What is the primary purpose of a data retention policy?

To minimize the cost of data storage by deleting all data as soon as possible

To ensure all data is encrypted at rest

To comply with legal, regulatory, and business requirements for how long data must be kept

To ensure data is kept for as long as possible for future analysis

A company is decommissioning a server that contains data classified as 'Internal'. The data is no longer needed, but the server will be repurposed for a different function. What is the MOST appropriate action?

Overwrite the hard drives with a single pass of zeros.

Physically destroy the hard drives.

Perform a quick format of the hard drives.

Use a certified data sanitization tool that overwrites the drives with multiple passes.

What is the primary purpose of labeling information assets with their classification level?

To indicate the classification and handling requirements to users

To increase the storage capacity of the system

To track the physical location of the asset

To automatically encrypt all labeled data

A government agency is decommissioning a data center and must dispose of hard drives that contain classified information. The drives are still functional. Which destruction method is MOST appropriate?

Reformatting the drives and repurposing them

Overwriting the drives with multiple passes of random data

Physically shredding the drives

An organization has implemented a data classification scheme with labels such as 'Confidential' and 'Internal'. They are now creating a procedure for handling documents. What should the procedure include?

Specific instructions for storage, transmission, and disposal based on the classification label.

Instructions to store all documents in a locked cabinet.

A general rule to treat all documents as confidential.

Instructions to destroy all documents after reading.

Certified Information Systems Security Professional

Domain 2Objective 2

2.2 - Establish Information and Asset Handling Requirements CISSP Practice Questions (Page 1)

Part of the Asset Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

10%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of a data retention policy?
Select an answer first
2expert · hard
A company is decommissioning a server that contains data classified as 'Internal'. The data is no longer needed, but the server will be repurposed for a different function. What is the MOST appropriate action?
Select an answer first
3foundation · easy
What is the primary purpose of labeling information assets with their classification level?
Select an answer first
4application · medium
A government agency is decommissioning a data center and must dispose of hard drives that contain classified information. The drives are still functional. Which destruction method is MOST appropriate?
Select an answer first
5application · medium
An organization has implemented a data classification scheme with labels such as 'Confidential' and 'Internal'. They are now creating a procedure for handling documents. What should the procedure include?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.