2.5 - Ensure Appropriate Asset Retention (e.g., End of Life (EOL), End of Support) CISSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of asset retention in the context of asset lifecycle management?

   • ATo keep assets only for the duration of their operational usefulness
   • BTo ensure assets are kept for as long as possible to maximize their value
   • CTo maintain assets for a defined period to meet legal, regulatory, contractual, and business requirements
   • DTo store all assets indefinitely to support potential future litigation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm must retain customer transaction records for seven years per regulatory requirements. The retention policy currently applies a uniform seven-year period to all data, including marketing emails and internal memos. An auditor has flagged that some records are being kept longer than necessary, increasing storage costs and legal exposure. What is the most appropriate action?

   • AExtend the retention period for all data to ten years to ensure compliance with any future regulatory changes.
   • BDelete all records older than seven years immediately, including those subject to the regulatory requirement.
   • CImplement a retention schedule that classifies data by type and sensitivity, applying the seven-year period only to regulated records and shorter periods to other data.
   • DRetain the uniform seven-year policy but move all data to cheaper archival storage to reduce costs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization's retention policy requires that customer data be deleted after three years. During an internal audit, the security team discovers that some customer data is still present on backup tapes from five years ago. What is the most appropriate action?

   • AIgnore the backup tapes because they are not actively used.
   • BEnsure that the backup tapes are securely destroyed or the data is purged, and update the retention process to include backups.
   • CUpdate the retention policy to allow backups to retain data longer than the original retention period.
   • DMove the backup tapes to a secure offsite location to reduce the risk of exposure.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A hospital uses a legacy medical device that is past its End of Life (EOL) but still within the vendor's extended support period, which ends in 12 months. The device is critical for patient monitoring and cannot be replaced within the support window due to budget constraints. The hospital's risk team is evaluating options. Which approach best balances patient safety, security, and operational continuity?

   • AIsolate the device from the network and continue using it indefinitely.
   • BNegotiate a custom support extension with the vendor while developing a phased replacement plan.
   • CContinue using the device until the extended support ends, then reassess the risk.
   • DImmediately decommission the device and switch to manual patient monitoring procedures.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hospital is decommissioning an MRI machine that contains a hard drive with patient imaging data. The device is being returned to the leasing company, which will resell it. What is the most appropriate action before returning the device?

   • ADelete the patient files from the hard drive and return the device.
   • BPerform a quick format of the hard drive and return the device.
   • CRely on the leasing company's promise to wipe the drive after return.
   • DRemove the hard drive and destroy it using a certified shredder, documenting the destruction.
   Reveal Solution Discussion Select an answer first