CISSP Practice Test Chapter 2 Asset Security (Sybex) Flashcards

Question

How should you determine which controls from the baseline should be applied to a given system or software package? A. Consult the custodians of the data. B. Select based on the data classification of the data it stores or handles. C. Apply the same controls to all systems. D. Consult the business owner of the process the system or data supports. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 30). Wiley. Kindle Edition.

Answer 1

B. Select based on the data classification of the data it stores or handles. Explanation: The controls implemented from a security baseline should match the data classification of the data used or stored on the system. Custodians are trusted to ensure the day-to-day security of the data and should do so by ensuring that the baseline is met and maintained. Business owners often have a conflict of interest between functionality and data security, and of course, applying the same controls everywhere is expensive and may not meet business needs or be a responsible use of resources. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 324). Wiley. Kindle Edition.

Answer 2

D. The data processor Explanation: The third-party company is a data processor—they process data on behalf of Henry's company, which is a data controller. The data is collected about data subjects. Data owners are tasked with making decisions about data, such as who receives access to it and how it is used. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 324). Wiley. Kindle Edition.

Answer 3

B. Data remanence is a concern. Explanation: Many organizations require the destruction of media that contains data at higher levels of classification. Often the cost of the media is lower than the potential costs of data exposure, and it is difficult to guarantee that reused media doesn't contain remnant data. Tapes can be erased by degaussing, but degaussing is not always fully effective. Bitrot describes the slow loss of data on aging media, while data permanence is a term sometimes used to describe the life span of data and media. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 324). Wiley. Kindle Edition.

Answer 4

A. Personally identifiable information (PII) | Explanation: NIST Special Publication 800-122 defines PII as any information that can be used to distinguish or trace an individual's identity, such as name, Social Security number, date and place of birth, mother's maiden name, biometric records, and other information that is linked or linkable to an individual such as medical, educational, financial, and employment information. PHI is health-related information about a specific person, Social Security numbers are issued to individuals in the United States, and SII is a made-up term. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 5

B. Data breach Explanation: Typically, data breaches cause the greatest reputational damage as a result of threats to data at rest. Data at rest with a high level of sensitivity is often encrypted to help prevent this. Decryption is not as significant of a threat if strong encryption is used and encryption keys are well secured. Insider threats are a risk, but the majority of insider threat issues are unintentional rather than intentional, making this risk less likely in most organizations. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 6

B. Data at rest Explanation: Full disk encryption only protects data at rest. Since it encrypts the full disk, it does not distinguish between labeled and unlabeled data. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 7

C. EOS Explanation: C. This is an example of an end-of-support (EOS) scenario. The company is intentionally ending support and needs to address what happens to the devices next—secure disposal, destruction, or re-sale—depending on data security requirements and policies set by the company. EOL is when a device or software is no longer made or supported, in contrast to end of support, which may be when it is no longer serviced, including via patches, upgrades, or organizational maintenance. Planned obsolescence and device risk management are not terms that are used on the exam. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 8

D. It identifies the value of the data to the organization. Explanation: Classification identifies the value of data to an organization. This can often help drive IT expenditure prioritization and could help with rough cost estimates if a breach occurred, but that's not the primary purpose. Finally, most breach laws call out specific data types for notification rather than requiring organizations to classify data themselves. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 9

B. The cost of the sanitization process may exceed the cost of new equipment. Explanation: Downgrading systems and media is rare due to the difficulty of ensuring that sanitization is complete. The need to completely wipe (or destroy) the media that systems use means that the cost of reuse is often significant and may exceed the cost of purchasing a new system or media. The goal of purging is to ensure that no data remains, so commingling data should not be a concern, nor should the exposure of the data; only staff with the proper clearance should handle the systems! Finally, a DLP system should flag data based on labels, not on the system it comes from. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 10

A. The cost to classify the data Explanation: A. Classification should be conducted based on the value of the data to the organization, its sensitivity, and the amount of harm that could result from exposure of the data. Cost should be considered when implementing controls and is weighed against the damage that exposure would create. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 11

C. Erasing Explanation: Erasing, which describes a typical deletion process in many operating systems, typically removes only the link to the file and leaves the data that makes up the file itself. The data will remain in place but not indexed until the space is needed and it is overwritten. Degaussing works only on magnetic media, but it can be quite effective on it. Purging and clearing both describe more elaborate removal processes. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 12

C. TLS Explanation: TLS is a modern encryption method used to encrypt and protect data in transit. BitLocker is a full disk encryption technology used for data at rest. DES and SSL are both outdated encryption methods and should not be used for data that requires high levels of security. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 325). Wiley. Kindle Edition.

Answer 13

C. Private Explanation: C. We know that the data classification will not be the top-level classification of Confidential because the loss of the data would not cause severe damage. This means we have to choose between private (PHI) and sensitive (confidential). Calling this private due to the patient's personal health information fits the classification scheme, giving us the correct answer. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (pp. 325-326). Wiley. Kindle Edition.

Answer 14

A. DLP Explanation: A data loss prevention (DLP) system or software is designed to identify labeled data or data that fits specific patterns and descriptions to help prevent it from leaving the organization. An IDS is designed to identify intrusions. Although some IDS systems can detect specific types of sensitive data using pattern matching, they have no ability to stop traffic. A firewall uses rules to control traffic routing, while UDP is a network protocol. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 15

A. Top Secret Explanation: When data is stored in a mixed classification environment, it is typically classified based on the highest classification of data included. In this case, the US government's highest classification is Top Secret. Mixed classification is not a valid classification in this scheme. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 16

B. End of support Explanation: The end of support of a device or product typically occurs after the end of life and end of sales. Support may continue for a period of months or even years, but eventually support stops too. General availability is found during the main part of a lifecycle, rather than at the end, and helps note when the product is out of testing and can be acquired or used by customers or others instead of specific groups like beta testers or early release partners. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 17

D. Tailoring Explanation: Tailoring ensures that assessment methods are appropriate to the systems, services, and other assets that are being validated and is the best answer here. Scoping is a related term and involves setting the boundaries of security control implementations. Asset management involves how assets are overseen throughout their lifecycle, and compliance is a broad term that describes ensuring that regulations, contractual terms, or other requirements are met. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 18

B. Use Microsoft Group Policy. Explanation: Group Policy provides the ability to monitor and apply settings in a security baseline. Manual checks by users and using startup scripts provide fewer reviews and may be prone to failure, while periodic review of the baseline won't result in compliance being checked. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 19

B. Consent Explanation: Providing consent, or agreeing to data collection and use, is important in many data collection scenarios and may be required by law. Remanence occurs when data remains in place, sometimes inadvertently, after it should have been removed or disposed of. Retention is the intentional process of keeping and managing data. Certification is not a data lifecycle process element. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 20

A. Data custodian Explanation: A. Amy is a data custodian and is responsible for the technical environment, including things like database structures and the technical implementations of data policies. Some organizations may overlap other data roles, including data controllers or data stewards, but the best answer here is a data custodian. Amy is not a data user and is not a data processor who uses the data on behalf of a data controller. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 21

B. DLP Explanation: A data loss prevention (DLP) system can tag, monitor, and limit where files are transferred to. Jim's company may also elect to use digital rights management tools in combination with a data loss prevention system, but DRM controls how data can be used, not where files are transferred to or where they exist at any point in time in most cases. An intrusion prevention system (IPS) may be able to detect files that are being sent across a network but won't stop files from being copied on workstations or thumb drives. Antivirus is not designed for this purpose. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 326). Wiley. Kindle Edition.

Answer 22

D. Use AES-256 encryption. Explanation: Using strong encryption, like AES-256, can help ensure that loss of removable media like tapes doesn't result in a data breach. Security labels may help with handling processes, but they won't help once the media is stolen or lost. Having multiple copies will ensure that you can still access the data but won't increase the security of the media. Finally, using hard drives instead of tape only changes the media type and not the risk from theft or loss. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 327). Wiley. Kindle Edition.

Answer 23

D. It validates who approved the data. Explanation: Electronic signatures, as used in this rule, prove that the signature was provided by the intended signer. Electronic signatures as part of the FDA code are intended to ensure that electronic records are “trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.” Signatures cannot provide confidentiality or integrity and don't ensure that someone has reviewed the data. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 327). Wiley. Kindle Edition.

Answer 24

D. Tagging Explanation: Tags that include information about the life span of the data and when it has expired can help with lifecycle management processes. Tags can be as simple as timestamps, or they can include additional metadata like the data type, creator, or purpose that can help inform the retention and disposal process. Rotation of files like logs is commonly done to limit how much space they take up, but rotation itself does not address disposal requirements and information that would guide the disposal process. DRM, or digital rights management, and DLP, or data loss prevention, both address data security and use but not disposal. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 327). Wiley. Kindle Edition.

Answer 25

B. Data maintenance Explanation: During the data maintenance phase of a typical data lifecycle, activities like data scrubbing occur to remove unneeded, incorrect, or out-of-date data. Data retention is not a phase; instead, it is a decision that organizations make based on requirements, laws, or their own needs. Data remanence is also not a phase. Data remanence describes the problem of data that remains after data is removed. Finally, in the data collection phase, data is acquired and may be scrubbed, but the question describes a process occurring after data is no longer needed, not during acquisition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 327). Wiley. Kindle Edition. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 327). Wiley. Kindle Edition.

Answer 26

B. NDAs ``` Explanation: Nondisclosure agreements (NDAs) are used to enforce confidentiality agreements with employees and may remain in effect even after an employee leaves the organization. Other controls, such as sanitization, clearing, and encryption, would not be effective against information in an employee's memory. ``` Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 327). Wiley. Kindle Edition.

Answer 27

C. Label the data. Explanation: Data labels are crucial to identify the classification level of information contained on the media, and labeling data at creation helps to ensure that it is properly handled throughout its lifecycle. Digital rights management (DRM) tools provide ways to control how data is used, while encrypting it can help maintain the confidentiality and integrity of the data. Classifying the data is necessary to label it, but it doesn't automatically place a label on the data.

Answer 28

D. Purge, validate, document Explanation: The NIST SP 800-88 process for sanitization and disposition shows that media that will be reused and was classified at a moderate level should be purged and then that purge should be validated. Finally, it should be documented.

Answer 29

D. TLS, VPN, IPsec Explanation: Data in transit is data that is traversing a network or is otherwise in motion. TLS, VPNs, and IPsec tunnels are all techniques used to protect data in transit. AES, Serpent, and IDEA are all symmetric algorithms, while Telnet, ISDN, and UDP are all protocols. BitLocker and FileVault are both used to encrypt data, but they protect only stored data, not data in transit.

Answer 30

C. Data owners Explanation: The data owner has ultimate responsibility for data belonging to an organization and is typically the CEO, president, or another senior employee. Business and mission owners typically own processes or programs. System owners own a system that processes sensitive data.

Answer 31

C. In memory Explanation: The most difficult location to secure for encryption keys and similar highly sensitive information is in active memory because the data needs to be decrypted to be used. When data is at rest on a drive or in transit via either a local or public network, it can be encrypted until it reaches its destination, and you can use strong encryption in each of those circumstances.

Answer 32

A. He is responsible for steps 3, 4, and 5. Explanation: A. Chris is most likely to be responsible for classifying the data that he owns as well as assisting with or advising the system owners on security requirements and control selection. In an organization with multiple data owners, Chris is unlikely to set criteria for classifying data on his own. As a data owner, Chris will also not typically have direct responsibility for scoping, tailoring, applying, or enforcing those controls.

Answer 33

B. They are administrators and custodians. Explanation: The system administrators are acting in the roles of data administrators who grant access and will also act as custodians who are tasked with the day-to-day application of security controls. They are not acting as data owners who own the data itself. Typically, system administrators are delegated authority by system owners, such as a department head, and of course they are tasked with providing access to users.

Answer 34

C. Data processors Explanation: C. Third-party organizations that process personal data on behalf of a data controller are known as data processors. The organization that they are contracting with would act in the role of the business or mission owners, and others within Chris's organization would have the role of data administrators, granting access as needed to the data based on their operational procedures and data classification.

Answer 35

D. Use network logs to identify all connected devices and track them down from there. Explanation: While it can be a lot of work, the most complete inventory of active systems and devices can be created by determining what is connected to the network and then finding those assets. Port scans can help to find some systems, but firewalls and other security solutions can prevent systems from being discovered. Staff may not know about all of the systems and devices on the network or may presume that someone else will provide information about shared resources such as printers, security cameras, or other devices. Active Directory is unlikely to contain all devices, particularly if an inventory is needed!

Answer 36

B. Ensure that procurement and acquisition processes add new devices to the inventory before they are deployed. Explanation: In most organizations, changing processes so that new systems and devices are added to inventory before they are deployed is the first step in making sure asset inventories are current. Yearly or quarterly updates are too infrequent for most organizations and will lead to gaps as devices are forgotten

Answer 37

C. Use metadata tagging based on data type or security level. Explanation: Chris should use metadata tagging to allow him to use technical tools like DLP and DRM to handle and track data based on its type and content. File extensions do not reveal data security or type, and relying on network share locations to secure data or inventory will lead to gaps in security as files are moved, copied, or stored locally

Answer 38

D. Employees Explanation: Patents, databases, and formulas are all examples of intangible assets. Tangible assets include things like hardware, cables, and buildings. Personnel assets include employees, and most organizations would be quite concerned if their employees were intangible!

Answer 39

D. Data should be collected from all individuals equally. Explanation: There is no requirement that data collection be equal or equivalent. Instead, data collection statutes and other requirements often require that only required data is collected, that individuals are made aware of the data collection, and that they consent to the collection. Similarly, data should only be collected lawfully and via fair methods.

Answer 40

B. It prevents sensitive media from not being marked by mistake. Explanation: Requiring all media to have a label means that when unlabeled media is found, it should immediately be considered suspicious. This helps to prevent mistakes that might leave sensitive data unlabeled. Prelabeled media is not necessarily cheaper (nor may it make sense to buy!), while reusing public media simply means that it must be classified based on the data it now contains. HIPAA does not have specific media labeling requirements.

Answer 41

B. Data in use Explanation: Data in use is data that is in a temporary storage location while an application or process is using it. Thus, data in memory is best described as data in use or ephemeral data. Data at rest is in storage, while data

Answer 42

C. Data remanence Explanation: Validation processes are conducted to ensure that the sanitization process was completed, avoiding data remanence. A form like this one helps to ensure that each device has been checked and that it was properly wiped, purged, or sanitized. This can allow reuse, does not prevent destruction, and does not help with attribution, which is a concept used with encryption to prove who created or sent a file

Answer 43

C. It is more expensive than new media and may still fail. Explanation: Ensuring that data cannot be recovered is difficult, and the time and effort required to securely and completely wipe media as part of declassification can exceed the cost of new media. Sanitization, purging, and clearing may be part of declassification, but they are not reasons that it is not frequently chosen as an option for organizations with data security concerns.

Answer 44

D. Destruction Explanation: Destruction is the final stage in the lifecycle of media and can be done via disintegration, incineration, or a variety of other methods that result in the media and data being nonrecoverable. Sanitization is a combination of processes used when data is being removed from a system or media. Purging is an intense form of clearing, and degaussing uses strong magnetic fields to wipe data from magnetic media

Answer 45

A. PHI Explanation: PHI is protected health information. Personally identifiable information (PII) is any information that can identify an individual. Proprietary data is information that helps organizations maintain a competitive edge or that they want to keep to their own organization or a controlled set of individuals. PID is not a term used for data classification.

Answer 46

D. To indicate the classification level of the data or system Explanation: Handling requirements and tools include visual indicators like a distinctive screen background and can help employees remember what level of classification they are dealing with and thus the handling requirements that they are expected to follow

Answer 47

C. Follow the organization's purging process, and then downgrade and replace labels. Explanation: If an organization allows media to be downgraded, the purging process should be followed, and then the media should be relabeled. Degaussing may be used for magnetic media but won't handle all types of media. Pulverizing would destroy the media, preventing reuse, while relabeling first could lead to mistakes that result in media that hasn't been purged entering use

Answer 48

B. Establishes rules for appropriate use and protection of data Explanation: The data owner sets the rules for use and protection of data. The remaining options all describe tasks for the system owner, including implementation of security controls.

Answer 49

B. Categorizing and selecting controls Explanation: In the NIST SP 800-60 diagram, the process determines appropriate categorization levels resulting in security categorization and then uses that as an input to determine controls. Standard selection would occur at an organizational level, while baselining occurs when systems are configured to meet a baseline. Sanitization would require the intentional removal of data from machines or media.

Answer 50

C. A and E Explanation: A and E can both be expected to have data at rest. C, the internet, is an unknown, and the data can't be guaranteed to be at rest. B, D, and F are all data in transit across network links.

Answer 51

C. TLS Explanation: B, D, and F all show network links. Of the answers provided, Transport Layer Security (TLS) provides the best security for data in motion. AES-256 and 3DES are both symmetric ciphers and are more likely to be used for data at rest. SSL has been replaced with TLS and should not be a preferred solution.

Answer 52

B. Encrypt the data files and send them. Explanation: Sending a file that is encrypted before it leaves means that exposure of the file in transit will not result in a confidentiality breach and the file will remain secure until decrypted at location E. Since answers A, C and D do not provide any information about what happens at point C, they should be considered insecure, as the file may be at rest at point C in an unencrypted form

Answer 53

C. Sensitive email should be encrypted and labeled. Explanation: Encrypting and labeling sensitive email will ensure that it remains confidential and can be identified. Performing these actions only on sensitive email will reduce the cost and effort of encrypting all email, allowing only sensitive email to be the focus of the organizations efforts. Only encrypting highly sensitive email not only skips labeling but might expose other classifications of email that shouldnt be exposed.

Answer 54

C. By reducing the amount of data that may need to be produced for lawsuits Explanation: Data retention policies can reduce the amount of old logs and other files that may be produced during a legal case. That can reduce organizational risk, but retention policies need to be in place well before a legal gold is filed. Reducing storage in use does not reduce liability, but it can reduce financial costs, and data retention policies dont tend to limit the number of classifications in use. Legal penalties are not impacted by a retention policy

Answer 55

C. Data processor Explanation: Systems used to process data are data processors. Data owners are typically CEOs or other very senior staff, custodians are granted rights to perform day-to-day tasks when handling data, and mission owners are typically program or information system owners.

Answer 56

D. ZIP code Explanation: Personally identifiable information includes any information that can uniquely identify an individual. This would include name, Social Security number, and any other unique identifier (including a student ID number). ZIP code, by itself, does not uniquely identify an individual.

Answer 57

B. PHI Explanation: Protected health information, or PHI, includes a variety of data in multiple formats, including oral and recorded data, such as that created or received by healthcare providers, employers, and life insurance providers. PHI must be protected by HIPAA. PII is personally identifiable information. SHI and HPHI are both made-up acronyms.

Answer 58

B. Tokenization Explanation: Tokenization replaces other data with a random string of characters. These tokens are then matched to the actual values for secure lookups as needed. Anonymization removes all personally identifiable data to ensure that the original subject cannot be identified. Data masking obscures some, but not all, data. Pseudonymization uses a pseudonym or alias to replace other information.

Answer 59

B. PCI-DSS Explanation: The Payment Card Industry Data Security Standard, or PCI-DSS, is a credit card industry data security standard that defines how businesses must handle information related to credit cards. CC-Comply was made up for this question. GLBA, or Gramm-Leach-Bliley, modernized financial institution standards, and GDPR is an EU data privacy regulation.

Answer 60

C. Disintegration Explanation: Due to problems with remnant data, the U.S. National Security Agency requires physical destruction of SSDs. This process, known as disintegration, results in very small fragments via a shredding process. Zero fill wipes a drive by replacing data with zeros, degaussing uses magnets to wipe magnetic media, and clearing is the process of preparing media for reuse.

Answer 61

A. Data owners, system owners, custodians Explanation: A. The data owner bears responsibility for categorizing information systems and delegates selection of controls to system owners, while custodians implement the controls. Users don't perform any of these actions, while business owners are tasked with ensuring that systems are fulfilling their business purpose.

Answer 62

B. Step 2 Explanation: PCI DSS provides a set of required security controls and standards. Step 2 would be guided by the requirements of PCI DSS. PCI DSS will not greatly influence step1 because all of the systems handle credit card information, making PCI DSS apply to all systems covered. Steps 3 and 4 will be conducted after PCI DSS has guided the decisions in step 2.

Answer 63

C. Custodians Explanation: Custodians are tasked with the day-to-day monitoring of the integrity and security of data. Step 5 requires monitoring, which is a custodial task. A data owner may grant rights to custodians but will not be responsible for conducting monitoring. Data processors process data on behalf of the data controller, and a user simply uses the data via a computing system.

Answer 64

B. Mishandling of drives by the third party Explanation: B. Susan’s organization is limiting its risk by sending drives that have been sanitized before they are destroyed. This limits the possibility of a data breach if drives are mishandled by the third party, allowing them to be stolen, resold, or simply copied. The destruction of the drives will handle any issues with data remanence, while classification mistakes are not important if the drives have been destroyed. Wiping the data before destruction does not make a meaningful difference for data retention policy concerns. Data permanence and the life span of the data are not important on a destroyed drive.

Answer 65

C. RFID tags Explanation: RFID tags are a common solution for tracking hardware assets and equipment. They can be queried wirelessly at varying ranges depending on the tags and may be built-in to hand-held readers or even included in doorways or arches to track items as they enter or leave a facility. Visual inventory relies on staff checking items, MAC addresses are hardware addresses for networked devices and not every asset in inventory is likely to have a wireless network capability—or to be on! Steganography is hiding messages in images and doesn't help at all with inventory.

Answer 66

D. Record retention Explanation: Record retention is the process of retaining and maintaining information for as long as it is needed. A data storage policy describes how and why data is stored, while data storage is the process of actually keeping the data. Asset maintenance is a noninformation-security-related process for maintaining physical assets.

Answer 67

C. How much the data cost to create Explanation: The cost of the data is not directly included in the classification process. Instead, the impact to the organization if the data were exposed or breached is considered. Who can access the data and what regulatory or compliance requirements cover the data are also important considerations.

Answer 68

B. Symmetric encryption Explanation: Symmetric encryption like AES is typically used for data at rest. Asymmetric encryption is often used during transactions or communications when the ability to have public and private keys is necessary. DES is an outdated encryption standard, and OTP is the acronym for onetime password.

Answer 69

D. Administrators Explanation: Administrators have the rights to apply the permissions to access and handle data. Custodians are trusted with day-to-day data handling tasks. Business owners are typically system or project owners, and data processors are systems used to process data.

Answer 70

A. It identifies the individual(s) responsible for protecting the asset. Explanation: Knowing the asset's owner also tells you who is responsible for protecting the asset or for delegating that task. While asset owners may be law enforcement contacts, this is not a critical item for asset security. It does not directly help you to establish the value of the asset or to set security classification levels for an asset.

Answer 71

A. Ensure that the tapes are handled the same way the original media would be handled based on their classification. Explanation: Tapes may be vulnerable to theft or loss in transit. That means that tapes that are leaving their normal storage facility should be handled according to the organization's classification schemes and handling requirements. Purging the tapes would cause the loss of data, while increasing the classification level of the tapes. The tapes should be encrypted rather than decrypted.

Answer 72

A. Data on a backup tape that is being shipped to a storage facility Explanation: The correct answer is the tape that is being shipped to a storage facility. You might think that the tape in shipment is “in motion,” but the concept is that the data is not being accessed and is instead in storage rather than being sent across a network. Data in a TCP packet, in an e-commerce transaction, or in local RAM is in motion and is actively being used.

Answer 73

D. Review its data classifications and classify the data appropriately. Explanation: When the value of data changes due to legal, compliance, or business reasons, reviewing classifications and reclassifying the data is an appropriate response. Once the review is complete, data can be reclassified and handled according to its classification level. Simply relabeling the data avoids the classification process and may not result in the data being handled appropriately. Similarly, selecting a new baseline or simply encrypting the data may not handle all of the needs that the changes affecting the data create.

Answer 74

A. Data owners B. Data controllers C. Data custodians Explanation: Data owners, controllers, and custodians are typically found inside of a company, while data processors are typically third parties.

Answer 75

C. Public Explanation: Public data is just that—information that can be made public without any harm to the organization, and in fact, it is often information that the organization wants to make available. Private information should stay private inside of an organization, sensitive data may cause damage to the mission of the organization if exposed, and proprietary or confidential information is the most sensitive data that an organization wants to protect. Chapple, Mike; Seidl, David. (ISC)2 CISSP Certified Information Systems Security Professional Official Practice Tests (p. 332). Wiley. Kindle Edition.

Answer 76

The data elements match with the categories as follows: Data elements Medical records: B. PHI Trade secrets A. Proprietary data Social Security numbers: C. PII Driver's license numbers: C. PII Medical records are an example of protected health information (PHI). Trade secrets are an example of proprietary data. Social Security numbers and driver's license numbers are examples of PII; if they were used in a medical context, they may also be PHI, but this question does not ask you to consider them in that context.