Angela is an information security architect at a bank and has been assigned to ensure that transactions are secure as they traverse the network. She recommends that all transactions use TLS. What threat is she most likely attempting to stop, and what method is she using to protect against it?

1. Man-in-the-middle, VPN
2. Packet injection, encryption
3. Sniffing, encryption
4. Sniffing, TEMPEST

COBIT, Control Objectives for Information and Related Technology, is a framework for IT management and governance. Which data management role is most likely to select and apply COBIT to balance the need for security controls against business requirements?

1. Business owners
2. Data processors
3. Data owners
4. Data stewards

What term is used to describe a starting point for a minimum security standard?

1. Outline
2. Baseline
3. Policy
4. Configuration guide

When media is labeled based on the classification of the data it contains, what rule is typically applied regarding labels?

1. The data is labeled based on its integrity requirements.
2. The media is labeled based on the highest classification level of the data it contains.
3. The media is labeled with all levels of classification of the data it contains.
4. The media is labeled with the lowest level of classification of the data it contains.

The need to protect sensitive data drives what administrative process?

1. Information classification
2. Remanence
3. Transmitting data
4. Clearing

How can a data retention policy help to reduce liabilities?

1. By ensuring that unneeded data isn’t retained
2. By ensuring that incriminating data is destroyed
3. By ensuring that data is securely wiped so it cannot be restored for legal discovery
4. By reducing the cost of data storage required by law

Staff in an IT department who are delegated responsibility for day-to-day tasks hold what data role?

1. Business owner
2. User
3. Data processor
4. Custodian

Susan works for an American company that conducts business with customers in the European Union. What is she likely to have to do if she is responsible for handling PII from those customers?

1. Encrypt the data at all times.
2. Label and classify the data according to HIPAA.
3. Conduct yearly assessments to the EU DPD baseline.
4. Comply with the US-EU Safe Harbor requirements.

Ben has been tasked with identifying security controls for systems covered by his organization’s information classification system. Why might Ben choose to use a security baseline?

1. It applies in all circumstances, allowing consistent security controls.
2. They are approved by industry standards bodies, preventing liability.
3. They provide a good starting point that can be tailored to organizational needs.
4. They ensure that systems are always in a secure state.

What term is used to describe overwriting media to allow for its reuse in an environment operating at the same sensitivity level?

1. Clearing
2. Erasing
3. Purging
4. Sanitization

Which of the following classification levels is the US government’s classification label for data that could cause damage but wouldn’t cause serious or grave damage?

1. Top Secret
2. Secret
3. Confidential
4. Classified

What issue is common to spare sectors and bad sectors on hard drives as well as overprovisioned space on modern SSDs?

1. They can be used to hide data.
2. They can only be degaussed.
3. They are not addressable, resulting in data remanence.
4. They may not be cleared, resulting in data remanence.

What term describes data that remains after attempts have been made to remove the data?

1. Residual bytes
2. Data remanence
3. Slack space
4. Zero fill

For questions 14, 15, and 16, please refer to the following scenario:

Your organization regularly handles three types of data: information that it shares with customers, information that it uses internally to conduct business, and trade secret information that offers the organization significant competitive advantages. Information shared with customers is used and stored on web servers, while both the internal business data and the trade secret information are stored on internal file servers and employee workstations.

What civilian data classifications best fit this data?

1. Unclassified, confidential, top secret
2. Public, sensitive, private
3. Public, sensitive, proprietary
4. Public, confidential, private

What technique could you use to mark your trade secret information in case it was released or stolen and you need to identify it?

1. Classification
2. Symmetric encryption
3. Watermarks
4. Metadata

What type of encryption should you use on the file servers for the proprietary data, and how might you secure the data when it is in motion?

1. TLS at rest and AES in motion
2. AES at rest and TLS in motion
3. VPN at rest and TLS in motion
4. DES at rest and AES in motion

What does labeling data allow a DLP system to do?

1. The DLP system can detect labels and apply appropriate protections.
2. The DLP system can adjust labels based on changes in the classification scheme.
3. The DLP system can notify the firewall that traffic should be allowed through.
4. The DLP system can delete unlabeled data.

Why is it cost effective to purchase high-quality media to contain sensitive data?

1. Expensive media is less likely to fail.
2. The value of the data often far exceeds the cost of the media.
3. Expensive media is easier to encrypt.
4. More expensive media typically improves data integrity.

Chris is responsible for workstations throughout his company and knows that some of the company’s workstations are used to handle proprietary information. Which option best describes what should happen at the end of their lifecycle for workstations he is responsible for?

1. Erasing
2. Clearing
3. Sanitization
4. Destruction

Which is the proper order from least to most sensitive for US government classifications?

1. Confidential, Secret, Top Secret
2. Confidential, Classified, Secret
3. Top Secret, Secret, Classified, Public, Classified, Top Secret
4. Public, Unclassified, Classified, Top Secret

What scenario describes data at rest?

1. Data in an IPsec tunnel
2. Data in an e-commerce transaction
3. Data stored on a hard drive
4. Data stored in RAM

If you are selecting a security standard for a Windows 10 system that processes credit cards, what security standard is your best choice?

1. Microsoft’s Windows 10 security baseline
2. The CIS Windows 10 baseline
3. PCI DSS
4. The NSA Windows 10 baseline

Use the following scenario for questions 23, 24, and 25.

The Center for Internet Security (CIS) works with subject matter experts from a variety of industries to create lists of security controls for operating systems, mobile devices, server software, and network devices. Your organization has decided to use the CIS benchmarks for your systems. Answer the following questions based on this decision.

The CIS benchmarks are an example of what practice?

1. Conducting a risk assessment
2. Implementing data labeling
3. Proper system ownership
4. Using security baselines

Adjusting the CIS benchmarks to your organization’s mission and your specific IT systems would involve what two processes?

1. Scoping and selection
2. Scoping and tailoring
3. Baselining and tailoring
4. Tailoring and selection

How should you determine what controls from the baseline a given system or software package should receive?

1. Consult the custodians of the data.
2. Select based on the data classification of the data it stores or handles.
3. Apply the same controls to all systems.
4. Consult the business owner of the process the system or data supports.

What problem with FTP and Telnet makes using SFTP and SSH better alternatives?

1. FTP and Telnet aren’t installed on many systems.
2. FTP and Telnet do not encrypt data.
3. FTP and Telnet have known bugs and are no longer maintained.
4. FTP and Telnet are difficult to use, making SFTP and SSH the preferred solution.

The government defense contractor that Saria works for has recently shut down a major research project and is planning on reusing the hundreds of thousands of dollars of systems and data storage tapes used for the project for other purposes. When Saria reviews the company’s internal processes, she finds that she can’t reuse the tapes and that the manual says they should be destroyed. Why isn’t Saria allowed to degauss and then reuse the tapes to save her employer money?

1. Data permanence may be an issue.
2. Data remanence is a concern.
3. The tapes may suffer from bitrot.
4. Data from tapes can’t be erased by degaussing.

Information maintained about an individual that can be used to distinguish or trace their identity is known as what type of information?

1. Personally identifiable information (PII)
2. Personal health information (PHI)
3. Social Security number (SSN)
4. Secure identity information (SII)

What is the primary information security risk to data at rest?

1. Improper classification
2. Data breach
3. Decryption
4. Loss of data integrity

Full disk encryption like Microsoft’s BitLocker is used to protect data in what state?

1. Data in transit
2. Data at rest
3. Unlabeled data
4. Labeled data

Sue’s employer has asked her to use an IPsec VPN to connect to its network. When Sue connects, what does the IPsec VPN allow her to do?

1. Send decrypted data over a public network and act like she is on her employer’s internal network.
2. Create a private encrypted network carried via a public network and act like she is on her employer’s internal network.
3. Create a virtual private network using TLS while on her employer’s internal network.
4. Create a tunneled network that connects her employer’s network to her internal home network.

What is the primary purpose of data classification?

1. It quantifies the cost of a data breach.
2. It prioritizes IT expenditures.
3. It allows compliance with breach notification laws.
4. It identifies the value of the data to the organization.

Fred’s organization allows downgrading of systems for reuse after projects have been finished and the systems have been purged. What concern should Fred raise about the reuse of the systems from his Top Secret classified project for a future project classified as Secret?

1. The Top Secret data may be commingled with the Secret data, resulting in a need to relabel the system.
2. The cost of the sanitization process may exceed the cost of new equipment.
3. The data may be exposed as part of the sanitization process.
4. The organization’s DLP system may flag the new system due to the difference in data labels.

Which of the following concerns should not be part of the decision when classifying data?

1. The cost to classify the data
2. The sensitivity of the data
3. The amount of harm that exposure of the data could cause
4. The value of the data to the organization

Which of the following is the least effective method of removing data from media?

1. Degaussing
2. Purging
3. Erasing
4. Clearing

Safe Harbor is part of a US program to meet what European Union law?

1. The EU CyberSafe Act
2. The Network and Information Security (NIS) directives
3. The General Data Protection Regulation (GDPR)
4. The EU Data Protection Directive

Use the following scenario to answer questions 37, 38, and 39.

The healthcare company that Lauren works for handles HIPAA data as well as internal business data, protected health information, and day-to-day business communications. Its internal policy uses the following requirements for securing HIPAA data at rest and in transit.

Using the table, answer the following questions.

What type of encryption would be appropriate for HIPAA documents in transit?

1. AES256
2. DES
3. TLS
4. SSL

Lauren’s employer asks Lauren to classify patient X-ray data that has an internal patient identifier associated with it but does not have any way to directly identify a patient. The company’s data owner believes that exposure of the data could cause damage (but not exceptional damage) to the organization. How should Lauren classify the data?

1. Public
2. Sensitive
3. Private
4. Confidential

What technology could Lauren’s employer implement to help prevent confidential data from being emailed out of the organization?

1. DLP
2. IDS
3. A firewall
4. UDP

A US government database contains Secret, Confidential, and Top Secret data. How should it be classified?

1. Top Secret
2. Confidential
3. Secret
4. Mixed classification

What tool is used to prevent employees who leave from sharing proprietary information with their new employers?

1. Encryption
2. NDA
3. Classification
4. Purging

What encryption algorithm is used by both BitLocker and Microsoft’s Encrypting File System?

1. Blowfish
2. Serpent
3. AES
4. 3DES

Chris is responsible for his organization’s security standards and has guided the selection and implementation of a security baseline for Windows PCs in his organization. How can Chris most effectively make sure that the workstations he is responsible for are being checked for compliance and that settings are being applied as necessary?

1. Assign users to spot-check baseline compliance.
2. Use Microsoft Group Policy.
3. Create startup scripts to apply policy at system start.
4. Periodically review the baselines with the data owner and system owners.

What term is used to describe a set of common security configurations, often provided by a third party?

1. Security policy
2. Baseline
3. DSS
4. SP 800

What type of policy describes how long data is retained and maintained before destruction?

1. Classification
2. Audit
3. Record retention
4. Availability

Which attack helped drive vendors to move away from SSL toward TLS-only by default?

1. POODLE
2. Stuxnet
3. BEAST
4. CRIME

What security measure can provide an additional security control in the event that backup tapes are stolen or lost?

1. Keep multiple copies of the tapes.
2. Replace tape media with hard drives.
3. Use appropriate security labels.
4. Use AES256 encryption.

Joe works at a major pharmaceutical research and development company and has been tasked with writing his organization’s data retention policy. As part of its legal requirements, the organization must comply with the US Food and Drug Administration’s Code of Federal Regulations Title 21. To do so, it is required to retain records with electronic signatures. Why would a signature be part of a retention requirement?

1. It ensures that someone has reviewed the data.
2. It provides confidentiality.
3. It ensures that the data has not been changed.
4. It validates who approved the data.

What protocol is preferred over Telnet for remote server administration via the command line?

1. SCP
2. SFTP
3. WDS
4. SSH

What method uses a strong magnetic field to erase media?

1. Magwipe
2. Degaussing
3. Sanitization
4. Purging

What primary issue does personnel retention deal with?

1. Employees quitting
2. Employees not moving on to new positions
3. Knowledge gained after employment
4. Knowledge gained during employment

Alex works for a government agency that is required to meet US federal government requirements for data security. To meet these requirements, Alex has been tasked with making sure data is identifiable by its classification level. What should Alex do to the data?

1. Classify the data.
2. Encrypt the data.
3. Label the data.
4. Apply DRM to the data.

Ben is following the NIST Special Publication 800-88 guidelines for sanitization and disposition as shown in the following diagram. He is handling information that his organization classified as sensitive, which is a moderate security categorization in the NIST model. If the media is going to be sold as surplus, what process does Ben need to follow?

1. Destroy, validate, document
2. Clear, purge, document
3. Purge, document, validate
4. Purge, validate, document

What methods are often used to protect data in transit?

1. Telnet, ISDN, UDP
2. Encrypted storage media
3. AES, Serpent, IDEA
4. TLS, VPN, IPsec

Which data role is described as the person who has ultimate organizational responsibility for data?

1. System owners
2. Business owners
3. Data owners
4. Mission owners

What US government agency oversees compliance with the Safe Harbor framework for organizations wishing to use the personal data of EU citizens?

1. The FTC
2. The FDA
3. The DoD
4. The Department of Commerce

For questions 57, 58, and 59, use the following scenario.

Chris has recently been hired into a new organization. The organization that Chris belongs to uses the following classification process:

1. Criteria are set for classifying data.
2. Data owners are established for each type of data.
3. Data is classified.
4. Required controls are selected for each classification.
5. Baseline security standards are selected for the organization.
6. Controls are scoped and tailored.
7. Controls are applied and enforced.
8. Access is granted and managed.

Use the classification process to answer the following questions.

If Chris is one of the data owners for the organization, what steps in this process is he most likely responsible for?

1. He is responsible for steps 3, 4, and 5.
2. He is responsible for steps 1, 2, and 3.
3. He is responsible for steps 5, 6, and 7.
4. All of the steps are his direct responsibility.

Chris manages a team of system administrators. What data role are they fulfilling if they conduct steps 6, 7, and 8 of the classification process?

1. They are system owners and administrators.
2. They are administrators and custodians.
3. They are data owners and administrators.
4. They are custodians and users.

If Chris’s company operates in the European Union and has been contracted to handle the data for a third party, what role is his company operating in when it uses this process to classify and handle data?

1. Business owners
2. Mission owners
3. Data processors
4. Data administrators

Which of the following is not a part of the European Union’s Data Protection principles?

1. Notice
2. Reason
3. Security
4. Access

Ben’s company, which is based in the EU, hires a third-party organization that processes data for it. Who has responsibility to protect the privacy of the data and ensure that it isn’t used for anything other than its intended purpose?

1. Ben’s company is responsible.
2. The third-party data processor is responsible.
3. The data controller is responsible.
4. Both organizations bear equal responsibility.

Major Hunter, a member of the US armed forces, has been entrusted with information that, if exposed, could cause serious damage to national security. Under US government classification standards, how should this data be classified?

1. Unclassified
2. Top Secret
3. Confidential
4. Secret

When a computer is removed from service and disposed of, the process that ensures that all storage media has been removed or destroyed is known as what?

1. Sanitization
2. Purging
3. Destruction
4. Declassification

Linux systems that use bcrypt are using a tool based on what DES alternative encryption scheme?

1. 3DES
2. AES
3. Diffie-Hellman
4. Blowfish

Susan works in an organization that labels all removable media with the classification level of the data it contains, including public data. Why would Susan’s employer label all media instead of labeling only the media that contains data that could cause harm if it was exposed?

1. It is cheaper to order all prelabeled media.
2. It prevents sensitive media from not being marked by mistake.
3. It prevents reuse of public media for sensitive data.
4. Labeling all media is required by HIPAA.

Data stored in RAM is best characterized as what type of data?

1. Data at rest
2. Data in use
3. Data in transit
4. Data at large

What issue is the validation portion of the NIST SP 800-88 sample certificate of sanitization intended to help prevent?

1. Destruction
2. Reuse
3. Data remanence
4. Attribution

Why is declassification rarely chosen as an option for media reuse?

1. Purging is sufficient for sensitive data.
2. Sanitization is the preferred method of data removal.
3. It is more expensive than new media and may still fail.
4. Clearing is required first.

NIST SP 800-60 provides a process shown in the following diagram to assess information systems. What process does this diagram show?

1. Selecting a standard and implementing it
2. Categorizing and selecting controls
3. Baselining and selecting controls
4. Categorizing and sanitizing

The following image shows a typical workstation and server and their connections to each other and the Internet. Use the image to answer questions 70, 71, and 72.

Which letters should be associated with data at rest?

1. A, B, and C
2. C and E
3. A and E
4. B, D, and F

What would be the best way to secure data at points B, D, and F?

1. AES256
2. SSL
3. TLS
4. 3DES

What is the best way to secure files that are sent from workstation A via the Internet service (C) to remote server E?

1. Use AES at rest at point A, and TLS in transit via B and D.
2. Encrypt the data files and send them.
3. Use 3DES and TLS to provide double security.
4. Use full disk encryption at A and E, and use SSL at B and D.

Incineration, crushing, shredding, and disintegration all describe what stage in the life cycle of media?

1. Sanitization
2. Degaussing
3. Purging
4. Destruction

The European Union (EU) Data Protection Directive’s seven principles do not include which of the following key elements?

1. The need to inform subjects when their data is being collected
2. The need to set a limit on how long data is retained
3. The need to keep the data secure
4. The need to allow data subjects to be able to access and correct their data

Why might an organization use unique screen backgrounds or designs on workstations that deal with data of different classification levels?

1. To indicate the software version in use
2. To promote a corporate message
3. To promote availability
4. To indicate the classification level of the data or system

Charles has been asked to downgrade the media used for storage of private data for his organization. What process should Charles follow?

1. Degauss the drives, and then relabel them with a lower classification level.
2. Pulverize the drives, and then reclassify them based on the data they contain.
3. Follow the organization’s purging process, and then downgrade and replace labels.
4. Relabel the media, and then follow the organization’s purging process to ensure that the media matches the label.

Which of the following tasks are not performed by a system owner per NIST SP 800-18?

1. Develops a system security plan
2. Establishes rules for appropriate use and protection of data
3. Identifies and implements security controls
4. Ensures that system users receive appropriate security training

Susan needs to provide a set of minimum security requirements for email. What steps should she recommend for her organization to ensure that the email remains secure?

1. All email should be encrypted.
2. All email should be encrypted and labeled.
3. Sensitive email should be encrypted and labeled.
4. Only highly sensitive email should be encrypted.

What term describes the process of reviewing baseline security controls and selecting only the controls that are appropriate for the IT system you are trying to protect?

1. Standard creation
2. CIS benchmarking
3. Baselining
4. Scoping

What data role does a system that is used to process data have?

1. Mission owner
2. Data owner
3. Data processor
4. Custodian

Which of the following will be superceded in 2018 by the European Union’s General Data Protection Regulation (GDPR)

1. The EU Data Protection Directive
2. NIST SP 800-12
3. The EU Personal Data Protection Regulation
4. COBIT

What type of health information is the Health Insurance Portability and Accountability Act required to protect?

1. PII
2. PHI
3. SHI
4. HPHI

What encryption algorithm would provide strong protection for data stored on a USB thumb drive?

1. TLS
2. SHA1
3. AES
4. DES

Lauren’s multinational company wants to ensure compliance with the EU Data Protection Directive. If she allows data to be used against the requirements of the notice principle and against what users selected in the choice principle, what principle has her organization violated?

1. Onward transfer
2. Data integrity
3. Enforcement
4. Access

What is the best method to sanitize a solid-state drive (SSD)?

1. Clearing
2. Zero fill
3. Disintegration
4. Degaussing

For questions 86, 87, and 88, use the following scenario.

As shown in the following security life cycle diagram (loosely based on the NIST reference architecture), NIST uses a five-step process for risk management. Using your knowledge of data roles and practices, answer the following questions based on the NIST framework process.

What data role will own responsibility for step 1, the categorization of information systems, to whom will they delegate step 2, and what data role will be responsible for step 3?

1. Data owners, system owners, custodians
2. Data processors, custodians, users
3. Business owners, administrators, custodians
4. System owners, business owners, administrators

If the systems that are being assessed all handle credit card information (and no other sensitive data), at what step would the PCI DSS first play an important role?

1. Step 1
2. Step 2
3. Step 3
4. Step 4

What data security role is primarily responsible for step 5?

1. Data owners
2. Data processors
3. Custodians
4. Users

Susan’s organization performs a zero fill on hard drives before they are sent to a third-party organization to be shredded. What issue is her organization attempting to avoid?

1. Data remanence while at the third-party site
2. Mishandling of drives by the third party
3. Classification mistakes
4. Data permanence

Embedded data used to help identify the owner of a file is an example of what type of label?

1. Copyright notice
2. DLP
3. Digital watermark
4. Steganography

Retaining and maintaining information for as long as it is needed is known as what?

1. Data storage policy
2. Data storage
3. Asset maintenance
4. Record retention

Which of the following activities is not a consideration during data classification?

1. Who can access the data
2. What the impact would be if the data was lost or breached
3. How much the data cost to create
4. What protection regulations may be required for the data

What type of encryption is typically used for data at rest?

1. Asymmetric encryption
2. Symmetric encryption
3. DES
4. OTP

Which data role is tasked with granting appropriate access to staff members?

1. Data processors
2. Business owners
3. Custodians
4. Administrators

Which California law requires conspicuously posted privacy policies on commercial websites that collect the personal information of California residents?

1. The Personal Information Protection and Electronic Documents Act
2. The California Online Privacy Protection Act
3. California Online Web Privacy Act
4. California Civil Code 1798.82

Fred is preparing to send backup tapes off site to a secure third-party storage facility. What steps should Fred take before sending the tapes to that facility?

1. Ensure that the tapes are handled the same way the original media would be handled based on their classification.
2. Increase the classification level of the tapes because they are leaving the possession of the company.
3. Purge the tapes to ensure that classified data is not lost.
4. Encrypt the tapes in case they are lost in transit.

Which of the following does not describe data in motion?

1. Data on a backup tape that is being shipped to a storage facility
2. Data in a TCP packet
3. Data in an e-commerce transaction
4. Data in files being copied between locations

A new law is passed that would result in significant financial harm to your company if the data that it covers was stolen or inadvertently released. What should your organization do about this?

1. Select a new security baseline.
2. Relabel the data.
3. Encrypt all of the data at rest and in transit.
4. Review its data classifications and classify the data appropriately.

Ed has been asked to send data that his organization classifies as confidential and proprietary via email. What encryption technology would be appropriate to ensure that the contents of the files attached to the email remain confidential as they traverse the Internet?

1. SSL
2. TLS
3. PGP
4. VPN

Which mapping correctly matches data classifications between nongovernment and government classification schemes?

1. Top Secret - Confidential/Proprietary
   • Secret – Private
   • Confidential – Sensitive
2. Secret - Business confidential
   • Classifed - Proprietary
   • Confidential - Business Internal
3. Top Secret - Business sensitive
   • Secret - Business internal
   • Confidential - Business proprietary
4. Secret - Proprietary
   • Classified - Private
   • Unclassified - Public