CISSP Asset Security 4 — Questions and Answers
Question 1: Under GDPR, which role is responsible for processing personal data on behalf of a data controller?
- Data subject
- Data processor (Correct answer)
- Data owner
- Data protection officer
Correct answer: Data processor
A data processor handles personal data under the instructions of the data controller and must comply with GDPR requirements and contractual obligations.
Question 2: What is the PRIMARY security concern with end-of-life (EOL) software still running in a production environment?
- It increases software licensing costs
- It no longer receives security patches, leaving vulnerabilities unmitigated (Correct answer)
- It is incompatible with modern encryption standards
- It violates data retention policies
Correct answer: It no longer receives security patches, leaving vulnerabilities unmitigated
EOL software no longer receives vendor security updates, so discovered vulnerabilities remain permanently unpatched and exploitable in production environments.
Question 3: A cloud provider stores customer data on shared physical servers. Which technique BEST protects customer data from being accessed by other tenants?
- Physical separation of servers
- Data encryption with tenant-specific keys (Correct answer)
- Strong firewall rules between VMs
- Regular penetration testing
Correct answer: Data encryption with tenant-specific keys
Encrypting data with unique per-tenant keys ensures that even if one tenant accesses another's storage, the data remains unreadable without the correct decryption key.
Question 4: Which of the following BEST describes the concept of 'scoping' in security baseline selection?
- Reducing the number of controls applied based on the specific environment and mission (Correct answer)
- Expanding controls to cover additional assets beyond minimum requirements
- Selecting which regulatory framework applies to the organization
- Defining the boundary of the information system
Correct answer: Reducing the number of controls applied based on the specific environment and mission
Scoping allows organizations to eliminate controls that are not applicable to their specific environment, technology, or operational requirements while maintaining the intent of the baseline.
Question 5: What is the MAIN risk of storing sensitive data in personally identifiable information (PII) beyond its required retention period?
- Increased storage costs
- Higher exposure to breach liability and regulatory penalties (Correct answer)
- Reduced data quality over time
- Difficulty in data retrieval
Correct answer: Higher exposure to breach liability and regulatory penalties
Retaining PII beyond the defined period unnecessarily increases breach exposure and violates privacy regulations like GDPR and CCPA, resulting in significant legal and financial penalties.
Question 6: Which approach to data collection is required by the privacy principle of data minimization?
- Collect all available data to support future analytics
- Collect only the data necessary to fulfill the stated purpose (Correct answer)
- Encrypt all collected data at the point of collection
- Anonymize all data before storage
Correct answer: Collect only the data necessary to fulfill the stated purpose
Data minimization requires organizations to collect only the personal data that is adequate, relevant, and limited to what is necessary for the specified purpose.
Question 7: A security team discovers that backup tapes contain unencrypted PHI and are transported offsite by a courier. Which is the BEST immediate remediation?
- Replace courier with a more reputable company
- Encrypt backup data before writing to tape (Correct answer)
- Require the courier to sign a BAA
- Store backups onsite only
Correct answer: Encrypt backup data before writing to tape
Encrypting data on the tape before transport ensures that even if the tape is lost or stolen in transit, the PHI remains unreadable and the breach reporting obligation may not apply.
CISSP Asset Security 4
Under GDPR, which role is responsible for processing personal data on behalf of a data controller?