A company is developing a new product and has created a design document that contains trade secrets. They also have a public press release about the product. How should these documents be classified?

Design document: Confidential; Press release: Public

Design document: Public; Press release: Confidential

Design document: Internal; Press release: Public

A multinational corporation must comply with GDPR, which requires that personal data not be kept longer than necessary. They also have a business requirement to retain customer transaction records for seven years for tax purposes. How should the company reconcile these requirements?

Delete all personal data immediately after the transaction is complete.

Anonymize all personal data after the transaction to avoid GDPR obligations.

Implement a retention policy that deletes personal data once the business purpose is fulfilled, while retaining transaction records for the legally required period.

Retain all data for seven years to satisfy the tax requirement, as it overrides GDPR.

Which data destruction method is most appropriate for a hard disk drive that contained highly confidential information and is being decommissioned?

Deleting all files and emptying the recycle bin

Encrypting the drive and then discarding it

What is the primary goal of establishing information handling requirements for an asset?

To ensure the asset is stored in the most cost-effective manner

To protect the asset's confidentiality, integrity, and availability throughout its lifecycle

To ensure the asset is accessible to all employees

To simplify the process of sharing data with external partners

Which labeling technique is most appropriate for a printed document containing confidential information?

Encrypting the document with a password

Storing the document in a locked cabinet

Adding a digital watermark to the file metadata

Placing a visible classification banner on the document header or footer

Certified Information Systems Security Professional

Domain 2Objective 2

2.2 - Establish Information and Asset Handling Requirements CISSP Practice Questions (Page 4)

Part of the Asset Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

10%of the exam

Questions 16–20

16application · medium
A company is developing a new product and has created a design document that contains trade secrets. They also have a public press release about the product. How should these documents be classified?
Select an answer first
17application · medium
A multinational corporation must comply with GDPR, which requires that personal data not be kept longer than necessary. They also have a business requirement to retain customer transaction records for seven years for tax purposes. How should the company reconcile these requirements?
Select an answer first
18foundation · easy
Which data destruction method is most appropriate for a hard disk drive that contained highly confidential information and is being decommissioned?
Select an answer first
19foundation · easy
What is the primary goal of establishing information handling requirements for an asset?
Select an answer first
20foundation · easy
Which labeling technique is most appropriate for a printed document containing confidential information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.