Asset Security practice questions

Answer: A) Restricted: encryption, need-to-know access, and access logging. Public: change control and availability protections, with no read restrictions

Each classification level should map to its own baseline of handling controls, so protection matches sensitivity. Restricted data needs strong confidentiality and auditing controls, and Public data still needs protection for integrity and availability.

• ACorrect. Controls should match each level's sensitivity and impact. Restricted data needs strong confidentiality and accountability controls. Public data is meant to be disclosed, so the main risks are unauthorized changes, such as defacement, and loss of availability.
• BIncorrect. Treating all data the same over-protects low-sensitivity data. It adds unnecessary cost and limits legitimate use of material that is meant to be published.
• CIncorrect. Public data still needs protection for integrity and availability. Unauthorized changes to published material can damage the organization's reputation and mislead customers.
• DIncorrect. Handling requirements come from the data's classification, not from where it is stored. Location can affect how a control is implemented, but it does not set the level of protection required.

Answer: A) Patching, monitoring, and configuration baselines can only be applied to assets the organization knows it has

You can't protect what you don't know you have. An accurate inventory sets the scope for patching, monitoring, baselines, and incident response, so it comes before most other controls.

• ACorrect. Nearly every other control depends on the inventory. Systems nobody knows about are never patched, monitored, or hardened, and they also widen the scope of any incident. That makes inventory the foundation of the asset security program.
• BIncorrect. An inventory tells you what exists, and scanning tells you what is weak on those assets. The two work together, and the inventory defines what scanning has to cover. It does not replace scanning.
• CIncorrect. Depreciation and licensing are real uses for an inventory, but they are financial and compliance benefits. They do not explain why the inventory is the foundation of security controls.
• DIncorrect. Data classification and owner assignment are separate governance decisions made by the business. The inventory can record them once they are made, but listing an asset does not make those decisions.

Answer: A) Purpose limitation

• AData should be used only for the purposes stated at collection, unless further use is lawful and disclosed.
• BRemanence concerns residual data after deletion.
• CSovereignty concerns which country's laws apply to data.
• DDefense in depth is a layered security architecture principle.

Answer: A) Scoping (removing non-applicable controls) and tailoring (adjusting the remaining controls to the context)

• AScoping trims a baseline to what is relevant; tailoring refines the parameters and compensating measures so the baseline fits the actual system and risk.
• BThose are database-confidentiality concerns, not baseline customization.
• CThose are the assessment and authorization steps, performed after controls are selected.
• DThose are media-sanitization methods.

Answer: A) Data custodian

• ACustodians implement and maintain the protections that owners define.
• BData subjects are the people the data describes.
• CThe owner sets requirements and is accountable.
• DAuditors evaluate controls independently.

Answer: A) Purge each drive with a media-appropriate method that makes lab recovery infeasible, then verify and record the result

When media will be reused outside the organization, it should be purged with a method suited to the media type (for example, NIST SP 800-88 purge) so data can't be recovered, and the sanitization should be verified and documented. Formatting is not sanitization, and degaussing does not work on SSDs.

• APurge makes target data recovery infeasible even with state-of-the-art laboratory techniques, and the media stays reusable. Verifying and keeping records of the sanitization supports chain of custody and audit.
• BDeleting volumes and quick-formatting only removes file system references. The underlying data stays recoverable, so data remanence is not addressed.
• CDegaussing works only on magnetic media and does not sanitize flash-based SSDs. It also typically leaves magnetic drives unusable, which conflicts with the resale requirement.
• DUpdating inventory and ownership records is an administrative step. It does nothing to remove the data that remains on the drives.

Answer: A) Data remanence; the drive should have been purged or destroyed using an approved sanitization method

Data remanence is residual data left on media after deletion or formatting, and it can still be recovered. Media leaving the organization's control should be sanitized by purging or destruction according to NIST SP 800-88 guidance.

• ADeleting files and doing a quick format remove only references to the data. The data itself stays on the media and can be recovered. Purge techniques (such as degaussing magnetic media or cryptographic erase) or physical destruction make recovery infeasible, as described by NIST SP 800-88.
• BRetention schedules control how long data is kept. The records here were deleted. The problem is that deletion did not make them unrecoverable, so keeping data too long is not the issue.
• CAggregation is when combining pieces of lower-sensitivity data reveals more sensitive information. It does not explain how deleted data was recovered from released media.
• DReclassifying data changes its label and handling requirements. It does nothing to remove residual data from the media before the media leaves the organization's control.

Answer: A) Full-disk encryption using a TPM combined with a pre-boot PIN

Once a device is lost or stolen, only encryption of the data at rest with strong pre-boot authentication keeps the data confidential. Remote wipe, OS passwords and DLP can all be bypassed by an attacker who has physical control of the device.

• AFull-disk encryption keeps the data unreadable if someone runs attack tools against the device or moves the drive to another machine. Adding a pre-boot PIN to the TPM means the device cannot start or unlock without the user's PIN, which is multifactor protection.
• BRemote wipe is a useful extra control, but it only works if the device connects to the network after the loss is reported. An attacker can keep the device offline or remove the drive and read it directly.
• COS authentication protects only the running operating system. If the disk is unencrypted, an attacker can boot other media or move the drive to another machine and read the data without signing in.
• DDLP stops authorized users from moving data through monitored channels. It does not protect data at rest from someone who has physical control of the device and its storage.

Answer: A) Marking each drive with its sensitivity level and the handling requirements it carries

Marking media with its sensitivity level and handling requirements is the control that tells every handler what protection applies. Encryption, inventory records and NDAs support security but don't give that guidance on each drive.

• ACorrect. Visible markings tell anyone who picks up the drive how sensitive it is and how to store, transport and dispose of it, at every stage of its life.
• BIncorrect. Encryption protects confidentiality if a drive is lost, but it doesn't tell a handler how sensitive the drive is or what storage and transport rules apply.
• CIncorrect. Inventory records support tracking and accountability, but the person physically handling the drive can't see them, so they don't tell that person what protection is needed.
• DIncorrect. An NDA creates a legal obligation, but it doesn't tell the handler how sensitive a particular drive is or how to handle it.

Answer: A) Digital rights management

• ADRM enforces usage restrictions on the content itself, wherever it goes.
• BFirewalls control traffic, not document use after delivery.
• CFDE protects stored data on the server, not shared documents.
• DPort security limits switch connections.