easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A development team is implementing a new feature…
A development team is implementing a new feature that processes sensitive user data. Which of the following is the most secure approach to prevent data leakage during processing?
⚠ Common exam trap
Test-takers frequently choose logging (Option D) because auditing is a common security control, but they overlook that logging does not prevent data leakage during active processing, which is the core requirement of the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use memory encryption for all user data.
Memory encryption protects sensitive user data while it resides in RAM, preventing unauthorized access through memory dumps, cold boot attacks, or other memory-scraping techniques. This is the most secure approach because it safeguards data during the entire processing lifecycle, unlike other options that leave data exposed in memory or rely on post-processing cleanup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a separate virtual machine for each request.
Why it's wrong here
Instantiating and tearing down a full virtual machine for every single user request introduces prohibitive latency and consumes excessive CPU, memory, and storage resources. This approach is fundamentally unscalable, as the overhead of VM lifecycle management far outweighs the processing time for typical requests, making it impractical for high-throughput applications and leading to significant operational costs and performance bottlenecks.
- ✓
Use memory encryption for all user data.
Why this is correct
Implementing memory encryption ensures that sensitive user data remains unintelligible even if an attacker gains unauthorized access to the system's RAM, for instance, through memory scraping malware, cold boot attacks, or direct memory access (DMA) exploits. This proactive measure protects data in its most vulnerable state—during active processing—by encrypting memory pages or regions, thereby preventing the compromise of sensitive information residing in volatile memory.
- ✗
Store all data in a temporary file and delete it after processing.
Why it's wrong here
Storing sensitive data in temporary files, even if subsequently 'deleted,' creates a significant data remanence risk because file deletion typically only removes the directory pointer, leaving the actual data blocks recoverable until overwritten. This vulnerability allows forensic tools or even standard disk recovery utilities to retrieve sensitive information from the underlying storage media, including SSDs, HDDs, and even swap files, long after the application believes it has been purged.
- ✗
Log all data access for auditing.
Why it's wrong here
While logging all data access is a critical component of a robust security posture, providing essential forensic evidence for incident response and compliance, it is a detective control rather than a preventive one. Logging records events after they occur, meaning it does not actively stop an unauthorized access attempt or prevent data compromise in real-time, nor does it protect data during its processing phase from direct memory attacks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.