2.0 Asset Security CISSP Practice Quiz

• A. Define classification levels based on business value, sensitivity, legal obligations, and potential impact of disclosure or alteration
• B. Apply classification labels to the database name, not the data inside
• C. Skip classification on backups and reports because the source store is labeled
• D. Strip classification banners from documents because users find them distracting

Classification should reflect the value and risk of the information or asset to the organization. This is the correct answer.

• A. Review classification periodically and when business use, regulation, or data sensitivity changes
• B. Ignore backups and report extracts because the master record is already labeled
• C. Remove classification headers and footers because they're an aesthetic concern
• D. Default everything to public so the access control problem disappears

Classification can become inaccurate as data use and obligations change. This is the correct answer.

• A. Have DBAs unilaterally assign classification with no business-owner involvement
• B. Assign an accountable data owner to determine classification and approve handling requirements
• C. Use storage location as the only attribute that determines data classification
• D. Treat downstream copies as inheriting classification with no re-evaluation

Data owners understand business impact and are responsible for classification decisions. This is the correct answer.

• A. Skip data-level classification and use database-of-residence instead
• B. Include physical assets, information assets, software, services, and removable media in the asset inventory
• C. Skip labeling and access controls on derived reports built from classified data
• D. Disable visual classification labels because users complain they're noisy

Asset security requires knowing what exists before applying protection. This is the correct answer.

• A. Skip handling controls on data warehouses derived from classified sources
• B. Tie classification categories to control baselines such as encryption, access review, retention, and disposal requirements
• C. Suppress classification banners to keep PDF reports tidy
• D. Mark all information as public to avoid having to manage tiered access

Classification is useful when it drives practical security requirements. This is the correct answer.

• A. Mark every dataset 'public' to streamline information sharing
• B. Let infrastructure teams declare classification levels without business input
• C. Classify information consistently across structured data, unstructured data, backups, reports, and derived datasets
• D. Treat 'lives in DB-X' as the entire classification rule for the contents

Sensitive information can appear in many forms and should not lose classification because it changes format. This is the correct answer.

• A. Allow storage operators to assign classification with no consultation
• B. Inherit classification from the database object rather than the data semantics
• C. Identify asset custodians separately from asset owners when operational responsibility differs from business responsibility
• D. Treat backup copies as classification-irrelevant because the source is labeled

Owners decide value and requirements, while custodians operate or maintain assets. This is the correct answer.

• A. Hide classification markings to make documents look 'cleaner'
• B. Apply 'public' as the universal classification to make sharing easy
• C. Treat DBAs as data owners and skip business engagement in classification
• D. Use labels or metadata so users and systems can recognize the classification and apply handling rules

Classification must be visible or machine-readable to support consistent protection. This is the correct answer.