🎓 CISSP Practice - Domain 2 - Asset Security

Correct Answer: A

Policy/SCP is preventive, deterministic, and enforced by the control plane before the resource is created. B is not supported by major public clouds. C is administrative and can be bypassed. D is detective and allows a 15-minute exposure window.

Correct Answer: B

The secure destruction policy (B) must explicitly cover provider-side backups and snapshots; otherwise data remains recoverable. Retention schedule (A) already exists (1 year). Version-control baseline (C) and key escrow (D) are unrelated to residual snapshots.

Correct Answer: C

For Top-Secret data, NIST 800-88 requires “destroy” (shredding, incineration, etc.) regardless of any logical sanitization method. Overwrite (A) and secure-erase (B) are only acceptable for lower classifications. D does not affect the user data on the platters.

Correct Answer: C

Domain 2 stresses labeling and inventory as the foundation of asset tracking. Missing labels meant the media could not be reconciled with the inventory database. A is environmental, not asset tracking. B protects confidentiality but does not help track presence. D would show tampering but still requires a label to know what asset is missing.

Correct Answer: B

Domain 2 requires that every asset that processes, stores, or transmits sensitive data be inventoried and classified. Even volatile ePHI is still ePHI. Option B maintains the inventory’s integrity while applying compensating controls (encryption) where remediation (patching) is impossible. A creates an invisible risk; C mis-classifies the data, undermining downstream controls; D is an unnecessary business disruption.

Correct Answer: B

Asset classification must be based on verified attributes. Re-auditing ensures that the criticality (and therefore classification) is accurate. A trusts unverified data. D and C are secondary; the data must first be validated.

Correct Answer: A

Classification metadata should be validated whenever content changes. Because the promotion process did not re-check the true sensitivity, keys remained in a “Public” repo. B, C and D are generic access or coding issues; only A addresses the asset-classification gap.

Correct Answer: A

FIPS 140-2 Level 1 (A) provides cryptographic-module validation but does not mandate physical protection or hardware key storage, leaving keys potentially exposed in software. AES-256 is FIPS-approved (B is false). SaaS vendors can use validated modules (C is false). Level 1 imposes no key-length restriction (D is false).

Correct Answer: C

Co-mingling highly confidential IP with public data without role-based or folder-level controls means any insider or compromised marketing account can exfiltrate crown-jewel R&D data. Backup (D) and availability (A) are secondary; encryption in transit (B) does not fix the access problem.

Correct Answer: A

Under most modern privacy laws, any identifier that can be linked back to an individual—even irreversible hashes—remains personal data. Therefore retaining the hashes still triggers deletion obligations. B is wrong because templates remain; C is wrong because salting does not anonymize biometrics; D confuses cost with legal minimization.

Correct Answer: C

Envelope encryption with a per-customer DEK provides cryptographic isolation while still using one KMS CMK for master-key management, balancing isolation and overhead. A does not isolate because all DEKs are wrapped under the same CMK; an insider with decrypt rights on the CMK can access every customer. B gives perfect isolation but explodes key-management cost. D delegates control to AWS and does not give per-customer isolation.

Correct Answer: B

Biometric templates are inherently sensitive and require the highest default classification (“Restricted”) because they can be used to identify individuals across any context, unlike the original video content. Matching them to the source video’s level (A) or only one level higher (C) underestimates the risk. “Internal” (D) is insufficient for biometric data.

Correct Answer: B

Option B is the only choice that performs at least a cursory automated classification based on content indicators before data crosses the trust boundary, satisfying the “classify before you move” principle. A moves data unclassified, violating the policy. C destroys potentially valuable records and still leaves 90 % of the data unlabeled. D over-classifies everything, creating a denial-of-service for users and does not meet the 30-day goal because business units will be swamped with relabeling requests.

Correct Answer: D

When high- and low-value assets share infrastructure, the organization must protect everything to the highest level or accept under-protection; either choice is inefficient. The scenario does not mention disposal (A), availability (B), or ACL detail (C)—the core issue is misalignment of controls to classification.

Correct Answer: B

Option B achieves “safe-harbor” de-identification under HIPAA by removing direct identifiers and obfuscating quasi-identifiers such as precise dates. Hashing the image (A) does nothing for metadata identifiers. Encrypting (C) protects confidentiality but does not de-identify the data. Down-sampling (D) degrades clinical utility and still leaves metadata untouched.

Correct Answer: A

Jurisdiction-based data-locality requirements are essentially data-classification and location questions. Until you know exactly which data elements belong to which country (and can prove where they will reside, be processed and backed up) you cannot determine compliance. Option A is the only choice that creates the evidence needed to decide whether the PaaS architecture itself is lawful. B is useful but does not prove data-location compliance. C does not satisfy most data-locality laws because encrypted personal data is still considered “exported.” D is unrelated to residency obligations.

Correct Answer: B

Tokenization (B) replaces sensitive data with non-sensitive tokens and keeps the original values in an on-premise vault, eliminating the need to store regulated PAN data in the cloud and therefore reducing privacy liability. Hashing with salt in the same tenant (A) still leaves recoverable PANs if the salt is compromised. Full-database encryption (C) protects data at rest but does not remove the regulated data from the cloud provider’s custody. Truncating to the last four digits (D) destroys data utility for analytics and is not a reversible or complete protection strategy.

Correct Answer: B

PCI DSS considers any system storing full PANs as in-scope for all PCI requirements; therefore the asset must receive the highest classification (“Restricted”) to ensure strong encryption, access control, and destruction. A ignores the 30-day window of exposure. C confuses technical access with regulatory scope. D introduces an undefined label.

Correct Answer: A

A digital signature provides non-repudiation and integrity evidence, allowing the hospital to prove the strip has not been altered and to trace it back to the originating device (via the certificate). B is a hardware protection control, not chain-of-custody evidence. C tracks the physical device, not the data. D is trivial to spoof and offers no integrity protection.

Correct Answer: B

When data sets with different regulatory origins are combined, the highest/minimum common denominator rule applies. Option B keeps the stricter GDPR “Special Category” controls, thereby satisfying both GDPR transfer rules and HIPAA. A ignores GDPR’s prohibition on re-purposing consent-based data. C invents an arbitrary label without legal basis. D may destroy analytic value and still requires classification decisions for the anonymization residual risk.

Correct Answer: A

Crypto-shredding (changing the media-encryption key) instantly renders all previous data unrecoverable on modern self-encrypting drives and preserves resale value. Degaussing (B) is ineffective on SSDs and destroys the drive. Multi-pass overwrite (C) is unreliable due to over-provisioning and wear-leveling. D is overkill and still leaves no resale value.

Correct Answer: C

Even truncated PANs plus tokens can be replayed in certain contexts (PCI DSS SAQ guidance). “Confidential” reflects the need for encryption at rest and key protection. A ignores residual risk. B underestimates token replay. D over-classifies; full PAN is “Restricted,” but tokens are not PANs.

Correct Answer: B

Periodic hash verification with independent hash storage detects bit-rot early and triggers restoration from backup; it is the most cost-effective integrity control for long-term, rarely accessed data. RAID scrubbing (A) only protects against disk failure, not silent corruption. C is a valid media-renewal tactic but is more expensive and does not verify logical integrity. D adds redundancy but no integrity checking.

Correct Answer: A

Crypto-shredding is instantaneous and global; once the key is destroyed, data on any lagging replica becomes unrecoverable, meeting the user expectation. B and C still leave windows where replicas contain readable data. D hurts availability and does not address existing replicas.

Correct Answer: C

A live link to an accountable data owner ensures classification can be reviewed when business context changes. Creator name (A) becomes stale after org moves. Hash (B) is integrity, not classification accuracy. Purchase price (D) is financial, not security, metadata.

Correct Answer: D

In D the SaaS vendor never possesses the plaintext key, achieving true custodial separation. A and C still give the vendor transient access to the unwrapped key. B caches the key in vendor memory, exposing it to memory dumps or lawful intercept.

Correct Answer: B

A remote desktop/streaming session keeps the plaintext in the AWS data centre; disabling clipboard/file-transfer prevents exfiltration. A still allows the file to be downloaded inside China. D protects the laptop but not the asset once it leaves S3. C deters but does not prevent copying.

Correct Answer: B

PCI DSS explicitly forbids retaining magnetic-stripe data after authorisation; a classification & retention review identifies the illegal data so it can be destroyed, eliminating both regulatory risk and unnecessary cloud cost. A is wrong because the retailer, not the provider, is liable for PCI violations. C only adds a crypto control but does not purge prohibited data. D leaves the prohibited data intact; tokenisation protects PANs but not mag-stripe dumps.

Correct Answer: A

Domain 2 expects an organization to classify assets “in a timely manner” while supporting business and legal requirements. Option A introduces an interim controlled label, satisfies the 72-hour classification window, and preserves the 12-month SLA. B imposes an unnecessary business penalty. C leaves data under-classified, defeating downstream controls. D improperly outsources a core security responsibility.

Correct Answer: C

Cryptographic erasure—rendering data undecryptable by destroying the key—is fast, verifiable, and loggable; it scales in shared storage. A is unreliable because columnar stores may relocate blocks. B is procedural, not technical. D is costly and does not guarantee that snapshots or replicas are also shredded.

Correct Answer: A

Low-impact data is still company data; if disks are not sanitized between tenants (common in large-scale cloud) remanence is possible. B is incorrect—you can still delete customer-managed keys to render ciphertext unrecoverable (crypto-shredding). C is a geopolitical risk, not an asset-security remanence issue. D is an availability/integrity risk, not confidentiality.

Correct Answer: A

A jurisdictional sovereignty tag (A) directly labels data as “EEA-only,” allowing CASB/DLP tools to block cross-border transfers. ROPA (B) is a compliance register, not an enforceable technical tag. Owner (C) and criticality (D) do not drive geographic enforcement rules.

Correct Answer: C

Because you cannot confirm which laptops held sensitive CJIS data, the only compliant, low-risk option is physical destruction of the storage medium. Degaussing (A) ruins the entire laptop, wasting value. Cryptographic erase (B) is valid only if keys are provably destroyed and media is not expected to leave organizational control—here they are. Single pass (D) is insufficient for potential CJIS data.

Correct Answer: B

The QR code data itself is public, but its value relies on secrecy of the issuance process (i.e., the ability to counterfeit depends on knowing valid codes). The violation is disclosure of authentic identifiers—an issue of confidentiality, not integrity (data is unchanged) or availability (service is up).

Correct Answer: A

TPM-sealed full-disk encryption denies access when the disk is removed, is transparent to the OS, and adds no cloud or HSM cost. Double encryption (B) is overkill and increases support burden. HSMs (C) are expensive and unnecessary when keys can be sealed locally. Tokenization (D) breaks the on-prem licensing model and raises latency.

Correct Answer: A

Consistent classification across the enterprise is a core Domain 2 requirement. A produces a one-to-one mapping that aligns with the acquirer’s four-tier scheme and ensures policy enforcement tools (DLP, access control, retention) operate correctly. B invites inconsistent handling. C perpetuates fragmentation. D over-protects, potentially blocking legitimate business workflows and inflating cost.

Correct Answer: A

The real classification of the file is “Confidential/High” because of the embedded credentials. A content-aware control that re-evaluates and blocks on true classification closes the gap. B and D are generic access controls that do not address mis-classified data. C relies on human detection, which already failed.

Correct Answer: C

Domain 2 emphasizes labeling that is “persistent” and “usable across the life-cycle.” Technical, enforceable labels tied to hardware controls directly address the root cause: human mislabeling that enables data spillage. A focuses on the wrong threat vector (external penetration). B is punitive but not preventive. D merely escalates classification without fixing the process gap.

Correct Answer: B

You cannot select an appropriate confidentiality label or protection level until you know which laws (PCI-DSS, GDPR, CCPA, LGPD, etc.) apply; those statutes dictate minimum required controls. Encrypting or labeling data without this context (A, C) risks under- or over-protection. Buying a tool (D) is premature before the classification scheme is defined.

Correct Answer: B

Asset Security requires that destruction methods align with media type and classification. A 20 mm particle requirement for SSDs may be overkill or insufficient for magnetic drives; the standard must be reviewed. A is irrelevant—keys should be destroyed, not escrowed. C is secondary documentation. D is valid but later in the workflow.

Correct Answer: A

When classification is unknown, the secure default is the highest label—this avoids under-sanitization. B provides weak statistical assurance. C misses deleted or hidden data. D relies on incomplete assignment records.

Correct Answer: B

Classification is tied to the asset’s value and legal protection, not location or format. A, C, and D erroneously tie classification to network location or transport encryption level.

Correct Answer: A

Write-Once-Read-Many media is, by definition, non-erasable. Regulatory “right to be forgotten” still applies, so the only compliant path is destruction (shredding/incineration). B is illegal. C is technically impossible. D is ineffective because optical media is not magnetic.

Correct Answer: D

Cloud object-lock provides hardware-grade immutability plus geographic separation, meeting both retention and availability goals. WORM tape (A) is immutable but restores are slow, hurting availability. Blockchain (B) is immutable but introduces complexity and latency unsuitable for primary EHR queries. Local snapshots (C) are not immutable—ransomware can delete them.

Correct Answer: A

SHA-1 of MAC addresses (A) can be reversed by brute-forcing the 48-bit space, making re-identification trivial. Precise timestamps (B) and building names (C) increase risk but only if the identifier (MAC) can be recovered. A single semester (D) actually reduces risk by limiting the correlation window.

Correct Answer: A

Procedure codes (e.g., ICD-10) reliably indicate health information, triggering Special Category status. B is just an identifier format. C is unrelated to category. D is subjective and may be absent.

Correct Answer: C

Blocking the push at the server side (pre-receive hook) stops the exposure before it becomes part of the history. A would reduce risk but still allows mistakes in the private repo. B does not detect secrets. D is after-the-fact remediation.

Correct Answer: A

A gives both technical assurance (secure erase) and evidentiary proof (signed attestation). B leaves ciphertext intact; keys might be recovered. C contradicts the business need to share data. D does not guarantee deletion—drives could be lost or copied in transit.

Correct Answer: A

If keys are derived from the object ID, an attacker can enumerate identifiers and regenerate keys, breaking tenant isolation. Option A directly tests the confidentiality goal for co-mingled assets. B is irrelevant to isolation. C addresses availability, not isolation. D addresses transport security, not storage segregation.

Correct Answer: C

Physical destruction (degaussing) plus documented evidence (C) is the strongest assurance for sensitive offline media. Deleting keys (A) is acceptable for online crypto-shredding but does not meet defense-contractor requirements for physical media. Overwriting (B) is ineffective against modern high-coercivity tape. Relying on encryption alone (D) leaves residual data that may be decrypted in the future.

Correct Answer: B

Inconsistent classification tags cause downstream technical controls (IAM policies, DLP, CASB) to apply the wrong enforcement actions (B). Ownership (A) is a governance issue but not the primary technical risk. Key rotation (C) and retention (D) are unrelated to object-level tagging conflicts.

Correct Answer: D

S3 Lifecycle can transition based on age; using a separate customer-managed CMK in a compliance account enforces the key-segregation requirement. Intelligent-Tiering (B) does not guarantee Glacier nor key change. Config (C) detects but does not perform transition. CMK rotation (A) rotates the same key, not a different one.

Correct Answer: B

A container app (e.g., Workspace ONE, Intune managed app) sandboxes corporate data under enterprise keys, allowing selective cryptographic erase or app wipe. MDM full wipe (A) destroys personal data and may be illegal. C still wipes everything. D identifies but cannot delete data.

Correct Answer: A

The asset now contains credentials whose compromise would affect financial systems, so the classification must be elevated to ensure stricter handling rules. B fixes the exposure but ignores policy: the asset’s sensitivity has permanently increased. C does not address key leakage to anyone with repo access. D is excessive and hampers agile development.

Correct Answer: B

The business unit that profits from and decides on the data is the owner (Head of Payments); the entity that implements day-to-day controls on the infrastructure is the custodian (cloud SRE). A reverses the roles; C gives ownership to the wrong party; D assigns custody to an auditor who does not operate systems.

Correct Answer: B

A consistent, enterprise-wide classification scheme is the prerequisite for applying appropriate controls in the cloud (Domain 2). Option B builds the inventory and mapping needed to satisfy GDPR (lawful basis, data-minimization) and PCI DSS (scope-reduction). A only perpetuates inconsistent labels and does not address scope. C over-protects, driving unnecessary cost and complexity. D provides integrity assurance but does nothing for classification or jurisdictional requirements.

Correct Answer: C

Asset Security (Domain 2) requires that classification and labeling persist throughout the life-cycle, especially when responsibility shifts to a cloud shared-responsibility model. Option C ensures that EU-privacy obligations remain bound to the data set even when it moves to the PaaS object store. A is useful but reactive; classification must already be in place before migration. B merely adopts the vendor’s taxonomy without guaranteeing alignment to GDPR categories. D removes the data from the architecture instead of securing it in its intended environment.

Correct Answer: B

A random surrogate identifier prevents disclosure of business-relevant data while still allowing quick inventory sweeps; the CMDB provides the correlation when needed. A eliminates RF risk but slows down inventory. C leaks metadata length and still exposes ciphertext that can be brute-forced. D is impractical and does not protect assets outside the cafeteria.

Correct Answer: B

Dual-step destruction (degauss + 6 mm shred) (B) meets both PCI DSS and most national banking standards for top-secret data, and the shredded material can still be recycled. Cryptographic erasure (A) is acceptable only if full-disk encryption was always enabled, which is not stated. ATA secure-erase (C) is reversible with forensic tools if the firmware is compromised. Shredding alone to 12 mm (D) leaves larger recoverable pieces and is weaker than 6 mm.

Correct Answer: B

The policy trigger is “can lead to financial fraud.” Even with bcrypt, cracked passwords plus purchase history facilitate account-takeover fraud. The label must therefore be “Confidential.” A underestimates offline cracking. C overstates; policy does not mandate Restricted for hashed passwords. D is not among the company’s four-tier scheme.

Correct Answer: C

For Confidential data on SSDs, destruction (shred to < 5 mm) provides the highest assurance because overwrite and vendor secure-erase may be circumvented by spare-area remapping. B is acceptable for lower classifications but not for Confidential without additional verification. A is insufficient on flash media. D is not recognised sanitisation—key loss ≠ data destruction.

Correct Answer: D

Ensuring each record relates to at least k=50 individuals is the textbook definition of k-anonymity. Data minimization (A) would mean not sharing at all. Consent (B) is unrelated to the technical control. Differential privacy (C) would require mathematical noise, not suppression.

Correct Answer: C

The priority is to stop the contractual breach, preserve evidence, and enforce the agreement; suspension and forensics achieve this. A is aggressive and may destroy evidence. B is reactive and does not address the partner’s mis-use. D does nothing about the copy already on the laptop.

Correct Answer: B

If the DLP engine cannot read the file’s classification label it cannot enforce the “Confidential ≠ Internal” rule. A, C, and D are good practices but are not the root cause of the silent failure.

Correct Answer: B

Tokenization/hashing is the only option that fundamentally reduces the sensitivity of the data set while preserving analytic utility. An NDA (A) is administrative and does not prevent misuse. Strong encryption (C) protects only while the drives are at rest; once mounted on the air-gapped cluster the clear text is exposed. Logging serial numbers (D) is detective, not preventive.