2.3 - Provision Information and Assets Securely CISSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm is implementing a new data governance program. The Chief Information Officer (CIO) has designated the head of each business unit as the individual responsible for the data their unit creates, including determining its classification and approving access requests. The IT department is tasked with implementing the technical controls and maintaining the systems that store the data. Which of the following best describes the role of the head of each business unit in this arrangement?

   • AData steward
   • BCustodian
   • CAsset owner
   • DUser
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is implementing a data loss prevention (DLP) solution. The DLP solution will monitor data in use, in motion, and at rest. The security team needs to define rules for what constitutes sensitive data. Which of the following is the most important input for defining these rules?

   • AThe vendor contracts, which specify data protection requirements
   • BThe asset inventory, which lists all data repositories and their classifications
   • CThe employee handbook, which outlines acceptable use policies
   • DThe network diagram, which shows how data flows through the organization
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A university's research department stores sensitive research data on a network file share. The data is owned by the principal investigator (PI) of each research project. The IT department manages the file server and performs backups. A graduate student who is a member of a research project needs access to the data for analysis. Who is responsible for granting the student access to the data?

   • AThe principal investigator, because they are the asset owner
   • BThe university's data protection officer, because they oversee data privacy
   • CThe IT department, because they manage the file server
   • DThe graduate student, because they are a member of the project
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a policy that all data must be classified at the time of creation. However, employees often forget to classify new documents, and the documents are stored with a default classification of 'Internal'. This has led to some sensitive documents being under-classified. Which of the following is the most effective way to address this issue?

   • AImplement automated classification tools that use content analysis to suggest a classification
   • BTrain employees on the importance of data classification
   • CChange the default classification to 'Confidential'
   • DRequire employees to complete a classification form before saving any document
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise has an asset inventory that is maintained in a spreadsheet by a single administrator. The administrator is leaving the company, and the new security manager discovers that the inventory is incomplete and outdated. The company is required to report to regulators on the location and classification of all data assets. Which of the following is the most effective way to improve the accuracy and completeness of the inventory?

   • AAssign responsibility for maintaining the inventory to a dedicated asset management team and implement automated discovery tools
   • BPurchase a commercial asset management tool and install it without customizing it to the organization's needs
   • CRequire all employees to report their assets to the security team on a monthly basis
   • DConduct a one-time comprehensive audit and update the spreadsheet
   Reveal Solution Discussion Select an answer first