CISSP Asset Security Practice Test 2 — 15 Questions

Question 1

An organization is implementing privacy by design in a new application that collects user location data. Which practice best aligns with the data minimization principle?

Accepted Answer

Collecting location data only when the app is actively in use. Data minimization means collecting only the data that is necessary for the specified purpose. Collecting location data only when the app is actively in use limits collection to the minimum needed for the app's functionality, directly aligning with the principle.

Answer

Encrypting location data both at rest and in transit

Answer

Anonymizing location data after collection

Answer

Obtaining explicit consent from users before collection

Question 2

Which phase of the data lifecycle involves the removal of data from active storage and placement into long-term storage for potential future use?

Accepted Answer

Archive. The Archive phase of the data lifecycle is specifically defined as the stage where data is moved out of active, frequently accessed storage and placed into long-term retention for potential future reference or compliance needs. Unlike Destroy, which permanently eliminates data, Archive preserves the data in a lower-cost, less accessible tier. This aligns with lifecycle models (e.g., ISACA/ISO 27001 data lifecycle) where Archive follows Use and precedes eventual Destroy.

Answer

Use

Answer

Destroy

Answer

Store

Question 3

A company's software asset management team discovers an unauthorized copy of a licensed application installed on several employee workstations. What is the primary risk associated with this finding?

Accepted Answer

Legal liability for software piracy. Unauthorized software can expose the organization to legal liability for copyright infringement, security vulnerabilities due to lack of patching, and compliance issues.

Answer

Reduction in employee productivity

Answer

Increased storage consumption

Answer

Incompatibility with other systems

Question 4

A data warehouse contains anonymized customer transaction data used for analytics. The anonymization process removed direct identifiers and applied k-anonymity with k=10. An attacker obtains the dataset and attempts to re-identify individuals using auxiliary information. Which of the following best describes the residual privacy risk?

Accepted Answer

Moderate risk because k-anonymity does not protect against attribute disclosure if the group is homogeneous. k-anonymity means each record is indistinguishable from at least k-1 other records, but attacks like homogeneity or background knowledge can still lead to re-identification, especially if auxiliary data is available.

Answer

No risk because anonymization eliminates all PII

Answer

High risk because k=10 is too small to provide meaningful privacy

Answer

Low risk because k=10 ensures a group of at least 10 individuals

Question 5

An organization's data retention policy specifies that customer records must be retained for five years after the end of the business relationship. After that period, what should be done with the data according to best practices?

Accepted Answer

Securely destroy the data. Once the retention period expires, data should be securely destroyed to prevent unauthorized access and comply with privacy regulations.

Answer

Continue retaining the data indefinitely for future use

Answer

Archive the data to offline storage

Answer

Anonymize the data and keep it

Question 6

What is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Provide a repository of configuration items and their relationships. The primary purpose of a configuration management database (CMDB) is to provide a repository of configuration items (CIs) and their relationships, enabling IT service management processes like change management, incident management, and asset management. It tracks the components of an IT environment and how they interconnect.

Answer

Monitor network traffic for anomalies

Answer

Store and manage data classification labels

Answer

Track software licenses and compliance

Question 7

A company uses differential privacy to release aggregate statistics from a dataset containing sensitive employee information. Which of the following is true regarding differential privacy?

Accepted Answer

It works by adding noise to the data or query results to protect individual privacy. Differential privacy is a mathematical framework that adds calibrated noise (e.g., Laplace or Gaussian) to either the raw data or the query output so that the presence or absence of any single individual changes the result by only a bounded amount. This provides plausible deniability for each record while still allowing statistically useful aggregate results. Option A correctly captures this core mechanism.

Answer

It ensures that no individual's data can ever be inferred from the released statistics

Answer

It requires that data be encrypted before release

Answer

It is a method of pseudonymization that replaces identifiers with pseudonyms

Question 8

An organization is required to declassify a document that was previously classified as 'Secret' under government guidelines. What process must be followed before the document can be released to the public?

Accepted Answer

A declassification review by authorized personnel must be conducted. Declassification under government guidelines (e.g., EO 13526 in the US, or equivalent national frameworks) requires a formal declassification review by authorized personnel before any classified material can be released. The review verifies whether the information still warrants protection, whether exemptions apply, and whether any portions must remain redacted. Only after this review and approval can the document be downgraded or released to the public.

Answer

The data owner must reclassify it as 'Unclassified' without further action

Answer

The document can be released immediately after the classification period expires

Answer

The document should be shredded and a new version created without classified markings

Question 9

An organization is developing a new application that collects and processes European customers' personal data. To comply with the privacy by design principles under GDPR, which THREE measures should be implemented? (Select THREE.)

Accepted Answer

Retain the data only as long as necessary to fulfill the purpose (storage limitation). Option A is correct because GDPR's storage limitation principle (Article 5(1)(e)) requires that personal data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed, making retention limits a core privacy-by-design measure. Option C is correct because the purpose limitation principle (Article 5(1)(b)) requires data to be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes, so restricting use to the original purpose is essential. Option E is correct because the data minimization principle (Article 5(1)(c)) requires processing to be adequate, relevant, and limited to what is necessary in relation to the purposes, so collecting only the minimum data needed directly implements privacy by design. Option B is not marked correct because, while encryption is a valuable security safeguard under Article 32, it is not one of the core privacy-by-design data principles tested here and GDPR does not mandate encryption of all personal data in every case. Option D is not marked correct because explicit consent is only one of several lawful bases under Article 6 and is not always required, so it is not a universal privacy-by-design measure.

Answer

Encrypt all personal data at rest and in transit

Answer

Obtain explicit consent from users before data collection

Question 10

An organization wants to ensure that data is protected throughout its lifecycle. Which step in the data lifecycle is most critical for enforcing data retention policies?

Accepted Answer

Archive. The Archive phase of the data lifecycle is where data retention policies are enforced, because this is the stage where data is moved to long-term storage and governed by retention schedules, legal holds, and disposition rules. Retention policies define how long data must be kept and when it must be securely destroyed, and these controls are applied at the archive stage. Without proper archival governance, data may be retained indefinitely or destroyed prematurely, violating regulatory requirements.

Answer

Use

Answer

Create/Collect

Answer

Share

Question 11

Which role is ultimately accountable for the classification of data within an organization?

Accepted Answer

Data owner. The data owner is the senior manager or business leader ultimately accountable for the data's classification, protection, and use. They hold the authority and responsibility for deciding how data is categorized (e.g., public, internal, confidential, restricted) based on its sensitivity and business value. Accountability cannot be delegated to custodians or stewards, who execute the owner's decisions.

Answer

Data steward

Answer

Data custodian

Answer

Data processor

Question 12

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

Accepted Answer

Data controller. Under the GDPR, the data controller is the entity (natural or legal person, public authority, agency, or other body) that alone or jointly with others determines the purposes and means of processing personal data. This role carries primary accountability for GDPR compliance, including lawful basis, data subject rights, and breach notification. The controller decides 'why' and 'how' data is processed, which is the defining characteristic of the role.

Answer

Data processor

Answer

Data subject

Answer

Data protection officer

Question 13

An organization is implementing privacy by design for a new application that processes PII. Which practice BEST aligns with the data minimization principle?

Accepted Answer

Collecting only the PII required for the stated function.. Data minimization means collecting only the personal data that is necessary for the specified purpose. Collecting only the PII required for the stated function directly implements this principle by limiting the scope of data collection at the source, reducing privacy risk and compliance burden.

Answer

Anonymizing data after collection.

Answer

Obtaining explicit consent from users.

Answer

Collecting all possible PII in case it is needed later.

Question 14

Which type of data is considered sensitive PII and requires enhanced protection?

Accepted Answer

Social Security number. A Social Security number is a government-issued unique identifier that, if exposed, enables identity theft and fraud, so it is classified as sensitive PII requiring enhanced protection under regulations like GLBA, HIPAA, and state privacy laws. Names, email addresses, and phone numbers are PII but generally lower sensitivity, while job titles are typically not considered sensitive PII at all. The SSN is the classic example of high-sensitivity personal data.

Answer

Name and email address

Answer

Job title

Answer

Phone number

Question 15

A security administrator needs to ensure that data stored on a server is unrecoverable after decommissioning. The server uses SSDs. Which sanitization method is MOST appropriate?

Accepted Answer

Physical destruction (shredding). SSDs cannot be reliably overwritten due to wear leveling; physical destruction or cryptographic erasure is recommended.

Answer

Quick format

Answer

Standard overwriting with multiple passes

Answer

Degaussing