Asset Security — CISSP practice questions

Printed reports containing restricted data are routinely left in shared printer trays. Which handling control addresses this MOST directly?

1. Encrypting the report files stored on the reporting server
2. Requiring restricted reports to be reviewed by the data owner quarterly
3. Marking output and requiring authenticated release at the device
4. Adding a clause on printed material to the acceptable use policy

Answer: C — Marking output and requiring authenticated release at the device

C) Correct — handling requirements combine visible marking, so anyone can recognise sensitivity, with a release mechanism that keeps output from appearing before the recipient is present. A) protects the stored file but not the printed copy, which is where the exposure occurs. B) is periodic oversight and does nothing about daily handling. D) is necessary policy support but relies entirely on voluntary compliance with no enforcement at the device.

A firm operates in several jurisdictions with conflicting obligations: one requires citizen data to remain in-country, another grants broad deletion rights. Which approach is MOST appropriate?

1. Apply the least restrictive requirement globally to keep operations simple
2. Apply the requirements of the jurisdiction where headquarters is located
3. Map obligations per data set and engineer to the strictest applicable
4. Store all data in a single jurisdiction chosen for its favourable privacy regime

Answer: C — Map obligations per data set and engineer to the strictest applicable

C) Correct — conflicting regimes are handled by mapping which obligations attach to which data and population, then designing controls to satisfy the strictest applicable requirement for each. A) guarantees non-compliance in the stricter jurisdiction. B) is a common misconception — the headquarters location does not displace obligations tied to where data subjects reside. D) directly violates the localisation requirement described in the stem.

Which is the BEST control to ensure media is properly labeled throughout its lifecycle?

1. Encrypting all media at rest regardless of the classification assigned to the content it holds
2. Restricting all classified media to a single physical location under continuous camera coverage
3. Documented labeling standards aligned to the classification scheme and maintained through handling
4. Requiring biometric authentication before any labeled media may be retrieved from the store

Answer: C — Documented labeling standards aligned to the classification scheme and maintained through handling

C) Correct: labeling is only reliable when a documented standard ties labels to the classification scheme, applies them at creation, and requires them to be preserved through copying, transport, storage and disposal. A) Encryption protects the content but conveys nothing about how it must be handled. B) Concentrating media in one location is impractical and still leaves each item unlabeled. D) Biometric access controls who may retrieve media, which is a separate control objective from marking it.

Which classification of data should carry the strictest controls?

1. Top Secret or restricted data held on a need-to-know basis
2. Public data already approved for unrestricted external release
3. Internal business data intended for general employee consumption
4. Unclassified material carrying no disclosure restrictions at all
5. Marketing collateral prepared for wide customer distribution

Answer: A — Top Secret or restricted data held on a need-to-know basis

A is the level whose disclosure would cause the gravest damage, so it attracts the strictest access, encryption, handling, labeling, and destruction requirements. B, D, and E are all approved for release or carry no restriction, so protective spend on them is wasted. C sits in the middle: internal data needs baseline controls but not compartmentalized access. The controlling principle is that controls are calibrated to classification, not applied uniformly.

Decommissioned solid-state drives that held confidential data must be reused in a lower-classification environment. Why is degaussing NOT an appropriate sanitisation method?

1. SSDs store data in flash cells that a magnetic field does not erase
2. Degaussing destroys the drive electronics, preventing any later reuse
3. Degaussing only removes file system pointers rather than the data itself
4. Degaussing requires the drive to be powered and mounted to take effect

Answer: A — SSDs store data in flash cells that a magnetic field does not erase

A) Correct — degaussing works by disrupting magnetic domains, and flash memory stores charge in cells, so the technique has no effect on an SSD. B) is true of magnetic hard drives, where degaussing does render the drive unusable, but that is not why it fails on an SSD. C) describes a simple delete or format, not degaussing. D) invents an operating requirement that does not exist.

An organization stores customer data in a cloud region located in another country. Which concern is MOST directly raised?

1. Data sovereignty — the data may fall under the laws of the country where it is physically stored
2. Data quality — records may degrade as network latency increases between the two regions involved
3. Key lifecycle — encryption keys may expire more quickly when held in foreign data centre facilities
4. Backup integrity — geographic separation may corrupt copies replicated to the distant region

Answer: A — Data sovereignty — the data may fall under the laws of the country where it is physically stored

A) Correct: storing data in another jurisdiction subjects it to that country's law, including government access powers, retention mandates and disclosure obligations, and may conflict with the obligations that apply at home. B) Latency affects performance and is measured in milliseconds; it does not alter stored records. C) Key validity periods are set by policy and the key management system, not by the geography of the data centre. D) Replication distance does not corrupt data; integrity is protected by checksums and verification regardless of distance.

A merchant tokenises card numbers at capture so that no system beyond the payment gateway stores a primary account number. What is the MAIN compliance benefit under the current PCI DSS version?

1. Reduced scope, because systems that never store card data fall outside assessment
2. Exemption from assessment entirely, because tokens are not cardholder data
3. Automatic satisfaction of every encryption-at-rest requirement that applies to stored data
4. Elimination of the need for network segmentation in the merchant environment

Answer: A — Reduced scope, because systems that never store card data fall outside assessment

A) Correct — under PCI DSS 4.0.1, removing cardholder data from systems reduces the assessment scope, which is the principal reason merchants tokenise. B) overstates the effect: scope shrinks but the merchant is still assessed for the systems that remain in scope. C) is a half-right claim — tokenisation reduces what must be protected but does not automatically satisfy requirements for data that is still stored. D) is a misconception: segmentation remains a key scope-reduction technique and is not eliminated.

A bank must run analytics on customer records held by a third-party cloud provider without exposing plaintext to the provider's administrators during processing. Which protection addresses the data-in-use state?

1. Transport layer encryption between the bank and the provider's endpoint
2. Full disk encryption on the provider's storage nodes with bank-held keys
3. Confidential computing using trusted execution enclaves
4. Tokenising the records before upload and detokenising after processing

Answer: C — Confidential computing using trusted execution enclaves

C) Correct — data in use is the state where plaintext exists in memory, and hardware-backed enclaves are the protection designed to keep it isolated from the host operator during processing. A) addresses data in transit only. B) addresses data at rest and is bypassed once data is decrypted for computation. D) is a strong technique but if analytics must operate on real values, detokenising restores plaintext into the same exposed processing state.

Under NIST SP 800-88, which sanitization method is appropriate for moderately classified media that will leave organizational control and pass to a media-handling vendor?

1. Clear, applying logical overwrite techniques that resist recovery through the standard interfaces
2. Purge, rendering the data infeasible to recover even with state-of-the-art laboratory techniques
3. Destroy, physically shredding or disintegrating the media so that it can no longer be used at all
4. No sanitization, relying on the confidentiality clauses in the media-handling vendor's contract

Answer: B — Purge, rendering the data infeasible to recover even with state-of-the-art laboratory techniques

B) Correct: once media leaves organizational control, the resistance level must rise beyond keyboard-level recovery, and purge is the technique defined to defeat laboratory attack while leaving the media reusable. A) Clear is appropriate where the media stays under organizational control and only casual recovery is in scope. C) Destroy is warranted for highly sensitive data or genuine end-of-life, and forfeits the reuse value the scenario implies. D) Contractual clauses allocate liability after the fact and are not a sanitization technique.

A DLP programme generates poor results because rules are written against generic patterns. Which change would MOST improve accuracy?

1. Integrate DLP with classification labels applied at or near data creation
2. Extend inspection to cover additional egress channels such as web and cloud
3. Increase the sensitivity threshold so fewer matches are required to trigger
4. Move enforcement decisions from automated blocking to manual review queues

Answer: A — Integrate DLP with classification labels applied at or near data creation

A) Correct — DLP is only as good as its knowledge of what matters; consuming persistent classification labels applied at creation lets policy act on identified sensitive data rather than guessing from patterns. B) broadens coverage while carrying the same inaccurate logic to more channels. C) is a direction reversal that raises false positives, worsening the stated problem. D) manages the consequences of inaccuracy through human effort instead of improving detection.

What is the difference between DLP at rest, in motion, and in use?

At rest: scans storage. In motion: inspects network traffic. In use: agent on endpoint monitors clipboard, file actions, removable media. Comprehensive coverage needs all three.

What is tokenization?

Replacing sensitive data with a token (random reference) stored in a secure vault. Original data retrievable only via the vault. Common for PCI scope reduction.

Name the principal data roles and state who bears accountability for classification decisions.

Data owner (or information owner) — a senior business role accountable for classification, valuation and authorising access; accountability cannot be delegated. Data controller — determines purposes and means of processing. Data processor — processes on the controller's instructions. Data custodian — implements and operates the controls the owner specifies. Data steward — maintains data quality and business meaning. Data subject — the individual the personal data describes.

What is the role of a data owner?

Senior management responsible for the protection and use of a specific dataset. Approves access, classifies data, sets retention. Often a business unit head.