Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Asset Classification & OwnershipSwitch
All CISSP topics

2.0 Asset Security

Asset Classification & Ownership Practice Questions

Classification schemes, data owner vs. custodian vs. steward, asset inventory, and handling requirements.

One solved question, so you can see how these are marked

A federal agency is categorizing a new information system under a government impact-based scheme. Which factor BEST determines whether confidentiality should be rated low, moderate, or high?

The harm unauthorized disclosure could cause to agency operations, assets, or individuals

Government impact categorization rates the potential effect of a loss of confidentiality, integrity, or availability, such as low, moderate, or high impact. User count, replacement cost, and a vendor's marketing tier do not establish the agency's impact level.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Asset Classification & Ownership questions in this set

Answers and explanations appear when you work through the set above.

  1. A company uses Public, Internal, Confidential, and Restricted labels. A product roadmap includes unreleased pricing and acquisition targets. Which classification is MOST appropriate before the roadmap is approved for release?

    • Public, because employees created it
    • Internal, because it is used only by business departments
    • Confidential, because every business document receives the same label
    • Restricted, because unauthorized release could materially harm the business

  2. Who is ordinarily accountable for approving the classification of a business unit's customer data and accepting the residual risk of its handling?

    • The database administrator acting as custodian
    • The system owner responsible for the hosting platform
    • The data owner representing the business
    • The data steward responsible for maintaining metadata

  3. A data owner classifies payroll records as Restricted and specifies encryption, access approval, and retention rules. Which activity is the custodian MOST likely to perform?

    • Changing classification to reduce storage costs without owner approval
    • Approving the business purpose for collecting each record
    • Defining the organization's enterprise classification levels
    • Configuring storage, backups, and access to meet the owner's requirements

  4. A large organization wants reliable ownership and handling decisions for data shared across finance, legal, and marketing. Which responsibility BEST describes a data steward?

    • Maintaining definitions, metadata, quality rules, and daily governance for a data subject area
    • Operating the servers that host every copy of the data
    • Accepting all business risk for the data classification
    • Taking over classification approval and residual risk acceptance when a department changes its reporting line

  5. During a cloud migration, who is primarily responsible for ensuring that the payroll application has an approved system security plan, operating controls, and a current risk decision for the platform as a whole?

    • The business data steward
    • The individual payroll user
    • The system owner
    • The storage administrator

  6. A security manager discovers several production servers that are missing from the asset register. What is the BEST first management action?

    • Immediately isolate every unregistered production server, using the missing inventory record as the shutdown criterion
    • Reconcile the inventory, recording owners, relationships, classification, and lifecycle status
    • Purchase a data loss prevention product for every server
    • Ask administrators to label the servers without recording ownership

  7. A vendor will receive a dataset labeled Confidential for a defined analytics project. Which provisioning control is MOST important before access is granted?

    • Give the vendor a permanent administrator account covering the dataset and the supporting analytics infrastructure
    • Obtain owner approval and grant least privilege with a defined purpose and expiration or review
    • Copy the dataset to an unclassified shared folder for convenience
    • Let the vendor decide its own access scope after onboarding

  8. A Restricted report is printed for a meeting and then sent to an approved recipient. Which handling requirement BEST preserves the classification throughout this process?

    • Label the pages and envelope, control physical access, and use approved protected delivery
    • Remove classification markings from the printed report and envelope because the approved recipient is trusted
    • Email a scan through any available personal account after the meeting
    • Leave the pages in the conference room because the meeting was authorized

  9. A team wants to downgrade a customer dataset from Confidential to Internal because it has been copied into a new repository. What should the security manager require FIRST?

    • Accept the downgrade because the newer repository has more recent software
    • Have the custodian select a cheaper control set and downgrade the label to match the new repository settings
    • Require owner reassessment of sensitivity and impacts under policy
    • Delete the original classification from the inventory during the migration