Asset Security Flashcards
7 cards from real CISSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Asset Security flashcards as text
Which data state requires encryption to protect information being processed by a CPU?
Answer: Data in use
Data in use refers to information actively being processed in memory or CPU registers, which is the most difficult state to protect and requires techniques like secure enclaves.
A company wants to ensure that data is permanently unrecoverable from decommissioned HDDs containing PII. Which method is MOST appropriate?
Answer: Degaussing or physical destruction
Degaussing destroys the magnetic properties of the drive making data unrecoverable, and physical destruction ensures no data can be retrieved from decommissioned media.
Under which data classification level would government information whose unauthorized disclosure could cause serious damage to national security be placed?
Answer: Secret
The Secret classification applies to information whose unauthorized disclosure could cause serious damage to national security, while Top Secret applies when damage would be exceptionally grave.
What is the PRIMARY purpose of a data retention policy?
Answer: To define how long data must be kept and when it must be destroyed
A data retention policy establishes the required storage duration for different data types and mandates secure destruction once that period expires, balancing legal requirements and risk.
Which concept ensures that a user is given only the minimum access rights necessary to perform their job function?
Answer: Least privilege
Least privilege limits user rights and permissions to only what is required for their specific role, reducing the attack surface and limiting damage from compromised accounts.
A data owner has labeled a file as 'Confidential.' Who is responsible for implementing the appropriate security controls on that file?
Answer: The data custodian
The data custodian (typically IT) is responsible for implementing and maintaining the security controls specified by the data owner for protecting the asset.
Which asset management practice involves tracking hardware and software throughout its entire lifecycle from procurement to disposal?
Answer: Asset inventory management
Asset inventory management tracks physical and logical assets across their full lifecycle, ensuring accountability, compliance, and secure decommissioning.