CISSP Asset Security Practice Question
An organization is required to declassify a document that was previously classified as 'Secret' under government guidelines. What process must be followed before the document can be released to the public?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A declassification review by authorized personnel must be conducted
Declassification is a formal review process to determine if the information still requires protection. It must be performed by authorized personnel following established procedures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The data owner must reclassify it as 'Unclassified' without further action
Why it's wrong here
Declassification is a formal, structured process, not merely a unilateral reclassification by the data owner. While the data owner initiates or is involved in the process, simply changing the classification marking to 'Unclassified' without a comprehensive review by authorized personnel is insufficient. This approach bypasses the necessary checks to ensure no residual sensitive information remains, which could lead to unauthorized disclosure and violate established security protocols.
- ✗
The document can be released immediately after the classification period expires
Why it's wrong here
While a classification period's expiration often triggers the declassification process, it does not automatically permit immediate release. Many jurisdictions and policies require a mandatory declassification review even after the period expires, specifically to identify any information that might still warrant protection under specific exemptions, such as privacy concerns or ongoing national security interests. Releasing it immediately without this review risks unauthorized disclosure or legal non-compliance.
- ✓
A declassification review by authorized personnel must be conducted
Why this is correct
This option is correct because declassification is a formal, systematic process that mandates a thorough review by personnel specifically authorized for this task. This review ensures that the information no longer meets the criteria for classification and that its release will not compromise national security, privacy, or other protected interests. It's a critical safeguard against inadvertent disclosure of still-sensitive data and ensures compliance with declassification policies.
- ✗
The document should be shredded and a new version created without classified markings
Why it's wrong here
Shredding the original document and creating a new version without classified markings is an inappropriate response to declassification requirements. Declassification aims to make the *original* information available to a broader audience after it no longer requires protection, often for historical or public record purposes. Destroying the original document prevents this objective, could violate records management policies, and does not constitute a proper declassification action.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.