2.5 - Ensure Appropriate Asset Retention (e.g., End of Life (EOL), End of Support) CISSP Practice Questions (Page 4)

Questions 16–18

1. 16expert · hard

   A company's main application is running on an operating system that will reach End of Support in 6 months. The application is critical to business operations and cannot be upgraded to a newer OS version because the application vendor has not certified it. The company is considering options. Which approach best manages the risk?

   • ADecommission the application and move to a manual process.
   • BForce the upgrade to the new OS and hope the application works.
   • CImplement compensating controls, such as network isolation and enhanced monitoring, while working with the application vendor to certify the new OS.
   • DContinue running the application on the unsupported OS and accept the risk.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturer has been notified that a model of industrial controller it uses will reach End of Life (EOL) in six months. The controller still functions correctly and the company has no immediate need for new features. What is the most important consideration for the company's asset management planning?

   • AThe company can continue using the controller indefinitely as long as it meets functional requirements.
   • BThe controller's functionality will degrade immediately, so the company must replace it before the EOL date.
   • CThe controller will no longer receive security patches, so the company must plan for replacement or additional compensating controls.
   • DThe vendor will stop selling the controller, so the company should stockpile spare units to extend the useful life.
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   A company is decommissioning a data center and must dispose of thousands of hard drives. Some drives contain highly confidential customer data, while others contain only public marketing material. The company has a limited budget for disposal. What is the most appropriate disposal strategy?

   • ASell all drives to a certified recycler without sanitization to recover some cost.
   • BClassify the drives by data sensitivity and apply appropriate disposal methods: destruction for confidential data and degaussing or overwriting for public data.
   • CPhysically destroy all drives to ensure uniform security.
   • DOverwrite all drives with a single pass of zeros and then resell them.
   Reveal Solution Discussion Select an answer first