Question 100
A data lake has petabytes of objects but no map of which datasets contain restricted customer data. Which response best addresses the central security requirement with a defensible, risk-based design?
- Rely only on aggregate storage utilization charts
- Have the accountable owner classify data by disclosure impact and apply proportional controls
- Store classification in unsearchable personal notes
- Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle
Explanation
Correct Answer
D:A searchable inventory enables targeted controls and lawful retention.
Incorrect Answers
A:Capacity metrics reveal no data owner or sensitivity.
B:Sensitivity reflects expected harm from unauthorized disclosure rather than file size. Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle.
C:Local notes do not sustain an enterprise inventory.
Question 101
After a prior data sensitivity finding, a university consortium reports that the approved safeguard is implemented: “Have the accountable owner classify data by disclosure impact and apply proportional controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Classify every item only by extension
- Check that samples have owner-approved labels and matching access restrictions
- Run this adjacent but different test as the sole proof: Inspect owner signoff and change approvals for classification exceptions
- Accept a signed change ticket saying: Have the accountable owner classify data by disclosure impact and apply proportional controls
Explanation
Correct Answer
B:Classification is useful when it changes handling decisions.
Incorrect Answers
A:A spreadsheet can be public or highly sensitive. Check that samples have owner-approved labels and matching access restrictions.
C:Approval evidence confirms accountable decisions. It tests classification ownership, while this case requires evidence about data sensitivity.
D:Check that samples have owner-approved labels and matching access restrictions. Classification is useful when it changes handling decisions.
Question 102
After a prior asset criticality finding, a cloud service provider reports that the approved safeguard is implemented: “Rate asset criticality using process dependency, availability tolerance and business impact.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Map each high-criticality asset to a business process and validated recovery target
- Run this adjacent but different test as the sole proof: Check that samples have owner-approved labels and matching access restrictions
- Accept a signed change ticket saying: Rate asset criticality using process dependency, availability tolerance and business impact
- Use the completion of this alternative as proof: Sort asset importance by original invoice value
Explanation
Correct Answer
A:Dependency tracing justifies prioritization.
Incorrect Answers
B:Classification is useful when it changes handling decisions. It tests data sensitivity, while this case requires evidence about asset criticality.
C:Map each high-criticality asset to a business process and validated recovery target. Dependency tracing justifies prioritization.
D:Low-cost infrastructure can support essential processes. Map each high-criticality asset to a business process and validated recovery target.
Question 103
A research collaboration changes scientific data from internal to public but only the infrastructure operator approves the label. Which response best addresses the central security requirement with a defensible, risk-based design?
- Let storage administrators reclassify by disk utilization
- Rate asset criticality using process dependency, availability tolerance and business impact
- Automatically publish data after 30 days regardless of consent
- Require the accountable information owner to authorize reclassification after assessing impact and contractual restrictions
Explanation
Correct Answer
D:Custodians implement handling; owners determine sensitivity and permitted release.
Incorrect Answers
A:Storage capacity is not a sensitivity criterion.
B:Criticality depends on loss to mission, not replacement purchase price. Require the accountable information owner to authorize reclassification after assessing impact and contractual restrictions.
C:Age alone does not confer release authorization.
Question 104
After a prior metadata and inventories finding, a global logistics firm reports that the approved safeguard is implemented: “Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Rely only on aggregate storage utilization charts
- Reconcile physical and cloud assets against owner and classification metadata
- Accept a signed change ticket saying: Build governed metadata and asset inventories linking owners, sensitivity, location and lifecycle
- Run this adjacent but different test as the sole proof: Check that samples have owner-approved labels and matching access restrictions
Explanation
Correct Answer
B:Coverage checks reveal orphaned assets.
Incorrect Answers
A:Capacity metrics reveal no data owner or sensitivity. Reconcile physical and cloud assets against owner and classification metadata.
C:Reconcile physical and cloud assets against owner and classification metadata. Coverage checks reveal orphaned assets.
D:Classification is useful when it changes handling decisions. It tests data sensitivity, while this case requires evidence about metadata and inventories.
Question 105
An incident review documented this data sensitivity exposure: A file share mixes public brochures and unpublished acquisition figures without classification. The response team proposed only “Classify every item only by extension” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Uniform treatment wastes resources or misses critical paths.
- A spreadsheet can be public or highly sensitive.
- Price does not measure disclosure harm.
- Reader convenience is not a classification authority.
Explanation
Correct Answer
B:A spreadsheet can be public or highly sensitive. The missing change involves a spreadsheet can be public or highly sensitive.
Incorrect Answers
A:Uniform treatment wastes resources or misses critical paths. The actual criticized measure is a spreadsheet can be public or highly sensitive.
C:Price does not measure disclosure harm. The actual criticized measure is a spreadsheet can be public or highly sensitive.
D:Reader convenience is not a classification authority. That does not establish a spreadsheet can be public or highly sensitive.
Question 106
An incident review documented this asset criticality exposure: A minor lab server and the primary customer authorization database appear equally important in inventory. The response team proposed only “Sort asset importance by original invoice value” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Low-cost infrastructure can support essential processes.
- Local notes do not sustain an enterprise inventory.
- Uniform treatment wastes resources or misses critical paths.
- Reader convenience is not a classification authority.
Explanation
Correct Answer
A:Low-cost infrastructure can support essential processes. The relevant alternative is low-cost infrastructure can support essential processes.
Incorrect Answers
B:Local notes do not sustain an enterprise inventory. The actual criticized measure is low-cost infrastructure can support essential processes.
C:Uniform treatment wastes resources or misses critical paths. The actual criticized measure is low-cost infrastructure can support essential processes.
D:Reader convenience is not a classification authority. That does not establish low-cost infrastructure can support essential processes.
Question 107
A confidential report is correctly classified but emailed without any handling instructions. Which response best addresses the central security requirement with a defensible, risk-based design?
- Grant access only to the minimum records necessary for the authorized purpose
- Assume encryption alone tells recipients permitted use
- Change the filename to a random string
- Apply consistent visible or machine-readable labels that drive approved handling controls
Explanation
Correct Answer
D:Labels communicate how the authorized classification should travel with data.
Incorrect Answers
A:Clearance does not automatically imply need-to-know for unrelated data. Apply consistent visible or machine-readable labels that drive approved handling controls.
B:Ciphertext does not communicate usage rules after decryption.
C:An opaque name does not encode handling requirements.
Question 108
A supplier exchanges restricted contracts over an untrusted public link. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use authenticated encrypted transport and recipient validation appropriate to classification
- Compress messages before sending them openly
- Use a time-limited documented exception with owner approval and compensating controls
- Rely on a private-looking URL without TLS
Explanation
Correct Answer
A:Transmission protection must address both interception and wrong-recipient risk.
Incorrect Answers
B:Compression does not prevent eavesdropping.
C:Exceptional access should be accountable, scoped and revoked. Use authenticated encrypted transport and recipient validation appropriate to classification.
D:URL appearance does not prove channel confidentiality.
Question 109
A business database stores regulated records on shared disks without encryption or access segmentation. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply consistent visible or machine-readable labels that drive approved handling controls
- Apply data-at-rest encryption with key governance and least-privilege storage access
- Use a shared administrator account for all backups
- Enable only HTTP transport TLS
Explanation
Correct Answer
B:Storage controls protect sensitive contents and key custody across media and backups.
Incorrect Answers
A:Labels communicate how the authorized classification should travel with data. Apply data-at-rest encryption with key governance and least-privilege storage access.
C:Shared privileges broaden exposure and weaken attribution.
D:Transport TLS does not protect disk contents.
Question 110
A project engineer requests all HR salary data to troubleshoot one employee ID mapping. Which response best addresses the central security requirement with a defensible, risk-based design?
- Publish the dataset to a shared troubleshooting channel
- Grant the engineer unrestricted HR access because they are internal
- Apply data-at-rest encryption with key governance and least-privilege storage access
- Grant access only to the minimum records necessary for the authorized purpose
Explanation
Correct Answer
D:Clearance does not automatically imply need-to-know for unrelated data.
Incorrect Answers
A:Broad disclosure far exceeds the purpose.
B:Employment is not an entitlement to all sensitive data.
C:Storage controls protect sensitive contents and key custody across media and backups. Grant access only to the minimum records necessary for the authorized purpose.
Certified Information Systems Security Professional (CISSP) Practice Tests