CISSP Asset Security 3

Question 1

Which privacy principle requires that personal data collected for one purpose should not be used for a different purpose without consent?

Accepted Answer

Purpose limitation

Answer

Purpose limitation restricts the use of personal data to the specific purpose declared at the time of collection, which is a core GDPR and privacy principle.

Question 2

An organization stores customer credit card data. Under PCI DSS, what is the MINIMUM protection required for stored Primary Account Numbers (PAN)?

Accepted Answer

Any of: truncation, tokenization, hashing, or encryption

Answer

PCI DSS allows PANs to be rendered unreadable via truncation, tokenization, one-way hashing, or strong encryption — organizations may choose any of these approved methods.

Question 3

What is the MAIN difference between data marking and data labeling?

Accepted Answer

Marking is a visible classification indicator; labeling includes metadata embedded in the file

Answer

Data marking refers to visible human-readable classification indicators on documents, while labeling typically embeds classification metadata within digital files for automated handling.

Question 4

Which sanitization method is appropriate for reusing a hard drive within the SAME security domain?

Accepted Answer

Purging (overwriting)

Answer

Purging (overwriting with multiple passes) is sufficient for media being reused within the same security domain where the classification level remains constant.

Question 5

A CISO needs to ensure that sensitive R&D files on employee laptops remain protected even if the laptops are stolen. Which control BEST addresses this risk?

Accepted Answer

Full-disk encryption (FDE)

Answer

Full-disk encryption protects data at rest on stolen or lost devices by making stored data unreadable without the correct decryption key.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Asset Security 3