CISSP Q v1.4 -- Domain2: Asset Security

Question 1

Kevin uploads a configuration file to the company web server using FTPS. The company webserver receives the file and stores it on a hard drive that features full disk encryption (FDE). Which of the data states below is not being protected in this scenario?

A. Data in motion
B. Data in use
C. Data at rest
D. Data in transit

Answer 1

B. Data in use

FTP stands for File Transfer Protocol. The FTPS version is encrypted using SSL/TLS certificates. This tells us that the data in motion/transit is secure. SSH would have been another secure option.
Full disk encryption indicates that the data at rest is also safe.
While there’s no clear reason to believe the data in use (data in the processor/ram) is at risk, there is no indication that the data in use has been encrypted. Thereby, it is not being protected based off of the limited information above.

Question 2

At which point in the data lifecycle should an owner be assigned to the data?

A. When it needs to be shared
B. Before it is destroyed
C. At the moment it is created
D. At the time it is stored

Answer 2

C. At the moment it is created

The moment the data is created, it needs an owner!
Then, the owner should immediately classify it in accordance with company policy.

Question 3

An admin reads about a new type of worm that can quickly spread between Windows servers without detection and believes their company’s servers could be at risk. They take this information to the Chief Information Security Officer (CISO) who documents all of the admin’s findings and concerns. What describes the phase of risk management that the CISO is currently performing?

A. Risk Response
B. Risk Identification
C. Risk Calculation
D. Risk Assessment

Answer 3

B. Risk Identification

The CISO is still gathering information about the nature of the threat. As such, they have NOT yet begun to Assess (D) the impact or likelihood of the issue nor have they made any decisions (A) about how to deal with the problem. Thus, they are still operating in the Identification phase.

Question 4

You’ve been asked to determine the classification of several new company assets. Of the options below, what would be the most important to consider when determining the classification?

A. Business value
B. Total cost of ownership
C. Missing controls
D. Residual risk

Answer 4

A. Business value

Question 5

Which of the following statements MOST accurately describes what a data classification policy should include?
A. Who has access to the data, how the data will be secured, where the data originated.
B. Who has access to the data, how the data will be secured, whether the data should be encrypted.
C. How to dispose of the data, whether the data should be encrypted, whether the data are of foreign origin.
D. How to secure the data, who can use the data, and what the fines are for misuse of the data.

Answer 5

B. Who has access to the data, how the data will be secured, whether the data should be encrypted.

Question 6

Match the terms below with their proper definitions.

A. Classification
B. Categorization
C. Asset Management
D. CMDB

1. Determining the impact of the loss of confidentiality, integrity, or availability of the information to an organization.
2. Capturing the basics of what assets are on hand, where they reside, and who owns them.
3. Helps ensure information is marked in such a way that only those with an appropriate level of clearance can have access to the information.
4. A logical entity with key integration points that supports and enables processes in service delivery, service support, and other IT disciplines.

Answer 6

1: B. CATEGORIZATION
2: C. ASSET MGMT
3: A. CLASSIFICATION
4: D. CMDB

Question 7

Protection and security of information is the responsibility of everyone within the company. Which of the following describes an individual or function that protects the information on behalf of the owner?

A. The Data Custodian
B. The Information Systems Auditor
C. The Help Desk Administrator
D. The Business Continuity Planner

Answer 7

A. The Data Custodian

Question 8

Of the choices below, which are the three BEST mechanisms for maintaining confidentiality?

A. Data classification, encryption, and destruction.
B. Clustering, server backups, and purging.
C. Data classification, quality assurance, and degaussing.
D. Server backups, encryption, and training.

Answer 8

A. Data classification, encryption, and destruction.

Clustering, backups and QA do not maintain confidentiality. Degaussing would have no effect on SSDs, and note that purging is not as good as destruction, as it only gives assurance that data removed cannot be recreated by “known techniques.”

Question 9

Which of the following is NOT a primary enabler of data management success?

A. Ensuring that the data owner and the data custodian share the same duties.
B. Organizational alignment and defined data handling processes.
C. Scalable technologies and infrastructure.
D. A single centralized and relational repository.

Answer 9

A. Ensuring that the data owner and the data custodian share the same duties.

Question 10

Match the concepts below with their proper definitions.

A. Data management
B. Data policy
C. Data categorization
D. Information owner

1. The individual or group that creates, purchases, or acquires the data.
2. Includes a broad range of technical and administrative activities to be followed in order to properly handle data.
3. Identifying the what a loss of security for a given set of data would be to the organization.
4. Strategic long-term goals for data across all aspects of a project or enterprise.

Answer 10

1: D. INFORMATION OWNER
2: A. DATA MANAGEMENT
3: C. DATA CATEGORIZATION
4: B. DATA POLICY

Question 11

Good data management practices include which of the following?

1. Clearly defining strategic goals and objectives
2. Establishing data ownership for all project phases.
3. Proper documentation and descriptive metadata.
4. Installing adequate data quality procedures.

A.1, 2, and 3
B. 2, 3, and 4
C. 1, 3, and 4
D. 1, 2, 3, and 4

Answer 11

D. 1, 2, 3, and 4

Question 12

Which statement below is most accurate?

A. The data custodian creates the data and makes it available to users when they need it.
B. The data owner classifies the data and sets the rules for user privileges, then delegates the day-to-day data maintenance to the data custodian.
C. The data custodian provides user permissions and access to the data after the data owner has secured the data.
D. The data owner provides permissions to the data based on users’ need-to-know, and the data custodian implements the
classifications.

Answer 12

B. The data owner classifies the data and sets the rules for user privileges, then delegates the day-to-day data maintenance to the data custodian.

The custodian does not create the data, implement the classifications, or provide user permissions.

Question 13

Which of the following is considered Payment Card Industry (PCI) data?

A. Job title
B. Marital status
C. Educational background
D. Primary Account Number

Answer 13

D. Primary Account Number

PCI data fields include Primary Account Number (PAN), expiration date, CVV and service code.

Question 14

Which is NOT a common activity undertaken during the data life cycle?

A. Sanitizing the data upon receiving it.
B. Acquiring the data and putting it to use.
C. Decommissioning and disposing of the data.
D. Defining data requirements.

Answer 14

A. Sanitizing the data upon receiving it.

Question 15

Which of the following would best improve the quality of data?

A. Anonymizing all incoming data to avoid data leakage.
B. Using data quality, validation, and verification techniques.
C. Doing a yearly audit of all financial data.
D. Metadata, improving data quality by making the data more accurate.

Answer 15

B. Using data quality, validation, and verification techniques.

(A) Anonymizing all data is not always appropriate.
(C) Yearly audits may not be enough to meet some regulations and is too infrequent.
(D) If data is entered wrongly, metadata will not make the data more accurate.

Question 16

Match the concepts below with their proper definitions.

A. Quality Control
B. Data Modeling
C. Quality Assurance
D. Metadata

1. The assessment of data based on internal standards.
2. The methodology that identifies the path by which to meet user requirements.
3. Uses common methods to identify informational aspects, including the identification, data attributes, and formatting of data.
4. The assessment of data based on external standards.

Answer 16

1: A. QUALITY CONTROL
2: B. DATA MODELING
3: D. METADATA
4: C. QUALITY ASSURANCE

Question 17

Of the techniques listed below, which of the following is the BEST method for erasing information on a hard disk drive (HDD)?

A. Deleting files and then emptying the recycle bin.
B. High level Operating System re-formatting.
C. Multiple rounds of Zero-one bit overwriting.
D. Low level re-formatting.

Answer 17

C. Multiple rounds of Zero-one bit overwriting.

We wish “disk destruction” or “degaussing” was an answer, but it isn’t. (C) Is correct.
(A) is completely inadequate.
(B) Does no more than erase the file links without erasing the sectors containing the files.
(D) Low level re-formatting is seldom used, as it is a disk controller function.

Question 18

Which statement below about the use of baselines in Asset Management is LEAST accurate?

A. A common organizational practice is to combine many baseline ideas into one large overarching baseline.
B. To create an effective baseline, you need to know what parts of the organization can be protected with the same baseline.
C. Baselines help establish a minimum set of controls with which to protect some or all IT systems in the enterprise.
D. Sets of baseline safeguards can be found in international, national, or industry standards.

Answer 18

A. A common organizational practice is to combine many baseline ideas into one large overarching baseline.

Answers (B), (C), and (D) are all recommended statements for baselines. Answer (A) is not a recommended practice, so it is the “LEAST accurate” answer.

Question 19

Which statement below about implementing controls is LEAST accurate?

A. Supplementation involves adding details to adequately meet the risk management needs of an organization.
B. Scoping provides an organization with general ideas about implementing controls.
C. Scoping provides an organization with specific terms and conditions about implementing controls.
D. Tailoring helps an organization fine-tune their chosen controls so that they better fit their intended situations.

Answer 19

B. Scoping provides an organization with general ideas about implementing controls.

Scoping provides specific terms, not general terms.

Question 20

Which answer with respect to data classification and protection is the LEAST accurate?

A. The Data Custodian determines classification.
B. The Data Owner determines classification level, marks hard
copies and labels files.
C. The Data Owner is responsible for the data throughout the
data lifecycle.
D. High level management determines the classification names
for all data levels.

Answer 20

A. The Data Custodian determines classification.

Question 21

Which of the following answers is NOT one of the Center for Strategic and International Studies (CSIS) five critical security tenets?

A. Prioritization–invest first in the controls that will give you the greatest benefit.
B. Metrics–allow required adjustments to be more quickly known and fixes implemented.
C. ContinuousMonitoring–test and validate the effectiveness of your controls.
D. Accuracy–keep an accurate, up-to-date count of current threats.

Answer 21

D. Accuracy–keep an accurate, up-to-date count of current threats.

FIVE CRITICAL TENETS:
Offense informs defense, Prioritization, Metrics, Continuous monitoring, Automation

Question 22

Which is the most accurate? job description of the data steward.

A. The data owner is responsible for adhering to the rules for using the data, while the data custodian is responsible for determining the corporate governance regarding the data.
B. The data owner is responsible for determining how the data may be used, while the data custodian is responsible for implementing the protections to the data.
C. The data owner is responsible for controlling the data, while the data custodian is responsible for maintaining the chain of custody.
D. The data owner grants the technical permissions for data access, while the data custodian maintains the database access controls to the data.

Answer 22

B. The data owner is responsible for determining how the data may be used, while the data custodian is responsible for implementing the protections to the data.

Owner – Management role of data
Stewart – governance/ compliance Custodian – access controls and security enforcement Privacy Officer – PII and disclosure