Show notes
Shon Gerber from ShonGerber.com provides you the information and knowledge you need to prepare and pass the CISSP Exam while providing the tools you need to enhance your cybersecurity career. Shon utilizes his expansive knowledge while providing superior training from his years of training people in cybersecurity.
In this episode, Shon will talk about questions for Domain 2 (Asset Security) of the CISSP Exam.
BTW - Get access to all my CISSP Training Courses here at: https://shongerber.com/
CISSP Exam Questions
Question: 075
As head of sales, Jim is the data owner for the sales department. Which of the following is not Jim’s responsibility as data owner?
- Assigning information classifications
- Dictating how data should be protected
- Verifying the availability of data
- Determining how long to retain data
Answer: C. The responsibility of verifying the availability of data is the only responsibility listed that does not belong to the data (information) owner. Rather, it is the responsibility of the data (information) custodian. The data custodian is also responsible for maintaining and protecting data as dictated by the data owner. This includes performing regular backups of data, restoring data from backup media, retaining records of activity, and fulfilling information security and data protection requirements in the company’s policies, guidelines, and standards. Data owners work at a higher level than the data custodians. The data owners basically state, “This is the level of integrity, availability, and confidentiality that needs to be provided—now go do it.” The data custodian must then carry out these mandates and follow up with the installed controls to make sure they are working properly.
From <https://www.brainscape.com/flashcards/asset-security-6578977/packs/10419165>
------------------------------------
Question: 076
Assigning data classification levels can help with all of the following except:
- The grouping of classified information with hierarchical and restrictive security
- Ensuring that nonsensitive data is not being protected by unnecessary controls
- Extracting data from a database
- Lowering the costs of protecting data
Answer: C. Data classification does not involve the extraction of data from a database. However, data classification can be used to dictate who has access to read and write data that is stored in a database. Each classification should have separate handling requirements and procedures pertaining to how that data is accessed, used, and destroyed. For example, in a corporation, confidential information may only be accessed by senior management. Auditing could be very detailed and its results monitored daily, and degaussing or overwriting procedures may be required to erase the data. On the other hand, information classified as public may be accessed by all employees, with no special auditing or destruction methods required.
From <https://www.brainscape.com/flashcards/asset-security-6578977/packs/10419165>
------------------------------------
Question: 077
Susan, an attorney, has been hired to fill a new position at Widgets, Inc.: chief privacy officer (CPO). What is the primary function of her new role?
- Ensuring the
Gain access to 30 FREE CISSP Exam Questions each and every month by going to FreeCISSPQuestions.com and sign-up to join the team for Free.
Our TOPPODCAST Picks 
Stay Connected
