CISSP Asset Security 5

Question 1

Which framework provides a standardized vocabulary for describing hardware and software asset information to support vulnerability management?

Accepted Answer

Common Platform Enumeration (CPE)

Answer

Common Platform Enumeration (CPE) is a structured naming scheme for IT systems, software, and packages that enables consistent identification of assets in vulnerability databases like NVD.

Question 2

An employee transfers to a new role with different access requirements. Which process ensures their old access rights are removed?

Accepted Answer

Privilege creep prevention via access reviews

Answer

Regular access reviews and timely revocation of previous role permissions prevent privilege creep, where users accumulate access rights beyond what their current role requires.

Question 3

Which type of data classification is MOST common in private sector organizations?

Accepted Answer

Public / Internal / Confidential / Restricted

Answer

Private sector organizations typically use a four-tier model of Public, Internal Use Only, Confidential, and Restricted (or similarly named tiers) as opposed to the government's classification scheme.

Question 4

What is the FIRST step an organization should take when establishing a data classification program?

Accepted Answer

Identify and inventory all data assets owned by the organization

Answer

Before data can be classified or protected, organizations must first identify and inventory all data assets to understand what they have, where it is, and who is responsible for it.

Question 5

Which secure disposal method is REQUIRED for solid-state drives (SSDs) when the data contains classified information?

Accepted Answer

Physical destruction or verified cryptographic erasure

Answer

SSDs are not effectively sanitized by degaussing (no magnetic media) or overwriting (wear leveling may leave residual data); physical destruction or cryptographic erasure are the only reliable methods for classified data.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Asset Security 5