Asset Security GISP Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A university research department stores sensitive research data on a shared network drive. The department head is the 'owner' of the data, and the IT help desk manages the storage system. A new researcher needs access to the data. Who should authorize the access?

   • AThe new researcher, because they need the data for their work.
   • BThe department head, as the data owner, should approve the access request.
   • CThe university's legal counsel, because the data is sensitive.
   • DThe IT help desk, because they manage the storage system.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of maintaining an accurate and up-to-date asset inventory?

   • ATo provide a basis for effective risk management and security control implementation
   • BTo track employee productivity and usage of company devices
   • CTo satisfy external auditors' requirements for financial reporting
   • DTo determine the resale value of assets for budgeting purposes
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the purpose of a retention schedule for organizational assets?

   • ATo identify which employees are responsible for each asset
   • BTo assign a monetary value to assets for insurance purposes
   • CTo specify how long different types of assets must be kept before disposal
   • DTo determine the maximum number of assets that can be stored in a facility
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A multinational e-commerce company is subject to the GDPR and the California Consumer Privacy Act (CCPA). The company processes customer data in the EU and the US. The privacy team is designing a data protection program. Which requirement is common to both regulations?

   • AAppoint a Data Protection Officer (DPO) for all companies
   • BRequire explicit opt-in consent for all data processing
   • CProvide individuals with the right to access and delete their personal data
   • DConduct a Data Protection Impact Assessment (DPIA) for every processing activity
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A marketing analyst needs to share a spreadsheet containing customer email addresses and purchase history with an external vendor for a promotional campaign. The data is classified as 'Confidential' under the company's data classification policy. What should the analyst do before sharing the file?

   • ASend the file as-is because the vendor is under a non-disclosure agreement.
   • BAsk the vendor to sign a data processing agreement before sending the file.
   • CRemove the email addresses to make the data anonymous before sharing.
   • DEncrypt the file and share the password through a separate communication channel.
   Reveal Solution Discussion Select an answer first