Quiz
CISSP - Chapter 2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (72)
1Angela is an information security architect at a bank and has been assigned to ensure that transactions are secure as they traverse the network. She recommends that all transactions use TLS. What threat is she most likely attempting to stop, and what method is she most likely using to protect against it?
- AMan-in-the-middle, VPN
- BPacket injection, encryption
- CSniffing, encryption
- DSniffing, TEMPEST
2Control Objectives for Information and Related Technology (COBIT) is a framework for information technology (IT) management and governance. Which data management role is most likely to select and apply COBIT to balance the need for security controls against business requirements?
- ABusiness Owners
- BData processors
- CData owners
- DData stewards
3Nadia's company is operating a hybrid cloud environment with some on-site systems and some cloud-based systems. She has satisfactory monitoring on-site, but needs to apply security policies to both the activities her users engage in and to report on exceptions with her growing number of cloud services. What type of tool is best suited to this purpose?
- ANGFW
- BA CASB
- CAn IDS
- DA SOAR
4When media is labeled based on the classification of the data it contains, what rule is typically applied regarding labels?
- AThe data is labeled based on its integrity requirements.
- BThe media is labeled based on the highest classification level of the data it contains.
- CThe media is labeled with all levels of classification of the data it contains.
- DThe media is labeled with the lowest level of classification of the data it contains.
5Which one of the following administrative processes assists organizations in assigning appropriate levels of security control to sensitive information?
- AData classification
- BRemanence
- CTransmitting data
- DClearing
6How can a data retention policy help to reduce liabilities?
- ABy ensuring that unneeded data isn't retained
- BBy ensuring that incriminating data is destroyed
- CBy ensuring that data is securely wiped so it cannot be restored for legal discovery
- DBy reducing the cost of data storage required by law
7Staff in an information technology (IT) department who are delegated responsibility for day-to-day tasks hold what data role?
- ABusiness owner
- BUser
- CData processor
- DCustodian
8Helen's company uses a simple data lifecycle as shown in the figure here. What stage should come first in their data lifecycle?
- AData policy creation
- BData labeling
- CData collection
- DData analysis
9Ben has been tasked with identifying security controls for systems covered by his organization’s information classification system. Why might Ben choose to use a security baseline?
- AIt applies in all circumstances, allowing consistent security controls.
- BThey are approved by industry standards bodies, preventing liability.
- CThey provide a good starting point that can be tailored to organizational needs.
- DThe ensure that systems are always in a secure state.
10Megan wants to prepare media to allow tor its reuse in an environment operating at the same sensitivity level. Which of the following is the best option to meet her needs?
- AClearing
- BErasing
- CPurging
- DSanitization
11Mikayla wants to identify data that should be classified that already exists in her environment. What type of tool is best suited to identifying data like Social Security numbers, credit card numbers, and similar well-understood data formats?
- AManual searching
- BA sensitive data scanning tool
- CAn asset metadata search tool
- DA data loss prevention system (DLP)
12What issue is common to spare sectors and bad sectors on hard drives as well as overprovisioned space on modern SSDs?
- AThey can be used to hide data.
- BThey can only be degaussed.
- CThey are not addressable, resulting in data remanence.
- DThey may not be cleared, resulting in data remanence.
13Naomi knows that commercial data is typically classified based on different criteria than government data. Which of the following is not a common criterion for commercial data classification?
- AUseful lifespan
- BData value
- CImpact to national security
- DRegulatory or legal requirements
14What term best describes data that is resident in system memory?
- AData at rest
- BBuffered data
- CData in use
- DData in motion
15What technique could you use to mark your trade secret information in case it was released or stolen and you need to identify it?
- AClassification
- BSymmetric encryption
- CWatermarks
- DMetadata
16What type of encryption is best suited for use on the file servers for the proprietary data, and how might you secure the data when it is in motion?
- ATLS at rest and AES in motion
- BAES at rest and TLS in motion
- CVPN at rest and TLS in motion
- DDES at rest and AES in motion
17What does labeling data allow a DLP system to do?
- AThe LP system can detect labels and apply appropriate protections based on rules.
- BThe LP system can adjust labels based on changes in the classification scheme.
- CThe LP system can modify labels to permit requested actions.
- DThe DLP system can delete unlabeled data.
18Why is it cost effective to purchase high-quality media to contain sensitive data?
- AExpensive media is less likely to fail.
- BThe value of the data often far exceeds the cost of the media.
- CExpensive media 1S easier to encrypt.
- DMore expensive media typically improves data integrity.
19Chris is responsible for workstations throughout his company and knows that some of the company's workstations are used to handle both proprietary information and highly sensitive trade secrets. Which option best describes what should happen at the end of their life (EOL) for workstations he is responsible for?
- AErasing
- BClearing
- CSanitization
- DDestruction
20Fred wants to classify his organization's data using common labels: private, sensitive, public, and proprietary. Which of the following should he apply to his highest classification level based on common industry practices?
- APrivate
- BSensitive
- CPublic
- DProprietary
21What scenario describes data at rest?
- AData in an IPsec tunnel
- BData in an e-commerce transaction
- CData stored on a hard drive
- DData stored in RAM
22If you are selecting a security standard for a Windows 10 system that processes credit cards. What security standard is your best choice?
- AMicrosoft's Windows 10 security baseline
- BThe CIS Windows 10 baseline
- CPCI DSS
- DThe NSA Windows 10 Secure Host Baseline
23The CIS benchmarks are an example of what practice?
- AConducting a risk assessment
- BImplementing data labeling
- CProper system ownership
- DUsing security baselines
24Adjusting the CIS benchmarks to your organization's mission and your specific IT systems would involve what two processes?
- AScoping and selection
- BScoping and tailoring
- CBaselining and tailoring
- DTailoring and selection
25How should you determine which controls from the baseline should be applied to a given system or software package?
- AConsult the custodians of the data.
- BSelect based on the data classification of the data it stores or handles.
- CApply the same controls to all systems.
- DConsult the business owner of the process the system or data supports.
26The company that Henry works for operates in the EU and collects data about their customers. They send that data to a third party to analyze and provide reports to help the company make better business decisions. What term best describes the third-party analysis company:
- AThe data controller
- BThe data owner
- CThe data subject
- DThe data processor
27The government defense contractor that Stela works for has recently shut down a major research project and is planning on reusing the hundreds of thousands of dollars of systems and data storage tapes used for the project for other purposes. When Stela reviews the company's internal processes, she finds that she can't reuse the tapes and that the manual says they should be destroyed. Why isn't Selah allowed to degauss and then reuse the tapes to save her employer money?
- AData permanence may be an Issue
- BData remanence is a concern
- CThe tapes may suffer from bitrot
- DData from tapes can't be erased by degaussing
28Information maintained about an individual that can be used to distinguish or trace their identity is known as what type of information?
- APersonally identifiable information (PII)
- BPersonal health information (PHI)
- CSocial Security number (SSN)
- DSecure identity information (SII)
29Which of the following information security risks to data at rest would result in the greatest reputational impact on an organization?
- AImproper classification
- BData breach
- CDecryption
- DAn intentional insider threat
30Full disk encryption like Microsoft's BitLocker is used to protect data in what state?
- AData in transit
- BData at rest
- CUnlabeled data
- DLabeled data
31The company that Katie works for provides its staff with mobile phones for employee use with new phones issued every two years. What scenario best describes this type of practice when the phones themselves are still usable and receiving operating system updates
- AEOL
- BPlanned obsolescence
- CEOS
- DDevice risk management
32What is the primary purpose of data classification?
- AIt quantifies the cost of a data breach.
- BIt prioritizes IT expenditures.
- CIt allows compliance with breach notification laws.
- DIt identifies the value of the data to the organization.
33Fred's organization allows downgrading of systems for reuse after projects have been finished and the systems have been purged. What concern should Fred raise about the reuse of the systems from his Top Secret classified project for a future project classified as Secret?
- AThe Top Secret data may be commingled with the Secret data, resulting in a need to relabel the system.
- BThe cost of the sanitization process may exceed the cost of new equipment.
- CThe data may be exposed as part of the sanitization process
- DThe organization's DLP system may flag the new system due to the difference in data labels.
34Which of the following concerns should not be part of the decision when classifying data?
- AThe cost to classify the data
- BThe sensitivity of the data
- CThe amount of harm that exposure of the data could cause
- DThe value of the data to the organization
35Which of the following is the least effective method of removing data from media?
- ADegaussing
- BPurging
- CErasing
- DClearing
36What encryption technology would be appropriate for HIPAA documents in transit:
- ABit Locker
- BDES
- CTLS
- DSSL
37Amanda's employer asks Amanda to classify patient X-ray data that has an internal patient identifier associated with it but does not have any way to directly identify a patient. The company's data owner believes that exposure of the data could cause damage (but not exceptional damage) to the organization. How should Amanda classify the data:
- APublic
- BSensitive
- CPrivate
- DConfidential
38What technology could Amanda's employer implement to help prevent confidential data from being emailed out of the organization?
- ADIP
- BIDS
- CA firewall
- DUDP
39Jacob's organization uses the US government's data classification system, which includes Top Secret, Secret, Confidential, and Unclassified ratings (from most sensitive to least). Jacob encounters a system that contains Secret, Confidential, and Top Secret data. How should it be classified?
- ATop Secret
- BConfidential
- CSecret
- DMixed classification
40Elle is planning her organization's asset retention efforts and wants to establish when the company will remove assets from use. Which of the following is typically the last event in a manufacturer or software provider's lifecycle?
- AEnd of life
- BEnd of support
- CEnd of sales
- DGeneral availability
41Amanda has been asked to ensure that her organization's controls assessment procedures match the specific systems that the company uses. What activity best matches this task?
- AAsset management
- BCompliance
- CScoping
- DTailoring
42Chris is responsible for his organization's security standards and has guided the selection and implementation of a security baseline for Windows PCs in his organization. How can Chris most effectively make sure that the workstations he is responsible for are being checked for compliance and that settings are being applied as necessary?
- AAssign users to spot-check baseline compliance.
- BUse Microsoft Group Policy.
- CCreate startup scripts to apply policy at system start
- DPeriodically review the baselines with the data owner and system owners.
43Frank is reviewing his company's data lifecycle and wants to place appropriate controls around the data collection phase. Which of the following ensures that data subjects agree to the processing of their data?
- ARetention
- BConsent
- CCertification
- DRemanence
44As a DBA, Amy's data role in her organization includes technical implementations of the data policies and standards, as well as managing the data structures that the data is stored in What data role best fits what Amy does?
- AData custodian
- BData owner
- CData processor
- DData user
45The company Jim works for suffered from a major data breach in the past year and now wants to ensure that it knows where data is located and if it is being transferred, is being copied to a thumb drive, or is in a network file share where it should not be. Which of the following solutions is best suited to tagging, monitoring, and limiting where files are transferred to?
- ADRM
- BDLP
- CA network IPS
- DAntivirus
46What security measure can provide an additional security control in the event that backup tapes are stolen or lost?
- AKeep multiple copies of the tapes
- BReplace tape media with hard drives
- CUse appropriate security labels.
- DUse AES-256 encryption.
47Joe works at a major pharmaceutical research and development company and has been tasked with writing his organization's data retention policy. As part of its legal requirements, the organization must comply with the US Food and Drug Administration's Code of Federal Regulations Title 21. To do so, it is required to retain records with electronic signatures. Why would a signature be part of a retention requirement?
- AIt ensures that someone has reviewed the data.
- BIt provides confidentiality.
- CIt ensures that the data has been changed
- DIt validates who approved the data.
48Susan wants to manage her data's lifecycle based on retention rules. What technique can she use to ensure that data that has reached the end of its lifecycle can be identified and disposed of based on her organization's disposal processes?
- ARotation
- BDRM
- CDLP
- DTagging
49Ben has been asked to scrub data to remove data that is no longer needed by his organization. What phase of the data lifecycle is Ben most likely operating in?
- AData retention
- BData maintenance
- CData remanence
- DData collection
50Steve is concerned about the fact that employees leaving his organization were often privy to proprietary information. Which one of the following controls is most effective against this threat?
- ASanitization
- BNDAs
- CClearing
- DEncryption
51Alex works for a government agency that is required to meet US federal government requirements for data security. To meet these requirements, Alex has been tasked with making sure data is identifiable by its classification level when it is created. What should Alex do to the data?
- AClassify the data.
- BEncrypt the data.
- CLabel the data.
- DApply DRM to the data.
52Ben is following the National Institute of Standards and Technology (NIST) Special Publication 800-88 guidelines for sanitization and disposition as shown here. He is handling information that his organization classified as sensitive, which is a moderate security categorization in the NIST model. If the media is going to be sold as surplus, what process does Ben need to follow?
- ADestroy, validate, document
- BClear, purge, document
- CPurge, document, validate
- DPurge, validate, document
53What methods are often used to protect data in transit?
- ATelnet, ISDN, UDP
- BBitLocker, File Vault
- CAES, Serpent, IDEA
- DTLS, VPN, IPsec
54Which one of the following data roles bears ultimate organizational responsibility for data?
- ASystem owners
- BBusiness owners
- CData owners
- DMission owners
55Shandra wants to secure an encryption key. Which location would be the most difficult to
protect, if the key was kept and used in that location?- AOn a local network
- BOn disk
- CIn memory
- DOn a public network
56If Chris is one of the data owners for the organization, what steps in this process is he most likely responsible for?
- AHe is responsible for steps 3, 4, and 5.
- BHe is responsible for steps 1, 2, and 3.
- CHe is responsible for steps 5, 6, and 7.
- DAll of the steps are his direct responsibility.
57Chris manages a team of system administrators. What data role are they fulfilling if they conduct steps 6, 7, and 8 of the classification process?
- AThey are system owners and administrators.
- BThey are administrators and custodians
- CThey are data owners and administrators.
- DThey are custodians and users.
58If Chris's company operates in the European Union and has been contracted to handle the data for a third party, what role is his company operating in when it uses this process to. classify and handle data:
- ABusiness owners
- BMission owners
- CData processors
- DData administrators
59Chris needs to identify all of the active systems and devices on the network. Which of the following techniques will give him the most complete list of connected devices?
- AQuery Active Directory for a list of all computer objects.
- BPerform a port scan of all systems on the network.
- CAsk all staff members to fill out a form listing all of their systems and devices.
- DUse network logs to identify all connected devices and track them down from there.
60Chris knows that his inventory is only accurate at the moment it was completed. How can he best ensure that it remains up-to-date?
- APerform a point-in-time query of network connected devices and update the list based on what is found.
- BEnsure that procurement and acquisition processes add new devices to the inventory before they are deployed.
- CRequire every employee to provide an updated inventory of devices they are responsible for on a quarterly basis.
- DManually verify every device in service at each organizational location on a yearly basis.
61Chris knows that his organization has more than just physical assets. In fact, his organization's business involves significant intellectual property assets, including designs and formulas. Chris needs to track and inventory those assets as well. How can he most effectively ensure that he can identify and manage data throughout his organization based on its classification or type?
- ATrack file extensions for common data types.
- BEnsure that data is collected in specific network share locations based on the data type and group that works with it.
- CUse metadata tagging based on data type or security level.
- DAutomatically tag data by file extension type.
62Chris has been tasked with identifying intangible assets but needs to provide his team with a list of the assets they will be inventorying. Which of the following is not an example of an intangible asset?
- APatents
- BDatabases
- CFormulas
- DEmployees
63Which of the following is not a common requirement for the collection of data under data privacy laws and statutes?
- AOnly data that is needed is collected.
- BData should be obtained lawfully and via fair methods.
- CData should only be collected with the consent of the individual whose data is being collected.
- DData should be collected from all individuals equally.
64Susan works in an organization that labels all removable media with the classification
level of the data it contains, including public data. Why would Susan's employer label all
media instead of labeling only the media that contains data that could cause harm if it
was exposed?- AIt is cheaper to order all prelabeled media.
- BIt prevents sensitive media from not being marked by mistake.
- CIt prevents reuse of public media for sensitive data.
- DLabeling all media is required by HIPAA.
65Data stored in RAM is best characterized as what type of data?
- AData at rest
- BData in use
- CData in transit
- DData at large
66What issue is the validation portion of the NIST SP 800-88 sample certificate of sanitization (shown here) intended to help prevent?
- ADestruction
- BReuse
- CData remanence
- DAttribution
67Why is declassification rarely chosen as an option for media reuse?
- APurging is sufficient for sensitive data.
- BSanitization is the preferred method of data removal.
- CIt is more expensive than new media and may still fail.
- DClearing is required first.
68Incineration, crushing, shredding, and disintegration all describe what stage in the lifecycle of media:
- ASanitization
- BDegaussing
- CPurging
- DDestruction
69What term is used to describe information like prescriptions and X-rays?
- APHI
- BProprietary data
- CPID
- DPII
70Why might an organization use unique screen backgrounds or designs on workstations that deal with data of different classification levels?
- ATo indicate the software version in use
- BTo promote a corporate message
- CTo promote availability
- DTo indicate the classification level of the data or system
71Charles has been asked to downgrade the media used for storage of private data for his
organization. What process should Charles follow?- ADegauss the drives, and then relabel them with a lower classification level.
- BPulverize the drives, and then reclassify them based on the data they contain.
- CFollow the organization's purging process, and then downgrade and replace labels.
- DRelabel the media, and then follow the organization's purging process to ensure that the media matches the label.
72Which of the following tasks is not performed by a system owner per NIST SP 800-18?
- ADevelops a system security plan
- BEstablishes rules for appropriate use and protection of data
- CIdentifies and implements security controls
- DEnsures that system users receive appropriate security training
Information
- Description
- Graduate CISSP Quiz on CISSP - Chapter 2, created by Craig Willey on 03/02/2022.
- Author
- Craig Willey
- Language
- English
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz