Asset Security GISP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A multinational corporation is implementing a data classification policy. The policy defines four labels: Public, Internal, Confidential, and Restricted. An employee in the HR department needs to send a spreadsheet containing employee salaries to the payroll outsourcing provider. Which label should be applied to the spreadsheet?

   • AConfidential
   • BInternal
   • CPublic
   • DRestricted
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A retail company collects customer names, addresses, and purchase history. They want to share this data with a marketing analytics firm for trend analysis. What is the most privacy-preserving approach?

   • AShare only the purchase history without any customer information.
   • BObtain explicit consent from each customer before sharing the data.
   • CAnonymize the data by removing direct identifiers such as names and addresses.
   • DShare the raw data with the analytics firm under a confidentiality agreement.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A healthcare organization is implementing a data classification policy. The policy defines 'Protected Health Information (PHI)' as data that must be encrypted and access-controlled. The organization also has 'Internal' data that requires no special handling. A nurse accidentally emails a spreadsheet containing PHI to an unauthorized recipient. The organization's security team needs to respond. What is the first step?

   • AConduct a full risk assessment to determine the impact of the breach
   • BDiscipline the nurse for violating the data classification policy
   • CContain the incident by asking the recipient to delete the email and confirm deletion
   • DReport the incident to the regulatory authority within the required timeframe
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A financial services company is implementing a data classification scheme. The compliance officer insists that all customer financial data be labeled as 'Confidential' and that access be restricted to employees with a legitimate business need. The marketing team, however, wants to use customer email addresses for a promotional campaign. What should the company do?

   • AKeep the 'Confidential' label but require marketing to obtain explicit consent from customers before using their email addresses
   • BRemove email addresses from the customer database to avoid any conflict
   • CAllow marketing to use the email addresses because they are not as sensitive as financial account numbers
   • DClassify customer email addresses as 'Internal' to allow marketing to use them freely
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a key characteristic of an effective asset inventory?

   • AIt is comprehensive and includes hardware, software, and data assets
   • BIt includes only hardware assets that are connected to the network
   • CIt is stored in a single spreadsheet accessible only to the IT department
   • DIt is updated only during annual audits to reduce administrative overhead
   Reveal Solution Discussion Select an answer first