CISSP Asset Security 3 — Questions and Answers
Question 1: Which privacy principle requires that personal data collected for one purpose should not be used for a different purpose without consent?
- Data minimization
- Purpose limitation (Correct answer)
- Storage limitation
- Accuracy
Correct answer: Purpose limitation
Purpose limitation restricts the use of personal data to the specific purpose declared at the time of collection, which is a core GDPR and privacy principle.
Question 2: An organization stores customer credit card data. Under PCI DSS, what is the MINIMUM protection required for stored Primary Account Numbers (PAN)?
- Hashing or tokenization
- Encryption with AES-256
- Truncation to the last four digits only
- Any of: truncation, tokenization, hashing, or encryption (Correct answer)
Correct answer: Any of: truncation, tokenization, hashing, or encryption
PCI DSS allows PANs to be rendered unreadable via truncation, tokenization, one-way hashing, or strong encryption — organizations may choose any of these approved methods.
Question 3: What is the MAIN difference between data marking and data labeling?
- Marking applies to physical documents; labeling applies to digital files
- Marking is a visible classification indicator; labeling includes metadata embedded in the file (Correct answer)
- Marking is for government data; labeling is for commercial data
- They are synonymous terms in CISSP
Correct answer: Marking is a visible classification indicator; labeling includes metadata embedded in the file
Data marking refers to visible human-readable classification indicators on documents, while labeling typically embeds classification metadata within digital files for automated handling.
Question 4: Which sanitization method is appropriate for reusing a hard drive within the SAME security domain?
- Physical destruction
- Degaussing
- Purging (overwriting) (Correct answer)
- Declassification
Correct answer: Purging (overwriting)
Purging (overwriting with multiple passes) is sufficient for media being reused within the same security domain where the classification level remains constant.
Question 5: A CISO needs to ensure that sensitive R&D files on employee laptops remain protected even if the laptops are stolen. Which control BEST addresses this risk?
- Strong login passwords
- Full-disk encryption (FDE) (Correct answer)
- Network access control (NAC)
- Endpoint antivirus software
Correct answer: Full-disk encryption (FDE)
Full-disk encryption protects data at rest on stolen or lost devices by making stored data unreadable without the correct decryption key.
Question 6: Which term describes the legal authority to determine how data is classified and who may access it?
- Data custodian
- Data processor
- Data owner (Correct answer)
- Data steward
Correct answer: Data owner
The data owner, typically a senior business manager, has the authority and responsibility to classify data, set access policies, and determine handling requirements.
Question 7: Which control helps prevent sensitive data from leaving an organization via email or USB drives?
- Intrusion Detection System (IDS)
- Data Loss Prevention (DLP) (Correct answer)
- Security Information and Event Management (SIEM)
- Web Application Firewall (WAF)
Correct answer: Data Loss Prevention (DLP)
Data Loss Prevention (DLP) solutions monitor and block the unauthorized transmission of sensitive data across various egress channels including email, USB, and cloud uploads.
CISSP Asset Security 3
Which privacy principle requires that personal data collected for one purpose should not be used for a different purpose without consent?