A company has a data classification policy with four levels. The policy states that 'Restricted' data must be encrypted at rest and in transit, and access must be logged and monitored. A new system is being deployed that will process 'Restricted' data, but the system's design does not support encryption at rest. The project manager wants to proceed with the deployment. What should the security team do?

Reclassify the data as 'Confidential' to avoid the encryption requirement.

Require the system to be modified to support encryption at rest before deployment.

Deploy the system and accept the risk of non-compliance.

Deploy the system and add encryption at a later date.

An organization is implementing a data classification program. What is the most direct benefit of this initiative?

It reduces the total storage capacity required for all organizational data

It guarantees that all data will remain confidential

It eliminates the need for data loss prevention (DLP) tools

It allows the organization to apply security controls that are commensurate with the value and risk of the data

A company uses three asset classification levels: Critical, Important, and Minor. A database server that supports the company's primary customer-facing application is considered Critical. Which protection measure is most appropriate for this asset?

Implement redundant power and network connections, and regular backups.

Apply standard security patches and basic access controls.

Only monitor the asset for unusual activity.

Use the same controls as for Minor assets to reduce costs.

In the asset classification process, what is the primary purpose of the 'labeling' step?

To encrypt the asset to prevent unauthorized access

To assign a unique serial number for inventory tracking

To mark the asset for disposal at the end of its lifecycle

To communicate the classification level and required handling procedures to users

What is the primary purpose of data classification in an organization?

To determine the appropriate level of protection based on the data's sensitivity and criticality

To ensure all data is encrypted at rest and in transit

To organize data into a hierarchical file structure for easier retrieval

To assign a monetary value to each data asset for insurance purposes

Certified Information Systems Security Professional

Domain 2Objective 1

2.1 - Identify and Classify Information and Assets CISSP Practice Questions (Page 2)

Part of the Asset Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

10%of the exam

Questions 6–10

6expert · hard
A company has a data classification policy with four levels. The policy states that 'Restricted' data must be encrypted at rest and in transit, and access must be logged and monitored. A new system is being deployed that will process 'Restricted' data, but the system's design does not support encryption at rest. The project manager wants to proceed with the deployment. What should the security team do?
Select an answer first
7foundation · easy
An organization is implementing a data classification program. What is the most direct benefit of this initiative?
Select an answer first
8application · medium
A company uses three asset classification levels: Critical, Important, and Minor. A database server that supports the company's primary customer-facing application is considered Critical. Which protection measure is most appropriate for this asset?
Select an answer first
9foundation · easy
In the asset classification process, what is the primary purpose of the 'labeling' step?
Select an answer first
10foundation · easy
What is the primary purpose of data classification in an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.