A company has a policy that all data classified as 'Confidential' must be encrypted when stored on laptops. An employee is working from home and needs to access a confidential document. The employee's laptop is not encrypted. What is the MOST secure action?

Email the document to the employee's personal email account.

Print the document and have the employee pick it up.

Copy the document to a USB drive and have the employee pick it up.

Allow the employee to access the document via a secure remote desktop connection to the office network.

Which of the following is an example of a secure handling requirement for transmitting confidential information?

Posting the information on a public website

Sending the information via standard email without any protection

Using an encrypted communication channel such as TLS or a VPN

Faxing the information to any available number

A hospital is disposing of old computers that contain patient health records. The hard drives are still functional. What is the MOST appropriate method to ensure the data is irrecoverable?

Physically destroy the hard drives

Delete the files and empty the recycle bin

Use a software tool to overwrite the entire drive with random data

An organization is developing a data classification scheme. Which factor is most important when determining the classification level for a specific information asset?

The cost of the storage media on which the asset is stored

The department that created the asset

The file format used to store the asset

The sensitivity and criticality of the asset to the organization

A financial services firm has implemented a data classification scheme with four levels: Public, Internal, Confidential, and Restricted. They need to ensure that employees can easily identify the sensitivity of documents and follow proper handling procedures. Which control would be MOST effective?

Conduct annual security awareness training on data handling.

Restrict access to all documents based on job role.

Apply clear and consistent labels to all documents and digital files indicating their classification.

Encrypt all documents containing confidential or restricted data.

Certified Information Systems Security Professional

Domain 2Objective 2

2.2 - Establish Information and Asset Handling Requirements CISSP Practice Questions (Page 2)

Part of the Asset Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

10%of the exam

Questions 6–10

6expert · hard
A company has a policy that all data classified as 'Confidential' must be encrypted when stored on laptops. An employee is working from home and needs to access a confidential document. The employee's laptop is not encrypted. What is the MOST secure action?
Select an answer first
7foundation · easy
Which of the following is an example of a secure handling requirement for transmitting confidential information?
Select an answer first
8application · medium
A hospital is disposing of old computers that contain patient health records. The hard drives are still functional. What is the MOST appropriate method to ensure the data is irrecoverable?
Select an answer first
9foundation · easy
An organization is developing a data classification scheme. Which factor is most important when determining the classification level for a specific information asset?
Select an answer first
10application · medium
A financial services firm has implemented a data classification scheme with four levels: Public, Internal, Confidential, and Restricted. They need to ensure that employees can easily identify the sensitivity of documents and follow proper handling procedures. Which control would be MOST effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.