Assets and Their Corresponding Protection Level CT-STE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a personnel asset in a security context?

   • AA network firewall appliance
   • BA database containing customer personal information
   • CA custom authentication software module
   • DA security administrator who manages access controls
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company must classify a legacy system that contains both public product information and confidential pricing data. The system is difficult to update. Which protection level should be assigned?

   • AHigh protection, because the confidential pricing data requires strong controls, even though the system is difficult to update.
   • BLow protection, because the system is legacy and difficult to update.
   • CMedium protection, because the system contains both public and confidential data.
   • DNo protection, because the system is legacy and will be replaced soon.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is classifying its assets. The customer database contains protected health information (PHI) subject to HIPAA, while the public marketing brochure PDF is freely downloadable from the website. The security team must assign protection levels. Which approach correctly aligns protection levels with asset characteristics?

   • AAssign the customer database a higher protection level than the brochure because PHI has higher sensitivity and regulatory impact.
   • BAssign both assets the same protection level because all organizational data should receive uniform safeguards.
   • CAssign the brochure a higher protection level because it is publicly accessible and therefore more exposed to tampering.
   • DAssign protection levels based solely on the cost of the hardware storing each asset.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An asset is classified as having a 'high' protection level. Which of the following control mappings is most appropriate?

   • AImplementing multi-factor authentication and encryption for the asset
   • BUsing the same controls as for a low-protection asset to save costs
   • CRelying solely on network firewalls without additional controls
   • DApplying only basic password protection, as the asset is not critical
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following inputs is most important when determining the protection level for an asset?

   • AThe number of security controls already in place
   • BThe asset's physical location within the data center
   • CThe asset's value, sensitivity, and applicable regulatory requirements
   • DThe asset's age and maintenance history
   Reveal Solution Discussion Select an answer first