CISSP Asset Security Practice Test 3 — 15 Questions

Question 1

An organization uses a configuration management database (CMDB). Which of the following is the PRIMARY purpose of a CMDB?

Accepted Answer

Record asset relationships and configurations. A CMDB stores information about hardware and software assets and their relationships, aiding in configuration management and change impact analysis.

Answer

Manage user passwords

Answer

Monitor network performance

Answer

Track software licenses

Question 2

A company is designing a database that will contain personally identifiable information (PII). To reduce privacy risk, they decide to add controlled noise to query results. This technique is known as:

Accepted Answer

Differential privacy. Differential privacy adds noise to query outputs to protect individual privacy while allowing aggregate analysis.

Answer

Data masking

Answer

Tokenization

Answer

Anonymization

Question 3

A data custodian is responsible for implementing controls to protect data. Which TWO of the following are typical responsibilities of a data custodian? (Select 2)

Accepted Answer

Performing regular backups of data. Data custodians handle day-to-day management, implement security controls, and perform backups and restoration.

Answer

Classifying data according to sensitivity

Answer

Defining data usage policies

Answer

Determining data retention periods

Question 4

An organization is developing a privacy program. Which THREE of the following are core principles of privacy by design? (Select 3)

Accepted Answer

Data minimization. Privacy by design includes data minimization, purpose limitation, and storage limitation among its principles.

Answer

Open data sharing

Answer

Maximum data retention

Question 5

A government contractor handles data classified as 'Secret'. According to government data classification levels, which of the following is the correct order from most restrictive to least restrictive?

Accepted Answer

Top Secret, Secret, Confidential, Unclassified. Government classification levels, from most restrictive to least restrictive, are: Top Secret, Secret, Confidential, Unclassified.

Answer

Confidential, Secret, Top Secret, Unclassified

Answer

Unclassified, Confidential, Secret, Top Secret

Answer

Secret, Top Secret, Confidential, Unclassified

Question 6

A data owner has classified a dataset as 'Confidential' in a commercial organization. Which of the following best describes the primary responsibility of the data owner for this dataset?

Accepted Answer

Determining the data's classification and ensuring it is labeled appropriately. The data owner is accountable for data classification and assigning protection requirements, while the custodian implements controls.

Answer

Ensuring the data is accurate and complete

Answer

Implementing technical controls to protect the data

Answer

Performing daily backups of the data

Question 7

A financial institution stores customer PII, including Social Security numbers (SSNs). Under privacy regulations, SSNs are considered sensitive PII. Which of the following techniques would best reduce the risk of re-identification while preserving the utility of the data for statistical analysis?

Accepted Answer

Differential privacy by adding calibrated noise to the dataset. Differential privacy adds noise to query results to protect individual records while allowing aggregate analysis, balancing privacy and utility.

Answer

Anonymization by removing all direct identifiers

Answer

Encrypting the entire dataset at rest

Answer

Pseudonymization by replacing names with random identifiers

Question 8

An organization is decommissioning a server containing magnetic hard drives that stored sensitive data. The data has been backed up to tape and the drives are to be reused. Which media sanitization method is most appropriate to ensure data cannot be recovered while preserving the drives for reuse?

Accepted Answer

Overwriting the entire drive with a recognized standard. Overwriting (e.g., DoD 5220.22-M) is effective for magnetic media and allows reuse; degaussing and destruction do not allow reuse.

Answer

Degaussing

Answer

Physical destruction (shredding)

Answer

Cryptographic erasure

Question 9

Under GDPR, a company processes personal data on behalf of a data controller. Which role does the company fulfill?

Accepted Answer

Data processor. A data processor processes data on behalf of the controller, subject to strict contractual and regulatory obligations.

Answer

Data custodian

Answer

Data controller

Answer

Data subject

Question 10

Which phase of the data lifecycle includes the act of securely deleting data that is no longer needed, in accordance with retention policies?

Accepted Answer

Destroy. The destroy phase involves secure disposal of data when it is no longer required, often through purging or destruction.

Answer

Store

Answer

Share

Answer

Archive

Question 11

During an audit, it is discovered that a database containing personally identifiable information (PII) has been retained for 10 years beyond the regulatory requirement. The data owner has not approved the retention extension. Which data lifecycle principle is primarily being violated?

Accepted Answer

Storage limitation. Storage limitation requires that data be retained only as long as necessary; exceeding the retention period violates this principle.

Answer

Data minimization

Answer

Purpose limitation

Answer

Integrity

Question 12

A company wants to ensure that data labeled 'Internal Use Only' is not inadvertently disclosed to unauthorized parties. What is the most effective way to communicate handling requirements to employees?

Accepted Answer

Implementing a data classification policy and training employees on labeling and handling procedures. Clear labeling and documented handling procedures ensure employees know how to treat data appropriately.

Answer

Using data loss prevention (DLP) software

Answer

Encrypting all data at rest

Answer

Restricting access to the data through role-based access control

Question 13

Which of the following is the primary purpose of a configuration management database (CMDB) in asset management?

Accepted Answer

Store information about hardware and software components and their relationships. A CMDB stores information about configuration items (CIs) and their relationships, aiding in change and incident management.

Answer

Track software licenses and compliance

Answer

Perform vulnerability scanning

Answer

Monitor network performance

Question 14

An organization uses full disk encryption on all laptops containing sensitive data. A laptop is to be decommissioned, and the data must be sanitized. The laptop's SSD cannot be overwritten reliably due to wear-leveling. Which method is most appropriate?

Accepted Answer

Cryptographic erasure by destroying the encryption key. Cryptographic erasure (destroying the encryption key) renders data inaccessible if encryption is strong, suitable for SSDs.

Answer

Degaussing

Answer

DoD 5220.22-M 7-pass overwrite

Answer

Physical destruction (shredding)

Question 15

A data breach has occurred involving a database that contains personally identifiable information (PII). As part of incident response, the organization needs to identify all roles responsible for data protection. Which TWO roles are primarily accountable for data classification and protection requirements according to typical data governance frameworks?

Accepted Answer

Senior management. The data owner is accountable for classification and protection requirements, while senior management has ultimate accountability.

Answer

Data subject

Answer

Data steward

Answer

Data custodian