CISSP Asset Security 2 — Questions and Answers
Question 1: Which data state requires encryption to protect information being processed by a CPU?
- Data at rest
- Data in transit
- Data in use (Correct answer)
- Data in archive
Correct answer: Data in use
Data in use refers to information actively being processed in memory or CPU registers, which is the most difficult state to protect and requires techniques like secure enclaves.
Question 2: A company wants to ensure that data is permanently unrecoverable from decommissioned HDDs containing PII. Which method is MOST appropriate?
- Deleting all files and emptying the recycle bin
- Performing a single-pass overwrite
- Degaussing or physical destruction (Correct answer)
- Formatting the drive using the OS
Correct answer: Degaussing or physical destruction
Degaussing destroys the magnetic properties of the drive making data unrecoverable, and physical destruction ensures no data can be retrieved from decommissioned media.
Question 3: Under which data classification level would government information whose unauthorized disclosure could cause serious damage to national security be placed?
- Confidential
- Secret (Correct answer)
- Top Secret
- Sensitive But Unclassified
Correct answer: Secret
The Secret classification applies to information whose unauthorized disclosure could cause serious damage to national security, while Top Secret applies when damage would be exceptionally grave.
Question 4: What is the PRIMARY purpose of a data retention policy?
- To ensure data is backed up daily
- To define how long data must be kept and when it must be destroyed (Correct answer)
- To restrict who can access sensitive data
- To classify data according to sensitivity
Correct answer: To define how long data must be kept and when it must be destroyed
A data retention policy establishes the required storage duration for different data types and mandates secure destruction once that period expires, balancing legal requirements and risk.
Question 5: Which concept ensures that a user is given only the minimum access rights necessary to perform their job function?
- Separation of duties
- Need to know
- Least privilege (Correct answer)
- Job rotation
Correct answer: Least privilege
Least privilege limits user rights and permissions to only what is required for their specific role, reducing the attack surface and limiting damage from compromised accounts.
Question 6: A data owner has labeled a file as 'Confidential.' Who is responsible for implementing the appropriate security controls on that file?
- The data owner
- The data custodian (Correct answer)
- The data user
- The security officer
Correct answer: The data custodian
The data custodian (typically IT) is responsible for implementing and maintaining the security controls specified by the data owner for protecting the asset.
Question 7: Which asset management practice involves tracking hardware and software throughout its entire lifecycle from procurement to disposal?
- Configuration management
- Asset inventory management (Correct answer)
- Change management
- Patch management
Correct answer: Asset inventory management
Asset inventory management tracks physical and logical assets across their full lifecycle, ensuring accountability, compliance, and secure decommissioning.
CISSP Asset Security 2
Which data state requires encryption to protect information being processed by a CPU?