CISSP Practice Set_01: Asset Security_2

Home » CISSP Practice Set_01: Asset Security_2

Asset Security

Domain 02 Practice Set: 01

CISSP DOMAIN 02: Asset Security (Assessment Mode)

CISSP Domain 2: Asset Security. This domain focuses on the concepts, principles, structures, and standards used to monitor and secure assets, emphasizing the importance of classification, ownership, and the protection of privacy and personal information.

Domain 02: Practice Set 01

Disclaimer: The practice exam questions provided are representative of the certification exam, but not the actual questions you will see on the certification exam. Practice exams are for self-assessment.

Page : 1/10

1. An organization needs to transfer sensitive data between its headquarters and a remote office. Which of the following is the MOST secure method to ensure data confidentiality and integrity during transmission?

A) FTP

B) HTTP

C) VPN

D) SMTP

2. An organization is implementing a data classification policy. Which of the following is the MOST important reason for classifying data?

A) To ensure data is encrypted at rest and in transit.

B) To facilitate the appropriate level of security controls.

C) To accelerate data discovery and retrieval processes.

D) To reduce storage costs by archiving old data.

3. Which of the following best describes the purpose of an information retention policy?

A) To define the time frame for which information must be kept before it can be deleted.

B) To ensure that information is encrypted while stored in the organization's systems.

C) To prevent unauthorized access to information by implementing access controls.

D) To facilitate the sharing of information within the organization.

4. Which of the following is NOT a method of protecting data at rest?

A. Encryption

B. Access Controls

C. Data Masking

D. Intrusion Detection Systems (IDS)

5. Which of the following is true about information labeling?

A. It is a process exclusively used for top secret government data.

B. It involves marking physical and digital data with labels indicating the sensitivity and handling requirements.

C. It is a form of encryption.

D. It only applies to digital data, not physical documents.

Page : 2/10

6. When implementing a privacy program, what is the PRIMARY purpose of data minimization?

A) To reduce the cost associated with data storage

B) To limit the organization's liability in case of a data breach

C) To ensure that only necessary data is collected and retained

D) To speed up the data processing and analysis tasks

7. Following a data breach that exposed sensitive customer information, what is the FIRST action an organization should take?

A) Notify affected customers immediately.

B) Launch a marketing campaign to mitigate reputation damage.

C) Conduct a thorough investigation to understand the breach's scope.

D) Update the organization's privacy policy on the website.

8. Which of the following media sanitization methods is MOST appropriate for permanently removing data from a solid-state drive (SSD) before disposal?

A) Degaussing

B) Cryptographic Erase

C) Physical Destruction

D) Overwriting

9. A company wants to prevent sensitive data from being accidentally shared outside the organization. Which technology would be MOST effective in identifying and blocking the transfer of this sensitive data?

A) Intrusion Detection System (IDS)

B) Data Loss Prevention (DLP)

C) Firewall

D) Antivirus

10. What role does classification play in information security?

A. It determines the level of impact to the organization if the confidentiality, integrity, or availability of the data is compromised.

B. It specifies the encryption algorithms to be used for data protection.

C. It defines the software to be used for data loss prevention.

D. It outlines the procedures for data recovery in the event of a disaster

Page : 3/10

11. Which of the following best describes the term "privacy by design"?

A. A regulatory requirement that all organizations must follow

B. A framework that ensures privacy is considered in the initial design stages of projects

C. A technology that automatically encrypts personal data

D. A policy that mandates the use of passwords and two-factor authentication

12. In the context of data lifecycle management, why is it important to securely delete data once it is no longer needed?

A) To free up storage space and reduce storage costs.

B) To comply with data protection regulations and policies.

C) To improve system performance by reducing data clutter.

D) To ensure efficient retrieval of remaining data.

13. Which of the following is true regarding secure data sanitization methods?

A. Formatting a hard drive is sufficient to prevent data from being recovered.

B. Overwriting data with zeros is an effective method for all types of storage media.

C. Degaussing can be used to securely erase data from both HDDs and SSDs.

D. Physical destruction ensures data cannot be reconstructed or retrieved.

14. What is the primary purpose of data classification?

A. To speed up data access

B. To facilitate risk management

C. To ensure data is encrypted

D. To increase storage efficiency

15. What is the primary consideration when implementing encryption for data at rest?

A) The performance impact on the storage system.

B) The geographic location of the data storage.

C) The strength of the encryption algorithm used.

D) The process for managing and storing encryption keys.

Page : 4/10

16. In an organization, who is PRIMARILY responsible for determining the classification level of data?

A) Data User

B) Data Custodian

C) Data Owner

D) IT Support Staff

17. An employee in an organization has access to classified information. Which of the following BEST ensures that this information remains secure?

A) Implementing a bring your own device (BYOD) policy.

B) Conducting regular security awareness training.

C) Applying strict access controls and need-to-know principles.

D) Encouraging the use of personal email for work communication.

18. What is the most critical step to ensure the security of data when an employee leaves the organization?

A) Performing an exit interview.

B) Disabling the employee's network access.

C) Retrieving all company-owned devices and assets.

D) Monitoring the employee's email for suspicious activity.

19. What type of controls are encryption and access control mechanisms considered as?

A. Preventive controls

B. Detective controls

C. Corrective controls

D. Deterrent controls

20. What is the purpose of a data retention policy?

A. To define how long data should be actively used within the organization

B. To ensure that data is encrypted when stored

C. To specify the timeframe for which information must be kept due to legal, regulatory, and business needs

D. To limit the amount of data that can be stored on individual devices

Page : 5/10

21. What does the principle of "least privilege" entail in the context of asset security?

A. Granting users the minimum levels of access—or permissions—needed to perform their job functions

B. Ensuring that all users have access to the information they need to understand company policies

C. Providing users with administrative privileges to ensure that they can manage any issues that arise

D. Granting all users equal access to ensure fairness in the workplace

22. In the context of secure asset disposal, which of the following statements is true about the method of cryptographic erasure?

A. It involves physically destroying the storage medium, making data recovery impossible.

B. It is the process of overwriting data with random data multiple times to ensure it cannot be recovered.

C. It uses encryption keys to render data unreadable and then securely deletes the keys.

D. It relies on degaussing to disrupt the magnetic fields on the storage medium.

23. In asset management, what is the difference between "owners" and "custodians"?

A. Owners are responsible for the maintenance and security of the asset, while custodians are responsible for its strategic management.

B. Owners have legal responsibility and accountability for the asset, while custodians are responsible for its day-to-day management and protection.

C. Owners are external stakeholders, while custodians are internal employee

D. There is no significant difference; the terms are interchangeable.

24. Which of the following is an example of a physical control for protecting assets?

A. Firewalls

B. Encryption

C. Biometric access controls

D. Antivirus software

25. Which of the following best describes the purpose of asset inventory management?

A. To track the physical location of all hardware devices

B. To ensure all software licenses are up to date

C. To maintain a record of all assets and their attributes within an organization

D. To monitor the performance of network devices

Page : 6/10

26. What is the MOST critical benefit of maintaining an up-to-date asset inventory?

A) Facilitating rapid deployment of new technologies

B) Ensuring compliance with software licensing agreements

C) Identifying unauthorized devices on the network

D) Optimizing costs associated with asset maintenance

27. Which of the following is the MOST secure method for disposing of paper records containing sensitive information?

A) Recycling

B) Shredding

C) Incineration

D) Placing in a secure trash bin

28. What is the primary reason for implementing privacy controls within an organization

A. To monitor employee activities

B. To protect the organization's intellectual property

C. To protect the personal information of individuals

D. To prevent external attacks on the organization's network

29. Which of the following is the PRIMARY purpose of establishing data handling policies within an organization?

A) To comply with international data protection regulations

B) To define roles and responsibilities in data management

C) To ensure that data is handled consistently and securely across the organization

D) To facilitate data processing and analysis

30. What is the primary purpose of implementing a data leakage prevention (DLP) system?

A. To detect and prevent unauthorized transmission of information outside the organization

B. To encrypt data stored on mobile devices

C. To ensure data integrity by applying digital signatures

D. To increase the availability of data through redundancy

Page : 7/10

31. Which of the following is an example of a physical control for asset security?

A. Firewalls

B. Encryption

C. Security guards

D. Anti-virus software

32. Your organization is implementing an information classification program. Which of the following is the primary reason for classifying information?

A. To determine the level of encryption required for data at rest.

B. To ensure appropriate levels of access control are applied to information assets.

C. To facilitate regulatory compliance.

D. To reduce the cost of storage by archiving old data.

33. What is the purpose of employing data masking techniques?

A) To enhance the physical security of data storage devices

B) To prevent unauthorized access to data by making it unintelligible without a decryption key.

C) To protect sensitive data by replacing it with fictional but realistic data in non-production environments.

D) To ensure data integrity by automatically correcting errors that occur during data transmission.

34. Which of the following best explains the concept of a data custodian?

A. The individual who creates the data

B. The individual responsible for securing and maintaining the data assets

C. The CEO of the company

D. The individual who has the authority to classify data

35. What principle ensures that data can only be accessed or modified by authorized users?

A. Availability

B. Integrity

C. Confidentiality

D. Accountability

Page : 8/10

36. An organization has developed a new data retention policy. Which of the following factors is MOST crucial when determining the retention period for specific types of data?

A. The cost of storage

B. Regulatory and legal requirements

C. The format of the data (e.g., digital vs. paper)

D. The frequency of data access

37. Which of the following best describes the purpose of data anonymization in protecting privacy?

A. To encrypt data so that it can only be accessed by authorized users

B. To remove or modify personal information so that individuals cannot be identified

C. To monitor and log access to personal data

D. To ensure that data is destroyed after a certain period

38. Which of the following scenarios exemplifies a violation of data privacy principles?

A) An organization encrypts employee personal information stored in its database.

B) A healthcare provider shares patient medical records with a third party without patient consent.

C) A company implements access controls to limit who can view customer data.

D) An IT department regularly patches and updates software to protect data integrity.

39. What is a common method for securely erasing data from a solid-state drive (SSD)?

A. Degaussing

B. Overwriting

C. Physical destruction

D. Repartitioning

40. Which of the following best describes the concept of data ownership?

A. The individual who created the data

B. The IT department that manages the data storage

C. The business unit that uses the data most frequently

D. The individual or entity responsible for the data's control and use

Page : 9/10

41. When storing highly sensitive data in a cloud storage service, which of the following practices is MOST important to ensure the confidentiality and integrity of the data?

A) Use of multi-factor authentication for access control

B) Regularly updating the cloud storage application

C) Encrypting data before it is uploaded to the cloud

D) Choosing a cloud provider with servers in the same country

42. What is the MOST important factor to consider when determining the methods for secure disposal of data?

A) The cost of the disposal method.

B) The environmental impact of the disposal method.

C) The sensitivity of the data being disposed of

D) The time required to complete the disposal process.

43. What is the main goal of information labeling and handling policies?

A. To ensure data is encrypted at all times

B. To standardize the interfaces for data access

C. To dictate how information is marked to reflect its sensitivity and how it should be handled

D. To define the roles and responsibilities of data users

44. What is the purpose of an information retention policy?

A. To define how long information should be kept before it is destroyed

B. To ensure that all data is encrypted

C. To prevent unauthorized access to information systems

D. To detail the procedures for backing up data

45. Which of the following best defines "privacy"?

A. The protection of confidential corporate information

B. The right of individuals to control their personal information

C. The security measures taken to protect data in transit

D. The process of encrypting data

Page : 10/10

46. What is the PRIMARY purpose of implementing controls to protect intellectual property rights within an organization?

A) To facilitate the sharing of proprietary information within the industry.

B) To ensure legal compliance and prevent unauthorized use or disclosure.

C) To encourage innovation by providing public access to research findings.

D) To increase the company's market share by openly licensing its products.

47. What is the purpose of digital rights management (DRM)?

A. To manage digital identities

B. To control and protect copyrighted digital media

C. To ensure data integrity

D. To protect data in transit

48. What is a primary goal of implementing data retention policies?

A. To ensure data is available for as long as it is needed

B. To comply with data protection regulations

C. To reduce the cost of data storage

D. Both A and B are correct

49. Why is it important to have a secure data destruction policy?

A. To ensure data is backed up before deletion

B. To prevent unauthorized access to sensitive information after it is no longer needed

C. To increase the efficiency of data storage systems

D. To comply with software licensing agreements

50. Which of the following best exemplifies the principle of Privacy by Design?

A) Retrofitting privacy controls into an existing system.

B) Implementing the strictest privacy settings by default.

C) Conducting a privacy impact assessment after system deployment.

D) Limiting user access to privacy settings.

CISSP Practice Test, Quiz & Flashcards

5

CISSP Practice Sets

250

Questions

5.8

Test Submited by Users

info@sajinshivdas.com

Abu Dhabi, UAE

twitter
facebook
youtube
behance

Close Menu

Home
Cybersecurity Blog
Cybersecurity Tools
Computer Forensics
AboutUs

Asset Security

Domain 02 Practice Set: 01

CISSP DOMAIN 02: Asset Security (Assessment Mode)

Domain 02: Practice Set 01

Disclaimer: The practice exam questions provided are representative of the certification exam, but not the actual questions you will see on the certification exam. Practice exams are for self-assessment.

CISSP Practice Test, Quiz & Flashcards

More practice question and flash cards

Risk & Security Management

Asset Security

Security Architecture & Engineering

Communication & Network Security

Identity & Access Management

CISSP Practice Sets Status

5

250

5.8

info@sajinshivdas.com