CISSP Asset Security: 120 practice questions

12 of the 120 Asset Security questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Delete unnecessary location and contact data after: Which TWO controls most directly address this failure?

Select two. More than one option is correct — every correct one is ticked below.

1. Add a confidential label to every collected field.

   Classification supports handling decisions, but labeling does not minimize collection or establish deletion timing.
2. Delete unnecessary location and contact data after the defined safety period. ✓

   Retention limits remove data no longer needed, directly addressing indefinite storage after the safety purpose ends.
3. Encrypt the entire database using organization-approved encryption.

   Encryption protects stored data from unauthorized access but does not reduce unnecessary collection or indefinite retention.
4. Segment the application database from manufacturing networks.

   Segmentation limits network exposure, but the demonstrated failure concerns excessive fields and indefinite retention.
5. Define and document the minimum fields required for safety alerts. ✓

   Data minimization starts by limiting collection to fields necessary for the stated safety purpose.

Specify only necessary fields and delete them when the defined safety purpose no longer requires retention.

2. Require the designated data owner to classify datasets: Which approach should the security manager approve?

1. Allow each analyst to select a label based on personal risk tolerance.

   Individual discretion creates inconsistent classifications and bypasses the policy's designated owner and decision criteria.
2. Classify every customer dataset as restricted to eliminate judgment.

   Uniform highest classification ignores organization-defined criteria and can impose unnecessary handling and access burdens.
3. Require the designated data owner to classify datasets using the approved policy. ✓

   The stated policy assigns classification to the data owner, who evaluates business and disclosure consequences.
4. Let the database administrator classify data because storage access determines sensitivity.

   Storage administration provides technical context, but does not establish business ownership or authorized classification authority.

The designated data owner must classify datasets under the organization’s documented classification criteria.

3. Combine DLP for endpoint transfers with rights management: Which approach best resolves the requirements?

1. Use data rights management alone because persistent restrictions prevent every transfer.

   Rights management can enforce usage restrictions, but the requirement also needs endpoint movement detection and blocking.
2. Encrypt all files and rely on recipients to follow handling instructions.

   Encryption protects content in transit or storage, but does not independently detect transfers or enforce recipient behavior.
3. Use DLP alone because it already detects sensitive transfers.

   DLP can restrict defined movements, but its stated limitation prevents enforcing permissions after authorized download.
4. Combine DLP for endpoint transfers with rights management for downloaded files. ✓

   DLP addresses detected movement, while rights management maintains authorized usage restrictions after download.

Use DLP for movement controls and rights management for restrictions that persist after authorized downloads.

4. Use stronger controls for higher classes and document: What is the best response?

1. Apply identical controls because consistent handling eliminates classification errors.

   Uniform controls ignore policy-defined differences and may underprotect restricted information or overburden low-risk information.
2. Apply restricted controls universally, then remove them only when owners request relief.

   Universal maximum controls create unnecessary burden and reverse the policy’s classification-based proportionality.
3. Use stronger controls for higher classes and document owner-approved exceptions. ✓

   This follows risk-based handling requirements while preserving the policy’s explicit exception process and accountability.
4. Let each administrator choose controls according to operational convenience.

   Administrator discretion bypasses classification policy and produces inconsistent protection without accountable owner approval.

Increase protection with classification and use documented business-owner approvals for permitted exceptions.

5. Partner: Which role is the asset owner?

1. Partner ✓

   The partner is accountable for business impact and classification, matching the policy’s definition of asset ownership.
2. IT storage operator

   IT operates the repository technically, but technical custody does not establish accountability for business impact.
3. Engagement team

   The team uses the data, but usage alone does not assign accountability for classification and business impact.
4. Records manager

   The records manager controls retention, but operational retention responsibility does not establish business ownership.

The partner owns the repository because policy ties ownership to business impact and classification accountability.

6. Suspend deletion for records within the documented hold: What should the security manager recommend?

1. Suspend all automated deletion until the dispute ends.

   The hold covers specific records, so a universal suspension exceeds the stated scope and may conflict with ordinary retention controls.
2. Continue scheduled deletion unless a court separately orders preservation.

   The documented legal hold is sufficient scenario evidence that ordinary deletion must be limited for covered records; a separate court order is not stated as necessary.
3. Suspend deletion for records within the documented hold. ✓

   This limits the exception to identified records and prevents routine deletion from destroying potentially relevant evidence.
4. Copy held records elsewhere, then delete the originals under the schedule.

   Deleting originals can violate the hold, and the scenario provides no authorization for destruction after copying.

Suspend routine deletion only for records covered by the documented legal hold.

7. The new fraud-analysis purpose requires owner-approved: Which TWO conclusions are justified?

Select two. More than one option is correct — every correct one is ticked below.

1. Device identifiers and advertising IDs may be reused without review because they were collected lawfully.

   Prior collection does not automatically authorize a different purpose or resolve new access and retention requirements.
2. The seven-year schedule automatically authorizes retaining every collected field.

   The policy separately requires deleting fields no longer needed, so the schedule does not justify indefinite field retention.
3. The new fraud-analysis purpose requires owner-approved review before repurposing the collected fields. ✓

   Using data for a new purpose requires authorized review of purpose, access, classification, and retention implications.
4. The advertising ID becomes necessary solely because fraud analysis is proposed.

   A proposal does not establish necessity or authorization; the owner must approve and define the revised purpose.
5. The advertising ID is unnecessary for the original eligibility purpose and should be removed when no longer needed. ✓

   The exhibit identifies the advertising ID as unrelated to eligibility, supporting minimization and deletion when unnecessary.

Remove unnecessary fields and obtain owner-approved review before changing the dataset’s purpose.

8. Pseudonymization and restricted access do not eliminate: What residual limitation remains?

1. Encryption automatically prevents analysts from combining dashboard data with public schedules.

   Authorized analysts can use decrypted data, and encryption does not control external correlation or inference.
2. Aggregation guarantees that individual drivers cannot be identified.

   Aggregation reduces direct identification but does not prevent inference when combinations remain linkable to public information.
3. Pseudonymization and restricted access do not eliminate linkage and reidentification risk. ✓

   Correlating remaining attributes with public information can identify individuals despite pseudonyms, access controls, and encryption.
4. Encryption cannot protect the dashboard while analysts actively process it.

   Encryption protects stored or transmitted data, but the described limitation is reidentification during authorized analytical use.

Pseudonymization and aggregation reduce exposure but cannot prevent reidentification through linkage with public information.

9. Masking obscures values but does not substitute: Which diagnosis is most accurate?

1. Masking obscures values but does not substitute independent tokens. ✓

   Masking changes visible presentation while leaving underlying values or recognizable patterns available to authorized processes.
2. Encryption failed because repeated masked values prove plaintext exposure.

   Repeated masked values demonstrate distinguishability, not necessarily disclosure of plaintext or failure of encryption.
3. Classification failed because all identifiers must be irreversibly anonymized.

   The stated display-obscuration requirement does not require irreversible anonymization or a different classification.
4. Tokenization failed because the mapping vault was unavailable.

   No tokenization requirement or mapping vault is established, so this diagnosis invents an unstated implementation.

Masking hides presentation; tokenization substitutes surrogates, and the scenario requires only display obscuration.

10. The transfer control failed because transit protection was: What is the best diagnosis?

1. The portal must tokenize every file before transmission.

   Tokenization is not the stated transit requirement and would not replace required protection of the communication path.
2. The approved portal is sufficient because stored encryption protects the files.

   Stored encryption protects data at rest, but it does not protect restricted files while traveling across the connection.
3. The transfer control failed because transit protection was absent. ✓

   The policy explicitly requires protection during movement, which stored encryption cannot provide for the transfer path.
4. The files were misclassified because restricted data cannot use portals.

   The policy permits the portal conditionally, so classification does not prohibit portal use by itself.

Encryption at rest does not satisfy a policy requiring protection while restricted files move.

11. Update the repository to the approved configuration: What corrective action should occur first?

1. Ask the data owner to perform the technical configuration change.

   The custodian is explicitly responsible for implementing approved safeguards and can perform this change.
2. Reclassify the repository before changing its backup configuration.

   The scenario confirms classification remains valid, so reclassification would not correct the tested implementation failure.
3. Update the repository to the approved configuration and report completion. ✓

   The custodian must implement the owner-approved safeguard, then provide evidence that the failed control was corrected.
4. Suspend all remote clinical access until the owner rewrites policy.

   The facts identify a correctable repository configuration issue, not a need to suspend all service access.

The custodian implements the approved safeguard; the owner’s classification and access decisions remain unchanged.

12. The controller remains unable to receive vendor fixes: What residual limitation must management still recogniz

1. Monitoring makes vendor support unnecessary because attacks become impossible.

   Monitoring can detect activity, but it cannot guarantee prevention or replace unavailable security updates.
2. Segmentation proves the controller no longer has exploitable vulnerabilities.

   Isolation reduces exposure but does not remove vulnerabilities embedded in unsupported software or firmware.
3. The controller remains unable to receive vendor fixes, so residual vulnerabilities persist. ✓

   Compensating controls reduce likelihood or exposure, but unsupported software still lacks vendor remediation for inherent weaknesses.
4. Restricted administration eliminates all risk from the unsupported controller.

   Administrative restriction narrows access paths but does not eliminate every vulnerability or operational dependency.

Compensating controls reduce exposure but cannot provide unavailable vendor patches or eliminate underlying vulnerabilities.

Other CISSP domains

• Security and Risk Management — 192 questions →
• Security Architecture and Engineering — 156 questions →
• Communication and Network Security — 156 questions →
• Identity and Access Management (IAM) — 156 questions →
• Security Operations — 156 questions →
• All 1200 CISSP questions →
• CISSP certification: requirements, cost and exam format →