2.1 - Identify and Classify Information and Assets CISSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A document is classified as 'Confidential'. Which of the following handling procedures is MOST appropriate based on this classification?

   • AIt should be protected with access controls and encrypted when stored or transmitted
   • BIt should be shredded immediately after creation
   • CIt should be shared freely with all employees to increase collaboration
   • DIt can be posted on the public website
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is tasked with classifying the organization's assets. The analyst has already identified all assets and created an inventory. According to the asset classification process, what should the analyst do next?

   • ADocument the classification scheme and procedures.
   • BSelect security controls for each asset.
   • CLabel each asset with its classification level.
   • DCategorize each asset based on its value and criticality to the business.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A multinational corporation is developing a data classification policy. The legal team notes that personal data of EU residents is subject to GDPR, while the marketing team wants to classify a product launch video as public. The CISO needs to ensure that classification criteria are consistent and defensible. Which set of criteria should the policy use to assign classifications?

   • AValue to the organization, sensitivity of the data, legal and regulatory requirements, and potential business impact if compromised.
   • BStorage location, data format, and the number of users who access the data.
   • CThe department that created the data and the file extension of the data.
   • DThe cost of the storage system and the age of the data.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services firm is implementing a data classification program. The compliance team has identified that customer financial records are subject to strict regulatory requirements, while marketing brochures have no regulatory impact. The CISO wants to ensure that classification labels directly influence the security controls applied. Which approach best aligns classification with control selection?

   • AClassify all data as confidential to ensure maximum protection, regardless of regulatory requirements.
   • BAssign classifications based on the data's value, sensitivity, and legal requirements, then map each classification to a baseline set of security controls.
   • CLet each business unit decide its own classification scheme and control requirements independently.
   • DApply the same security controls to all data, then classify based on the controls that are already in place.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing company wants to improve its security posture by categorizing all physical and logical assets, including servers, network devices, software licenses, and intellectual property. The security manager needs to distinguish this effort from data classification. What is the primary purpose of asset classification?

   • ATo assign confidentiality labels to data files and databases.
   • BTo track the location and ownership of every asset in the organization.
   • CTo categorize all types of organizational assets based on their value and criticality to the business.
   • DTo determine the depreciation value of assets for financial reporting.
   Reveal Solution Discussion Select an answer first