2.3 - Provision Information and Assets Securely CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In an organization, who is ultimately responsible for determining the classification level of an information asset and ensuring it is properly labeled and protected?

   • AThe custodian
   • BThe security auditor
   • CThe asset owner
   • DThe user
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In asset management, what does the 'end-of-life' phase of an asset's lifecycle primarily involve?

   • AReclassifying the asset to a lower sensitivity level
   • BTransferring ownership to another department
   • CUpgrading the asset to a newer version
   • DSecure disposal or decommissioning of the asset
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A hospital has a policy that requires all patient records to be classified as 'Confidential'. The hospital's IT department is responsible for implementing access controls on the electronic health record (EHR) system. A new nurse has been hired and needs access to patient records for her daily duties. Who is responsible for determining the nurse's level of access?

   • AThe hospital's data owner, typically the Chief Medical Officer or a designated manager
   • BThe nurse's supervisor, because they know the nurse's job duties
   • CThe IT department, because they manage the EHR system
   • DThe nurse herself, because she knows what she needs to do her job
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software development company uses a cloud-based code repository to store its source code. The company's security policy requires that all source code be encrypted at rest. The cloud provider offers encryption by default, but the company wants to manage its own encryption keys. Which of the following is the most appropriate way to meet this requirement?

   • AStore the source code in a separate encrypted database
   • BUse the cloud provider's default encryption and rely on the provider's key management
   • CEncrypt the source code locally before uploading it to the repository
   • DEnable a customer-managed key (CMK) feature provided by the cloud service
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is migrating its on-premises file servers to a cloud storage service. The migration includes sensitive customer data. The security team wants to ensure that the data is protected during the transfer and while at rest in the cloud. Which of the following is the most important control to implement?

   • AEncrypt the data using TLS during transfer and enable server-side encryption at rest
   • BUse a VPN to connect the on-premises network to the cloud provider
   • CRequire multi-factor authentication for all users accessing the cloud storage
   • DEnsure the cloud provider has strong physical security at its data centers
   Reveal Solution Discussion Select an answer first