Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 2.1: Information and asset identification and classification
A storage administrator discovers a new analytics dataset with no classification label. Who should determine the dataset's classification?
- A.The storage administrator who hosts it
- B.The vendor that supplied the storage platform
- C.The information owner responsible for its business use and impact
- D.Any user who has read access
Show answer and explanation
Best answer: C. The information owner responsible for its business use and impact
The information owner is accountable for classification based on business value, sensitivity, impact, and obligations; custodians implement the resulting controls.
A: The administrator is ordinarily a custodian, not the classification authority.
B: Third-party involvement does not transfer the organization's accountability or demonstrate that the service meets its requirements.
C: The information owner is accountable for classification based on business value, sensitivity, impact, and obligations; custodians implement the resulting controls.
D: Access does not confer classification authority.
Question 2·Objective 2.3: Ownership, inventory, provisioning, and asset management
Incident investigations repeatedly uncover business-owned cloud services that are absent from the asset inventory. Which improvement would BEST address the root cause?
- A.Ask incident responders to add services after each investigation
- B.Require each cloud provider to maintain the organization's inventory
- C.Scan primarily the corporate IP ranges more frequently
- D.Integrate procurement, expense, identity, and cloud-discovery events with an accountable asset onboarding process
Show answer and explanation
Best answer: D. Integrate procurement, expense, identity, and cloud-discovery events with an accountable asset onboarding process
Multiple discovery signals tied to accountable onboarding address decentralized acquisition and create a sustainable inventory process.
A: This option depends on the mistaken assumption that assets can be governed without complete inventory and accountable ownership.
B: Providers cannot own a complete customer-wide inventory across vendors.
C: Cloud services may not appear in corporate IP space.
D: Multiple discovery signals tied to accountable onboarding address decentralized acquisition and create a sustainable inventory process.
Question 3·Objective 2.4: Data roles and the collection, location, maintenance, retention, remanence, and destruction lifecycle
An organization's retention schedule requires deletion of customer support recordings after two years. One day before the next deletion job, the legal department reports a dispute and says some recordings may become evidence, but it has not yet identified all affected customers. What should the data owner do FIRST?
- A.Allow deletion because the approved retention schedule remains in effect
- B.Suspend disposal of potentially relevant recordings and work with legal counsel to define the hold's scope
- C.Retain every recording permanently to prevent future evidence loss
- D.Copy the recordings to removable media and continue the normal deletion job
Show answer and explanation
Best answer: B. Suspend disposal of potentially relevant recordings and work with legal counsel to define the hold's scope
A potential legal preservation duty overrides routine disposal for information within scope. Temporarily preserving potentially relevant material while counsel defines the hold prevents irreversible destruction without turning a limited exception into permanent retention.
A: Following the routine schedule after notice of a potential hold could destroy relevant evidence.
B: A potential legal preservation duty overrides routine disposal for information within scope. Temporarily preserving potentially relevant material while counsel defines the hold prevents irreversible destruction without turning a limited exception into permanent retention.
C: Permanent retention exceeds the stated need and creates unnecessary cost, privacy, and exposure risk.
D: This option depends on the mistaken assumption that data roles and lifecycle disposition can be decided without retention and sanitization evidence.
Question 4·Objective 2.6: Data states, control scoping/tailoring, standards selection, DRM, DLP, CASB, and compliance
A research workload must process highly sensitive data in a public cloud. Encryption already protects data at rest and in transit, but the primary concern is exposure to privileged infrastructure administrators while computations are running. Which control BEST addresses this concern?
- A.Increase the frequency of storage-key rotation
- B.Compress the dataset before uploading it
- C.Use a hardware-backed trusted execution environment with remote attestation
- D.Place another network firewall in front of the storage service
Show answer and explanation
Best answer: C. Use a hardware-backed trusted execution environment with remote attestation
A trusted execution environment can isolate data and code during processing, while attestation provides evidence of the expected execution state.
A: Storage-key rotation primarily protects data at rest.
B: Compression is not a confidentiality control.
C: A trusted execution environment can isolate data and code during processing, while attestation provides evidence of the expected execution state.
D: A firewall controls network access but not privileged access to processing memory.
Question 5·Objective 2.1: Information and asset identification and classification
Employees label nearly every document confidential, making controls costly and ignored. What should the data owner do FIRST?
- A.Refine classification criteria based on value, sensitivity, and obligations
- B.Remove the available classifications
- C.Let each employee invent labels
- D.Encrypt primarily files larger than a threshold
Show answer and explanation
Best answer: A. Refine classification criteria based on value, sensitivity, and obligations
Clear, risk-based criteria make classification consistent and usable.
A: Clear, risk-based criteria make classification consistent and usable.
B: This option depends on the mistaken assumption that classification can be assigned without considering sensitivity, value, or obligations.
C: This option depends on the mistaken assumption that classification can be assigned without considering sensitivity, value, or obligations.
D: This option depends on the mistaken assumption that classification can be assigned without considering sensitivity, value, or obligations.
Question 6·Objective 2.2: Information and asset handling requirements
A team must send restricted design files to a new engineering partner. What should occur FIRST?
- A.Email the files and request deletion later
- B.Confirm classification-based handling and approved transfer requirements
- C.Remove the labels to avoid confusion
- D.Compress the files without encryption
Show answer and explanation
Best answer: B. Confirm classification-based handling and approved transfer requirements
Handling must follow classification, recipient authorization, and approved transfer controls.
A: This postpones the required decision and leaves the identified exposure untreated during the delay.
B: Handling must follow classification, recipient authorization, and approved transfer controls.
C: This option depends on the mistaken assumption that handling requirements can be chosen without using the assigned classification.
D: This option depends on the mistaken assumption that handling requirements can be chosen without using the assigned classification.
Question 7·Objective 2.3: Ownership, inventory, provisioning, and asset management
A cloud account is found with no documented business owner. What is the BEST next action?
- A.Delete the account immediately
- B.List the cloud provider as owner
- C.Assign accountable ownership and validate the asset's purpose and controls
- D.Exclude it from inventory until renewal
Show answer and explanation
Best answer: C. Assign accountable ownership and validate the asset's purpose and controls
Ownership is needed to make risk, lifecycle, and control decisions.
A: This can destroy required data or evidence before retention, legal, recovery, and disposition requirements are resolved.
B: Third-party involvement does not transfer the organization's accountability or demonstrate that the service meets its requirements.
C: Ownership is needed to make risk, lifecycle, and control decisions.
D: This option depends on the mistaken assumption that assets can be governed without complete inventory and accountable ownership.
Question 8·Objective 2.4: Data roles and the collection, location, maintenance, retention, remanence, and destruction lifecycle
A data custodian receives conflicting deletion and litigation-hold instructions. What should the custodian do?
- A.Delete according to the normal schedule
- B.Keep the data forever without documentation
- C.Let the storage administrator decide
- D.Preserve the data and escalate to the accountable legal and data owners
Show answer and explanation
Best answer: D. Preserve the data and escalate to the accountable legal and data owners
A valid hold suspends routine deletion and must be resolved through accountable governance.
A: This can destroy required data or evidence before retention, legal, recovery, and disposition requirements are resolved.
B: This option depends on the mistaken assumption that data roles and lifecycle disposition can be decided without retention and sanitization evidence.
C: This option depends on the mistaken assumption that data roles and lifecycle disposition can be decided without retention and sanitization evidence.
D: A valid hold suspends routine deletion and must be resolved through accountable governance.
Question 9·Objective 2.5: Retention, end-of-life, and end-of-support
A medical system reaches vendor end-of-support but records must remain available for seven years. What is the BEST response?
- A.Develop a risk-based migration or compensating-control plan that preserves required records
- B.Erase the records when support ends
- C.Continue unchanged because retention is mandatory
- D.Publish the records in a standard format without access controls
Show answer and explanation
Best answer: A. Develop a risk-based migration or compensating-control plan that preserves required records
Retention and unsupported-platform risk must both be addressed through planned treatment.
A: Retention and unsupported-platform risk must both be addressed through planned treatment.
B: This can destroy required data or evidence before retention, legal, recovery, and disposition requirements are resolved.
C: This option depends on the mistaken assumption that retention and end-of-support risks can be deferred without an approved treatment plan.
D: This authorizes the action before requirements, control evidence, and residual risk are evaluated.
Question 10·Objective 2.6: Data states, control scoping/tailoring, standards selection, DRM, DLP, CASB, and compliance
A DLP rule blocks legitimate research because it treats all identifiers alike. What should be done FIRST?
- A.Disable DLP permanently
- B.Tune the rule using data context, approved use, and measured risk
- C.Allow researchers to bypass the available monitoring
- D.Block every outbound connection
Show answer and explanation
Best answer: B. Tune the rule using data context, approved use, and measured risk
Control tailoring should preserve protection while reflecting authorized use and false-positive evidence.
A: This option depends on the mistaken assumption that one data-protection control applies equally to every data state and use case.
B: Control tailoring should preserve protection while reflecting authorized use and false-positive evidence.
C: This option depends on the mistaken assumption that one data-protection control applies equally to every data state and use case.
D: This option depends on the mistaken assumption that one data-protection control applies equally to every data state and use case.
Continue studying Asset Security
Review the complete Domain 2 guide, then mix this material with the other seven domains in an adaptive mock exam.