2.1 - Identify and Classify Information and Assets CISSP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A data owner in a pharmaceutical company has classified a research dataset as 'Confidential'. The data custodian is responsible for implementing controls. The owner wants to grant access to a new research partner, but the custodian is concerned about the partner's security posture. What should the custodian do?

   • AImplement the access as approved by the owner, but flag the security concern to the owner.
   • BReclassify the data as 'Internal' to reduce the need for strict controls.
   • CRefuse to grant access until the partner improves their security posture.
   • DGrant access without notifying the owner.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Besides supporting classification, what is another key benefit of maintaining a comprehensive asset inventory?

   • AIt automatically patches all software vulnerabilities
   • BIt simplifies the process of decommissioning and disposal of assets
   • CIt prevents all unauthorized access to the network
   • DIt guarantees that all assets are fully utilized
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A company is deciding how to classify a new dataset containing personally identifiable information (PII) of its customers. Which criterion is the MOST important to consider when assigning a classification level?

   • AThe legal and regulatory requirements for protecting the data
   • BThe age of the data
   • CThe storage location of the data
   • DThe file format used to store the data
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise has an asset inventory that is outdated and incomplete. The security team wants to implement asset classification, but the IT department is overwhelmed with day-to-day operations. The CISO must decide how to proceed with limited resources. What is the most effective approach?

   • AWait until the IT department has more time to update the inventory completely.
   • BPrioritize the inventory update for assets that support critical business processes, then classify those assets first.
   • CClassify assets based on the existing incomplete inventory.
   • DHire a third-party consultant to update the inventory and classify all assets.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A global bank is designing a data classification scheme. The legal department insists that customer financial data must be classified as 'Restricted' due to regulations. The marketing department argues that the same data, when aggregated and anonymized, should be 'Public' for market analysis. The CISO must balance legal requirements with business needs. What is the most appropriate approach?

   • AClassify the raw customer data as Restricted, and the anonymized aggregate data as Public, with a review process to ensure anonymization is effective.
   • BClassify all customer data as Restricted, including anonymized aggregates, to avoid any legal risk.
   • CClassify all customer data as Public to support marketing efforts.
   • DLet each department classify the data as they see fit.
   Reveal Solution Discussion Select an answer first