CISSP Asset Security Practice Test 3 — 15 Questions

Question 1

A company has a data retention policy requiring customer transaction records to be kept for 7 years. After 7 years, the data should be destroyed. Which phase of the data lifecycle governs this action?

Accepted Answer

Destroy. The destroy phase of the data lifecycle explicitly governs the secure disposal of data once its retention period ends. In this scenario, after 7 years, the policy mandates destruction, so the action falls under the Destroy phase. This phase ensures data is irrecoverable and compliant with legal and regulatory requirements.

Answer

Use

Answer

Share

Answer

Archive

Question 2

Which term describes the process of modifying data so that it cannot be attributed to a specific individual without additional information that is kept separately?

Accepted Answer

Pseudonymisation. Pseudonymisation replaces identifying information with a pseudonym, and the mapping between the pseudonym and the original identity is kept separately, so re-identification is possible only with access to that additional information. This matches the definition exactly.

Answer

Anonymisation

Answer

Differential privacy

Answer

Encryption

Question 3

An organization uses a configuration management database (CMDB). Which of the following is the PRIMARY purpose of a CMDB?

Accepted Answer

Record asset relationships and configurations. A CMDB's core function is to serve as a repository that records configuration items (CIs) and, critically, the relationships between them — such as which server hosts which application, which application depends on which database, and how changes propagate. This relationship mapping is what enables impact analysis, change management, and incident root-cause analysis. Simply storing asset attributes without relationships would be an asset inventory, not a CMDB.

Answer

Manage user passwords

Answer

Monitor network performance

Answer

Track software licenses

Question 4

A company is designing a database that will contain personally identifiable information (PII). To reduce privacy risk, they decide to add controlled noise to query results. This technique is known as:

Accepted Answer

Differential privacy. Differential privacy is a technique that adds controlled noise to query results to protect individual privacy while allowing aggregate analysis. It ensures that the inclusion or exclusion of a single individual's data does not significantly affect the output, thereby reducing privacy risk. This matches the scenario of adding noise to query results for PII.

Answer

Data masking

Answer

Tokenization

Answer

Anonymization

Question 5

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

Accepted Answer

Performing regular backups of data. The data custodian handles the day-to-day operational, technical execution of data protection controls, and running scheduled backups is a classic custodial task that enforces the protection decisions made by data owners. Option D (Restoring data from backups when needed) is also correct because recovery operations—retrieving and restoring data from backup media during an incident or data loss event—fall within the custodian's operational remit for maintaining data availability and integrity. By contrast, Option A (Classifying data according to sensitivity), Option B (Defining data usage policies), and Option E (Determining data retention periods) are strategic governance responsibilities belonging to the data owner (or steward), who sets classification, policy, and retention rules that the custodian then implements.

Answer

Classifying data according to sensitivity

Answer

Defining data usage policies

Answer

Determining data retention periods

Question 6

An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)

Accepted Answer

Data minimization. Data minimization (B) is a core privacy-by-design principle because it requires collecting only the personal data that is adequate, relevant, and necessary for the specified purpose, reducing exposure and risk. Purpose limitation (C) is correct because personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. Storage limitation (E) is correct because data should be kept only as long as necessary for the stated purpose, after which it must be deleted or anonymized. Open data sharing (A) is not a privacy-by-design principle, as unrestricted sharing conflicts with confidentiality and purpose controls, and maximum data retention (D) is the opposite of storage limitation and increases privacy risk.

Answer

Open data sharing

Answer

Maximum data retention

Question 7

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

Accepted Answer

Top Secret, Secret, Confidential, Unclassified. The U.S. government classification hierarchy, defined by Executive Order 13526, ranks information from most to least restrictive as Top Secret, Secret, Confidential, and Unclassified. Top Secret covers information whose unauthorized disclosure could cause 'exceptionally grave damage' to national security, while Secret and Confidential correspond to 'serious' and 'damage' respectively. Unclassified sits at the bottom with no restriction. Option B is the only choice that lists this order correctly.

Answer

Confidential, Secret, Top Secret, Unclassified

Answer

Unclassified, Confidential, Secret, Top Secret

Answer

Secret, Top Secret, Confidential, Unclassified

Question 8

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

Accepted Answer

Determining the data's classification and ensuring it is labeled appropriately. The data owner is accountable for data classification and assigning protection requirements, while the custodian implements controls.

Answer

Ensuring the data is accurate and complete

Answer

Implementing technical controls to protect the data

Answer

Performing daily backups of the data

Question 9

A financial institution stores customer PII, including Social Security numbers (SSNs). Under privacy regulations, SSNs are considered sensitive PII. Which of the following techniques would best reduce the risk of re-identification while preserving the utility of the data for statistical analysis?

Accepted Answer

Differential privacy by adding calibrated noise to the dataset. Differential privacy adds mathematically calibrated noise to query results or dataset statistics so that the presence or absence of any single individual cannot be inferred, while aggregate statistical properties remain accurate. This directly addresses re-identification risk — even with auxiliary data, an attacker cannot confidently determine whether a specific person is in the dataset. It preserves utility for statistical analysis because the noise is bounded and unbiased across large populations.

Answer

Anonymization by removing all direct identifiers

Answer

Encrypting the entire dataset at rest

Answer

Pseudonymization by replacing names with random identifiers

Question 10

Under GDPR, a company processes personal data on behalf of a data controller. Which role does the company fulfill?

Accepted Answer

Data processor. Under GDPR Article 4(8), a processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. Since the company is processing data on behalf of the controller, it is the data processor.

Answer

Data custodian

Answer

Data controller

Answer

Data subject

Question 11

Which phase of the data lifecycle includes the act of securely deleting data that is no longer needed, in accordance with retention policies?

Accepted Answer

Destroy. The Destroy phase of the data lifecycle is explicitly the stage where data is securely deleted once it is no longer needed and retention policies permit disposal. It covers techniques like cryptographic erasure, degaussing, shredding, and secure overwrite, ensuring data cannot be recovered. This is the terminal phase before the lifecycle restarts.

Answer

Store

Answer

Share

Answer

Archive

Question 12

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

Accepted Answer

Storage limitation. Storage limitation requires that PII be kept only as long as necessary for the stated purpose or as required by regulation, and then securely deleted. Retaining data 10 years beyond the regulatory requirement, without the data owner's approval for an extension, directly violates this principle. The other principles address collection scope, purpose of use, and accuracy/consistency — not retention duration.

Answer

Data minimization

Answer

Purpose limitation

Answer

Integrity

Question 13

A company wants to ensure that data labeled 'Internal Use Only' is not inadvertently disclosed to unauthorized parties. What is the most effective way to communicate handling requirements to employees?

Accepted Answer

Implementing a data classification policy and training employees on labeling and handling procedures. A data classification policy defines the categories (e.g., Public, Internal Use Only, Confidential) and the required handling procedures for each, and employee training ensures that everyone who creates or handles data knows how to label and protect it. This is the most effective way to communicate handling requirements because it establishes both the rule and the human behavior needed to follow it. Technical controls alone cannot fully prevent inadvertent disclosure by authorized users.

Answer

Using data loss prevention (DLP) software

Answer

Encrypting all data at rest

Answer

Restricting access to the data through role-based access control

Question 14

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Store information about hardware and software components and their relationships. A CMDB's primary purpose is to store information about configuration items (CIs) — hardware, software, and other assets — and the relationships between them. This relationship mapping supports impact analysis, incident management, and change management by showing how components depend on each other.

Answer

Track software licenses and compliance

Answer

Perform vulnerability scanning

Answer

Monitor network performance

Question 15

An organization uses full disk encryption on all laptops containing sensitive data. A laptop is to be decommissioned, and the data must be sanitized. The laptop's SSD cannot be overwritten reliably due to wear-leveling. Which method is most appropriate?

Accepted Answer

Cryptographic erasure by destroying the encryption key. Cryptographic erasure by destroying the encryption key is the most appropriate method because the data is already encrypted with full disk encryption; destroying the key renders the data unrecoverable without needing to overwrite the SSD, which is unreliable due to wear-leveling. This approach is efficient and secure for decommissioning.

Answer

Degaussing

Answer

DoD 5220.22-M 7-pass overwrite

Answer

Physical destruction (shredding)