Asset Security GISP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization is deploying a new patient portal that will allow patients to view their medical records online. The privacy officer is concerned about unauthorized access to patient data. Which control is most important to implement?

   • ARequire multi-factor authentication for all patient portal users
   • BImplement a data retention policy that deletes patient records after one year
   • CAllow patients to share their login credentials with family members
   • DEncrypt the patient portal's database at rest
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A government agency is required to retain certain records for 10 years, but other records must be destroyed after 3 years. The agency currently stores all records in a single repository without any retention labels. The agency is facing a lawsuit that requires a legal hold on all records related to a specific project. What is the best approach?

   • AApply a legal hold to the project records and then implement automated retention policies for all other records
   • BKeep all records indefinitely to avoid any risk of non-compliance
   • CDelete all records older than 3 years immediately to comply with the retention schedule
   • DAsk the legal team to manually review each record and decide whether to keep or delete it
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A government contractor is required to retain project emails for seven years per federal regulations. The IT department currently keeps all emails indefinitely because they are unsure which ones must be retained. This has led to excessive storage costs and difficulty locating relevant records. What is the best approach?

   • AImplement an email retention policy that automatically archives emails related to government projects for seven years and deletes non-project emails after a shorter period
   • BAsk employees to manually delete emails they think are not important
   • CDelete all emails older than seven years without reviewing them
   • DContinue storing all emails indefinitely to avoid any risk of non-compliance
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A government agency is decommissioning a server that contained classified information. The server's hard drives are still functional. Which disposal method is most appropriate?

   • ASell the hard drives to a certified electronics recycler.
   • BDegauss the hard drives and then physically destroy them.
   • CReformat the hard drives and reuse them in another server.
   • DDelete the files and empty the recycle bin.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise has an asset inventory that is maintained manually in spreadsheets. The security team discovers that several high-value servers were not included in the inventory, and some decommissioned servers were not properly disposed of. The team must improve asset management. What is the most effective approach?

   • AOutsource asset management to a third-party vendor.
   • BRequire all employees to report new devices to the IT department within 24 hours.
   • CImplement an automated asset discovery tool that scans the network and integrates with the inventory system.
   • DConduct a one-time physical audit of all assets and update the spreadsheet.
   Reveal Solution Discussion Select an answer first