible for the day-to-day management and security of data, including implementing controls, backups, and access management, on behalf of the data owner.

Answer

Data steward

Answer

Data owner

Answer

Data processor

Question 7

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

Accepted Answer

Collecting location data only when the app is actively in use. Data minimization requires collecting only the data necessary for the specified purpose. Collecting location data only when the app is actively in use reduces unnecessary data collection.

Answer

Encrypting location data both at rest and in transit

Answer

Anonymizing location data after collection

Answer

Obtaining explicit consent from users before collection

Question 8

A financial institution is preparing to dispose of magnetic tape backups containing transaction records. The tapes are no longer needed for retention. Which sanitization method is most effective for rendering the data unrecoverable on magnetic tape?

Accepted Answer

Degaussing. Degaussing uses a strong magnetic field to erase data on magnetic media, including tapes, and is highly effective for sanitization.

Answer

Cryptographic erasure

Answer

Overwriting with zeros

Answer

Physical destruction by incineration

Question 9

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

Accepted Answer

Archive. The archive phase moves data from active use to long-term storage for retention purposes, often for compliance or historical reference.

Answer

Use

Answer

Destroy

Answer

Store

Question 10

A company's software asset management team discovers an unauthorized copy of a licensed application installed on several employee workstations. What is the primary risk associated with this finding?

Accepted Answer

Legal liability for software piracy. Unauthorized software can expose the organization to legal liability for copyright infringement, security vulnerabilities due to lack of patching, and compliance issues.

Answer

Reduction in employee productivity

Answer

Increased storage consumption

Answer

Incompatibility with other systems

Question 11

A data warehouse contains anonymized customer transaction data used for analytics. The anonymization process removed direct identifiers and applied k-anonymity with k=10. An attacker obtains the dataset and attempts to re-identify individuals using auxiliary information. Which of the following best describes the residual privacy risk?

Accepted Answer

Moderate risk because k-anonymity does not protect against attribute disclosure if the group is homogeneous. k-anonymity means each record is indistinguishable from at least k-1 other records, but attacks like homogeneity or background knowledge can still lead to re-identification, especially if auxiliary data is available.

Answer

No risk because anonymization eliminates all PII

Answer

High risk because k=10 is too small to provide meaningful privacy

Answer

Low risk because k=10 ensures a group of at least 10 individuals

Question 12

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

Accepted Answer

Securely destroy the data. Once the retention period expires, data should be securely destroyed to prevent unauthorized access and comply with privacy regulations.

Answer

Continue retaining the data indefinitely for future use

Answer

Archive the data to offline storage

Answer

Anonymize the data and keep it

Question 13

What is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Provide a repository of configuration items and their relationships. A CMDB is used to store information about configuration items (CIs) and their relationships, helping manage IT assets and their interdependencies.

Answer

Monitor network traffic for anomalies

Answer

Store and manage data classification labels

Answer

Track software licenses and compliance

Question 14

A company uses differential privacy to release aggregate statistics from a dataset containing sensitive employee information. Which of the following is true regarding differential privacy?

Accepted Answer

It works by adding noise to the data or query results to protect individual privacy. Differential privacy adds calibrated noise to query results to mask individual contributions, ensuring that the inclusion or exclusion of any single record does not significantly affect the output.

Answer

It ensures that no individual's data can ever be inferred from the released statistics

Answer

It requires that data be encrypted before release

Answer

It is a method of pseudonymization that replaces identifiers with pseudonyms

Question 15

An organization is required to declassify a document that was previously classified as 'Secret' under government guidelines. What process must be followed before the document can be released to the public?

Accepted Answer

A declassification review by authorized personnel must be conducted. Declassification is a formal review process to determine if the information still requires protection. It must be performed by authorized personnel following established procedures.

Answer

The data owner must reclassify it as 'Unclassified' without further action

Answer

The document can be released immediately after the classification period expires

Answer

The document should be shredded and a new version created without classified markings

Question 16

A multinational corporation is implementing a data classification policy for commercial data. Which TWO labels are commonly used in commercial classification schemes? (Select TWO.)

Accepted Answer

Public. Commercial classification often includes 'Public' for non-sensitive data and 'Private' for internal data. 'Top Secret' and 'Unclassified' are government labels.

Answer

Secret

Answer

Unclassified

Answer

Top Secret

Question 17

An organization is developing a new application that collects and processes European customers' personal data. To comply with the privacy by design principles under GDPR, which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Retain the data only as long as necessary to fulfill the purpose (storage limitation). Privacy by design principles include data minimization (collect only necessary data), purpose limitation (use data only for specified purpose), and storage limitation (retain data only as long as needed). Encryption is a security measure, not a privacy by design principle. Consent is important but not a design principle per se.

Answer

Encrypt all personal data at rest and in transit

Answer

Obtain explicit consent from users before data collection

Question 18

A security professional is tasked with sanitizing a set of hard drives that contain sensitive corporate data. The organization wants to ensure that data cannot be recovered, even by advanced forensic methods. According to NIST SP 800-88, which THREE methods are considered appropriate for sanitization? (Select THREE.)

Accepted Answer

Physically shredding the drive into small pieces. NIST SP 800-88 defines clearing, purging, and destroying as sanitization methods. Overwriting is a form of clearing/purging, degaussing is purging for magnetic media, and physical destruction is destroying. Cryptographic erasure is effective for encrypted media but is not a separate category in the standard.

Answer

Deleting all files and emptying the recycle bin

Answer

Reformatting the drive and reinstalling the operating system

Question 19

A government contractor handles documents classified as 'Secret.' Which of the following represents the correct handling of these documents when they are no longer needed?

Accepted Answer

Shred them using a cross-cut shredder to particles of a specified size.. Secret-level documents require secure destruction methods approved by the government, such as incineration or shredding to a specified particle size, to prevent unauthorized disclosure.

Answer

Overwrite the data using a 7-pass method.

Answer

Recycle them as part of a standard office recycling program.

Answer

Deposit them in a secure disposal bin for later incineration.

Question 20

A company is implementing a data classification scheme. Which category should be assigned to internal memos about employee benefit plans that are not intended for public disclosure?

Accepted Answer

Private/Internal. Commercial classification schemes typically use 'Private' for internal data that could cause harm if disclosed, such as employee benefit details.

Answer

Confidential/Restricted

Answer

Public

Answer

Sensitive

CISSP Asset Security — All Questions With Answers

An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

An organization wants to implement a data classification scheme for internal use. Which of the following is an example of a commercial data classification label?

A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

A financial institution is preparing to dispose of magnetic tape backups containing transaction records. The tapes are no longer needed for retention. Which sanitization method is most effective for rendering the data unrecoverable on magnetic tape?

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

A company's software asset management team discovers an unauthorized copy of a licensed application installed on several employee workstations. What is the primary risk associated with this finding?

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

What is the primary purpose of a configuration management database (CMDB) in asset management?

A company uses differential privacy to release aggregate statistics from a dataset containing sensitive employee information. Which of the following is true regarding differential privacy?

An organization is required to declassify a document that was previously classified as 'Secret' under government guidelines. What process must be followed before the document can be released to the public?

A multinational corporation is implementing a data classification policy for commercial data. Which TWO labels are commonly used in commercial classification schemes? (Select TWO.)

An organization is developing a new application that collects and processes European customers' personal data. To comply with the privacy by design principles under GDPR, which THREE measures should be implemented? (Select THREE.)

A government contractor handles documents classified as 'Secret.' Which of the following represents the correct handling of these documents when they are no longer needed?

A company is implementing a data classification scheme. Which category should be assigned to internal memos about employee benefit plans that are not intended for public disclosure?

An organization wants to ensure that data is protected throughout its lifecycle. Which step in the data lifecycle is most critical for enforcing data retention policies?

Which role is ultimately accountable for the classification of data within an organization?

A company must destroy a set of hard drives containing sensitive customer data. The drives are magnetic (HDDs). Which destruction method provides the highest assurance of data irrecoverability?

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Which type of data is considered sensitive PII and requires enhanced protection?

A security administrator needs to ensure that data stored on a server is unrecoverable after decommissioning. The server uses SSDs. Which sanitization method is MOST appropriate?

A company has a data retention policy requiring customer transaction records to be kept for 7 years. After 7 years, the data should be destroyed. Which phase of the data lifecycle governs this action?

Which term describes the process of modifying data so that it cannot be attributed to a specific individual without additional information that is kept separately?

An organization uses a configuration management database (CMDB). Which of the following is the PRIMARY purpose of a CMDB?

A company is designing a database that will contain personally identifiable information (PII). To reduce privacy risk, they decide to add controlled noise to query results. This technique is known as:

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

A financial institution stores customer PII, including Social Security numbers (SSNs). Under privacy regulations, SSNs are considered sensitive PII. Which of the following techniques would best reduce the risk of re-identification while preserving the utility of the data for statistical analysis?

An organization is decommissioning a server containing magnetic hard drives that stored sensitive data. The data has been backed up to tape and the drives are to be reused. Which media sanitization method is most appropriate to ensure data cannot be recovered while preserving the drives for reuse?

Under GDPR, a company processes personal data on behalf of a data controller. Which role does the company fulfill?

Which phase of the data lifecycle includes the act of securely deleting data that is no longer needed, in accordance with retention policies?

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

A company wants to ensure that data labeled 'Internal Use Only' is not inadvertently disclosed to unauthorized parties. What is the most effective way to communicate handling requirements to employees?

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

An organization uses full disk encryption on all laptops containing sensitive data. A laptop is to be decommissioned, and the data must be sanitized. The laptop's SSD cannot be overwritten reliably due to wear-leveling. Which method is most appropriate?

A company is implementing a data retention policy for customer records. Which THREE factors should be considered when determining retention periods?

An organization is reviewing its media sanitization procedures. Which TWO methods are considered acceptable for sanitizing solid-state drives (SSDs) according to NIST SP 800-88 guidelines?

CISSP Asset Security — All Questions With Answers

An organization's data retention policy requires that financial records be kept for seven years. After that period, the records must be destroyed in a manner that prevents reconstruction. Which of the following is the best sanitization method for paper records containing sensitive financial data?

A company collects PII from European customers for order processing. Under GDPR, they engage a third-party logistics provider to handle shipping. Which role does the logistics provider typically assume in this scenario?

An organization wants to implement a data classification scheme for internal use. Which of the following is an example of a commercial data classification label?

A database administrator (DBA) is responsible for implementing access controls and backup procedures for a customer database containing PII. The DBA reports to the data owner regarding security measures. Which role best describes the DBA's responsibilities?

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

A financial institution is preparing to dispose of magnetic tape backups containing transaction records. The tapes are no longer needed for retention. Which sanitization method is most effective for rendering the data unrecoverable on magnetic tape?

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

A company's software asset management team discovers an unauthorized copy of a licensed application installed on several employee workstations. What is the primary risk associated with this finding?

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

What is the primary purpose of a configuration management database (CMDB) in asset management?

A company uses differential privacy to release aggregate statistics from a dataset containing sensitive employee information. Which of the following is true regarding differential privacy?

An organization is required to declassify a document that was previously classified as 'Secret' under government guidelines. What process must be followed before the document can be released to the public?

A multinational corporation is implementing a data classification policy for commercial data. Which TWO labels are commonly used in commercial classification schemes? (Select TWO.)

An organization is developing a new application that collects and processes European customers' personal data. To comply with the privacy by design principles under GDPR, which THREE measures should be implemented? (Select THREE.)

A government contractor handles documents classified as 'Secret.' Which of the following represents the correct handling of these documents when they are no longer needed?

A company is implementing a data classification scheme. Which category should be assigned to internal memos about employee benefit plans that are not intended for public disclosure?

An organization wants to ensure that data is protected throughout its lifecycle. Which step in the data lifecycle is most critical for enforcing data retention policies?

Which role is ultimately accountable for the classification of data within an organization?

A company must destroy a set of hard drives containing sensitive customer data. The drives are magnetic (HDDs). Which destruction method provides the highest assurance of data irrecoverability?

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Which type of data is considered sensitive PII and requires enhanced protection?

A security administrator needs to ensure that data stored on a server is unrecoverable after decommissioning. The server uses SSDs. Which sanitization method is MOST appropriate?

A company has a data retention policy requiring customer transaction records to be kept for 7 years. After 7 years, the data should be destroyed. Which phase of the data lifecycle governs this action?

Which term describes the process of modifying data so that it cannot be attributed to a specific individual without additional information that is kept separately?

An organization uses a configuration management database (CMDB). Which of the following is the PRIMARY purpose of a CMDB?

A company is designing a database that will contain personally identifiable information (PII). To reduce privacy risk, they decide to add controlled noise to query results. This technique is known as:

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

A financial institution stores customer PII, including Social Security numbers (SSNs). Under privacy regulations, SSNs are considered sensitive PII. Which of the following techniques would best reduce the risk of re-identification while preserving the utility of the data for statistical analysis?

An organization is decommissioning a server containing magnetic hard drives that stored sensitive data. The data has been backed up to tape and the drives are to be reused. Which media sanitization method is most appropriate to ensure data cannot be recovered while preserving the drives for reuse?

Under GDPR, a company processes personal data on behalf of a data controller. Which role does the company fulfill?

Which phase of the data lifecycle includes the act of securely deleting data that is no longer needed, in accordance with retention policies?

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

A company wants to ensure that data labeled 'Internal Use Only' is not inadvertently disclosed to unauthorized parties. What is the most effective way to communicate handling requirements to employees?