hardMultiple ChoiceObjective-mapped
CISSP Practice Question: The security architect for a multinational…
You are the security architect for a multinational corporation that handles highly sensitive intellectual property (IP) and personally identifiable information (PII) for clients in multiple jurisdictions, including GDPR and CCPA regions. The company recently experienced a data breach where an attacker exfiltrated 50 GB of data from a file server by exploiting a vulnerability in the backup software. The backup software had been configured with default credentials and was accessible from the internet. The security team has implemented compensating controls, but management wants to prevent such incidents in the future. You have been asked to recommend a long-term strategy to protect sensitive data assets. The budget is limited, and the solution must minimize user friction. Current environment: On-premises Active Directory with Windows file servers, some data in AWS S3, and a mix of laptops and mobile devices. The organization uses Microsoft 365 for email and collaboration. Which of the following is the BEST course of action?
⚠ Common exam trap
It's easy for candidates to choose MFA or encryption as a silver bullet, but the CISSP exam emphasizes that data classification is the foundational control for protecting sensitive assets, especially when the threat involves data exfiltration via a compromised application, not just unauthorized access or theft of media.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a data classification and labeling solution integrated with endpoint and network DLP to automatically detect and protect sensitive data
Data classification and labeling, integrated with endpoint and network DLP, directly addresses the root cause: the inability to distinguish sensitive data from non-sensitive data. By automatically classifying and labeling IP and PII, the organization can enforce policy-based protections (e.g., blocking exfiltration, applying encryption) without relying solely on perimeter controls. This minimizes user friction by automating detection and response, and it scales across on-premises, cloud (AWS S3), and Microsoft 365 environments, aligning with GDPR and CCPA requirements for data protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a data classification and labeling solution integrated with endpoint and network DLP to automatically detect and protect sensitive data
Why this is correct
This solution directly tackles data protection by identifying sensitive information through classification and applying automated controls via Data Loss Prevention (DLP). Integrating these systems ensures continuous monitoring and enforcement of policies across endpoints, network traffic, and cloud services. This proactive, data-centric approach significantly reduces the risk of unauthorized data exfiltration, regardless of the vector or insider threat, making it the most comprehensive strategy for a multinational corporation.
- ✗
Implement multi-factor authentication (MFA) for all administrative accounts and backup interfaces
Why it's wrong here
While multi-factor authentication (MFA) is crucial for strengthening access control and significantly mitigating credential theft, its primary function is user authentication. MFA does not inherently prevent an authorized user, such as an insider threat, from intentionally or unintentionally exfiltrating sensitive data they have legitimate access to. Furthermore, it offers no protection against attacks exploiting system vulnerabilities that bypass authentication entirely, making it an incomplete data protection solution.
- ✗
Encrypt all data at rest using AES-256 and implement strict key management policies
Why it's wrong here
Encrypting data at rest with AES-256 and robust key management is essential for safeguarding information against physical theft or unauthorized access to storage media. However, this control does not protect data once it is decrypted for processing, in use, or accessed by an authorized entity, even if that entity has malicious intent. It fails to address data exfiltration scenarios where an attacker gains access to the system while the data is active or in transit.
- ✗
Segment the backup network from the production network and enforce strict firewall rules
Why it's wrong here
Network segmentation, including isolating backup networks with strict firewall rules, is a valuable defense-in-depth measure that limits an attacker's lateral movement and contains potential breaches. While it reduces the attack surface by controlling network traffic flow, it does not inherently classify or protect the *content* of sensitive data itself. An authorized user within a segmented network could still exfiltrate sensitive information, as segmentation focuses on network access rather than data-centric controls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.