A security administrator is responsible for sanitizing a set of hard drives that were used in a high-security environment. The drives contain classified data and will be disposed of. The administrator must choose a method that provides the highest assurance of data irrecoverability. Which method is most appropriate?

Overwriting the drives with random data

Physical destruction of the drives

Encrypting the drives and destroying the key

A healthcare app collects patient health data and must comply with both GDPR and local health regulations. The app is offered in multiple EU countries. To minimize privacy risk, which practice should the app implement during data collection?

Store data in the user's country to avoid all legal issues

Anonymize data after collection, regardless of purpose

Collect only the minimum data necessary for the stated purpose

Collect all available data to avoid future re-collection

A social media company collects user data for personalized advertising. The company is expanding to a new country with strict data localization laws. To comply, the company must store data of local users within the country. However, the company's analytics team needs access to the data for global reporting. What is the most appropriate approach?

Anonymize local users' data and store it outside the country

Store all data in the company's existing data center and argue that the law is not applicable

Stop collecting data from local users to avoid the requirement

Store local users' data in the new country and provide analytics access through a secure connection

Certified Information Systems Security Professional

Domain 2Objective 4

2.4 - Manage Data Lifecycle CISSP Practice Questions (Page 2)

Part of the Asset Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

10%of the exam

Questions 6–10

6expert · hard
A security administrator is responsible for sanitizing a set of hard drives that were used in a high-security environment. The drives contain classified data and will be disposed of. The administrator must choose a method that provides the highest assurance of data irrecoverability. Which method is most appropriate?
Select an answer first
7application · medium
A healthcare app collects patient health data and must comply with both GDPR and local health regulations. The app is offered in multiple EU countries. To minimize privacy risk, which practice should the app implement during data collection?
Select an answer first
8expert · hard
A social media company collects user data for personalized advertising. The company is expanding to a new country with strict data localization laws. To comply, the company must store data of local users within the country. However, the company's analytics team needs access to the data for global reporting. What is the most appropriate approach?
Select an answer first
9foundation · easy
Which role is typically responsible for implementing the technical controls and performing the day-to-day backup, restoration, and storage operations for a data asset?
Select an answer first
10foundation · easy
Which data destruction method is most suitable for optical media such as CDs and DVDs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

2.4 - Manage Data Lifecycle CISSP Practice Questions (Page 2)

Questions 6–10

A healthcare app collects patient health data and must comply with both GDPR and local health regulations. The app is offered in multiple EU countries. To minimize privacy risk, which practice should the app implement during data collection?

Which role is typically responsible for implementing the technical controls and performing the day-to-day backup, restoration, and storage operations for a data asset?

Which data destruction method is most suitable for optical media such as CDs and DVDs?

Keep studying — Asset Security