CISSP Asset Security 4

Question 1

Under GDPR, which role is responsible for processing personal data on behalf of a data controller?

Accepted Answer

Data processor

Answer

A data processor handles personal data under the instructions of the data controller and must comply with GDPR requirements and contractual obligations.

Question 2

What is the PRIMARY security concern with end-of-life (EOL) software still running in a production environment?

Accepted Answer

It no longer receives security patches, leaving vulnerabilities unmitigated

Answer

EOL software no longer receives vendor security updates, so discovered vulnerabilities remain permanently unpatched and exploitable in production environments.

Question 3

A cloud provider stores customer data on shared physical servers. Which technique BEST protects customer data from being accessed by other tenants?

Accepted Answer

Data encryption with tenant-specific keys

Answer

Encrypting data with unique per-tenant keys ensures that even if one tenant accesses another's storage, the data remains unreadable without the correct decryption key.

Question 4

Which of the following BEST describes the concept of 'scoping' in security baseline selection?

Accepted Answer

Reducing the number of controls applied based on the specific environment and mission

Answer

Scoping allows organizations to eliminate controls that are not applicable to their specific environment, technology, or operational requirements while maintaining the intent of the baseline.

Question 5

What is the MAIN risk of storing sensitive data in personally identifiable information (PII) beyond its required retention period?

Accepted Answer

Higher exposure to breach liability and regulatory penalties

Answer

Retaining PII beyond the defined period unnecessarily increases breach exposure and violates privacy regulations like GDPR and CCPA, resulting in significant legal and financial penalties.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Asset Security 4