(ISC)² CISSP Asset Security Practice Questions

Free CISSP Asset Security practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main (ISC)² CISSP page. Sign up free to practice the full set.

1. Question 1Asset Security

   Why classify data (e.g., public, internal, confidential, restricted)?

   • ATo justify deleting backups and archived copies of data judged low value to the business
   • BTo apply protection proportional to sensitivity (access, encryption, handling, retention)Correct
   • CTo make every dataset uniformly available and visible to all internal users regardless of sensitivity
   • DTo choose faster or cheaper storage tiers based on how each dataset happens to be labeled
   ✓ Correct answer: B

   Data is classified as public, internal, confidential, or restricted so that protection is applied proportional to sensitivity rather than uniformly. Classification drives the access controls, encryption strength, handling and labeling rules, retention period, and disposal method appropriate to each tier, letting an organization avoid both over-protecting low-value information and under-protecting sensitive information, which wastes resources or creates unacceptable risk.

   Why the other options are wrong

   • AClassification governs handling and retention; it is not a rationale for removing backups.
   • CUniform broad access contradicts the purpose of separating data by sensitivity.
   • DStorage performance tiering is an operational concern, not the security aim of classification.
2. Question 2Asset Security

   For a data warehouse used by analysts, which technique best preserves analytical utility while protecting individual privacy in the design?

   • AStoring raw PII in cleartext and relying solely on table-level passwords
   • BReversible tokenization with the token vault accessible openly to all analysts
   • CGranting analysts full unrestricted administrative rights to the source production systems
   • Danonymization/aggregation or differential privacy so individuals cannot be re-identifiedCorrect
   ✓ Correct answer: D

   Preserving analytical utility while protecting individual privacy means transforming the data itself, not just restricting access to it; anonymization, aggregation, or differential privacy remove or obscure identifying detail so re-identification is impractical, while analysts can still run statistics on the result. Raw PII behind a password, reversible tokens with an open vault, or broad admin rights all leave individuals identifiable to anyone with that access.

   Why the other options are wrong

   • ARaw PII behind a table password is still fully identifiable to anyone who has that password.
   • BA tokenization vault accessible to all analysts lets anyone reverse the tokens back to PII, defeating the protection.
   • CBroad administrative rights to source systems expand access rather than protecting individual privacy.
3. Question 3Asset SecuritySelect all that apply

   Which TWO statements about data states and the controls that protect them are correct? (Choose TWO)

   • AData in transit is best protected by TLS or IPsec encryptionCorrect
   • BData in use can be protected by confidential-computing techniques such as trusted execution environments (enclaves)Correct
   • CHashing a stored password makes the password recoverable for support purposes
   • DData at rest is protected only by network firewalls
   ✓ Correct answer: A, B

   Data in transit is protected by transport encryption such as TLS or IPsec, which shields it from interception on the wire. Data in use, meaning while it is actively being processed in memory, is a harder problem addressed by confidential-computing techniques like trusted execution environment enclaves that keep even privileged processes from reading it. Hashing is one-way and never reversible for recovery, and network firewalls control traffic, not data at rest.

   Why the other options are wrong

   • CHashing is a one-way function; a properly hashed password cannot be recovered, only compared against a new hash.
   • DData at rest needs encryption and access controls on the storage itself; a firewall only controls network traffic reaching it.
4. Question 4Asset Security

   A media company embeds an invisible identifier into each licensed video copy so that if the file is leaked, the specific recipient who leaked it can be traced. Which technique is being used?

   • ADigital watermarkingCorrect
   • BFull-disk encryption
   • CHashing
   • DDegaussing
   ✓ Correct answer: A

   Digital watermarking inserts an identifier into content that is difficult to remove without degrading the file, allowing the owner to attribute a leaked copy to a particular recipient. It supports intellectual-property protection and leak attribution rather than preventing access.

   Why the other options are wrong

   • BFull-disk encryption protects data at rest on a device; it does not embed traceable identifiers into individual content copies.
   • CHashing produces a fixed-length integrity value for data but does not embed a recoverable per-recipient identifier inside the content.
   • DDegaussing destroys data on magnetic media; it is a sanitization method, not a leak-tracing technique.
5. Question 5Asset Security

   An organization handling payment cards must comply with PCI DSS scoping. Which action MOST effectively reduces the scope of systems subject to PCI DSS controls?

   • ANetwork segmentation that isolates the cardholder data environment from other systemsCorrect
   • BIncreasing the minimum password length policy enforced across all servers company-wide
   • CDeploying antivirus software on every single workstation across the enterprise
   • DEnabling verbose diagnostic logging on all network devices for review
   ✓ Correct answer: A

   PCI DSS scope includes every system that stores, processes, or transmits cardholder data, plus any system connected to or able to affect the security of that environment. Properly implemented network segmentation, using firewalls or ACLs to isolate the cardholder data environment (CDE), removes unrelated systems from that connected category entirely. This is the only control among the choices that changes what falls in scope; the others are good hygiene but leave the assessment boundary unchanged.

   Why the other options are wrong

   • BLonger passwords strengthen authentication but do not remove any system from the CDE.
   • CEndpoint antivirus is sound hygiene but does not shrink which systems are in scope.
   • DVerbose logging aids forensics but has no effect on the PCI DSS assessment boundary.
6. Question 6Asset Security

   A bank is decommissioning self-encrypting solid-state drives (SSDs) that held Restricted data. The drives will be reused internally on a lower-classification system, and physical destruction is not desired. Because SSDs use wear-leveling that can leave remnants outside the logical address space, what is the MOST appropriate sanitization method to render the data unrecoverable while keeping the drives usable?

   • ACryptographic erase by destroying the drive's media encryption key, combined with the secure-erase commandCorrect
   • BA single-pass overwrite of every logical block with zeros using host-based disk-wiping software
   • CDegaussing the drives with a very strong magnetic field sized for enterprise storage media arrays
   • DDeleting all partitions and performing a full file-system reformat of every drive before reuse
   ✓ Correct answer: A

   SSD wear-leveling and over-provisioning relocate data to physical cells outside the logical address range software can reach, so a host-level overwrite of logical blocks can leave remnants intact. Cryptographic erase destroys the media encryption key, instantly rendering every ciphertext block on the drive - reachable or not - unrecoverable, and pairing it with the vendor's secure-erase command (a NIST-defined purge action) gives high assurance while leaving the drive functional for reuse at a lower classification.

   Why the other options are wrong

   • BOverwriting logical blocks misses remapped cells that wear-leveling holds outside the addressable space.
   • CDegaussing erases magnetic media and has no effect on flash-based SSD storage.
   • DReformatting only clears file-system metadata, leaving the underlying data recoverable.
7. Question 7Asset Security

   During an acquisition, the acquiring firm inherits thousands of backup tapes whose contents and classification are unknown, some likely containing regulated personal data. Before deciding how to protect, retain, or dispose of them, what should the security team do FIRST?

   • ADiscover and inventory the assets and determine the classification of the data they contain so that proportionate controls and retention or disposal decisions can be madeCorrect
   • BImmediately destroy every inherited backup tape outright to eliminate any potential future liability or breach exposure arising from the unknown regulated data
   • CEncrypt all of the inherited tapes and move them into long-term offsite cold storage indefinitely without conducting any further review of their contents
   • DApply the acquiring firm's most sensitive classification to every inherited tape by default and protect them all at that highest level going forward
   ✓ Correct answer: A

   Asset security and lifecycle decisions depend on knowing what you hold and how sensitive it is. The correct first step is discovery and inventory followed by determining the classification of the contained data. Only then can the team apply proportionate controls, honor retention obligations or legal holds, and decide what may be disposed of and how. Acting before classification risks destroying records under hold or under-protecting regulated data.

   Why the other options are wrong

   • BDestroying tapes before assessment could purge records under legal or regulatory retention obligations.
   • CEncrypting and shelving indefinitely defers the required inventory and classification decision.
   • DDefaulting all tapes to the highest classification skips discovery and inventory and over-controls low-value data while ignoring retention duties.
8. Question 8Asset Security

   A cloud-based SaaS provider stores tenant data encrypted at rest with a unique key per tenant. When a tenant terminates its contract, the provider needs an efficient way to render that tenant's data permanently unrecoverable without physically destroying shared multi-tenant storage hardware. Which technique best meets this need?

   • ACrypto-shredding by securely destroying the tenant's unique encryption keyCorrect
   • BRunning a full-disk overwrite across the entire shared storage array
   • CRelying on the storage vendor's own standard data retention policy
   • DPhysically destroying every drive inside the shared storage array
   ✓ Correct answer: A

   Crypto-shredding relies on strong encryption where each tenant's data is protected by its own key; deleting and overwriting that key renders the ciphertext practically irrecoverable, since no key remains to decrypt it. This works well in shared multi-tenant storage because it destroys only the target tenant's access without affecting the underlying media other tenants use. It is fast, scalable, and does not require locating every copy of the plaintext.

   Why the other options are wrong

   • BA full-disk overwrite is impractical and destructive in shared storage, affecting other tenants' data on the same array.
   • CA generic retention policy does not guarantee immediate, verifiable, tenant-specific unrecoverability at contract termination.
   • DPhysically destroying shared drives would also destroy other tenants' data, which is unacceptable in a multi-tenant environment.

How Asset Security is tested

This domain holds 109 of the 1,117 questions in the CISSP bank, about 10%. The mix is 94 single-answer multiple choice and 15 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Asset Security on its own rather than re-running full-length mocks.

Other CISSP exam domains

• Security and Risk Management172 questions
• Security Architecture and Engineering141 questions
• Communication and Network Security138 questions
• Identity and Access Management138 questions
• Security Assessment and Testing130 questions
• Security Operations157 questions
• Software Development Security132 questions
• All CISSP practice questions1,117 total
• Asset Security study notesKey concepts
• Security practice examsAll Security

CISSP Asset Security FAQ