View Full ISC CISSP Exam Dumps and Practice Test Dumps.

 

Question 321

Which principle requires an organization to collect only the personal information necessary for a specific legitimate purpose?

1. Data minimization
2. Data aggregation
3. Data replication
4. Data persistence

Correct Answer: 1

Explanation

Data minimization means collecting, processing, and retaining only the personal information necessary for an identified and legitimate purpose. Limiting unnecessary data reduces privacy exposure and can decrease the potential impact of a breach. Organizations should define what information is required, why it is needed, how long it should be retained, and who needs access. Data minimization should be considered during system design, application development, collection processes, and data lifecycle management. It supports privacy objectives while reducing unnecessary storage and security obligations.

Question 322

An organization labels information as public, internal, confidential, or restricted based on its sensitivity. Which process is being performed?

1. Data classification
2. Data recovery
3. Data normalization
4. Data replication

Correct Answer: 1

Explanation

Data classification categorizes information according to sensitivity, business value, legal requirements, and potential consequences of unauthorized disclosure, modification, or destruction. Classification labels help organizations determine appropriate security controls and handling requirements. For example, restricted information may require stronger encryption and access controls than public information. Classification should be based on documented criteria and consistently applied throughout the information lifecycle. Data owners are typically responsible for determining appropriate classification, while custodians implement and maintain the controls required to protect the information.

Question 323

Who is generally responsible for determining the classification and protection requirements of organizational information?

1. Data custodian
2. Data owner
3. System administrator
4. Security analyst

Correct Answer: 2

Explanation

The data owner is typically responsible for determining how information should be classified and what protection requirements apply to it. The owner represents the business interest in the information and may establish access requirements, retention expectations, and handling rules. A data custodian generally implements and maintains the technical and operational controls specified by the owner. Separating ownership from custodianship helps ensure that business decisions about information are not confused with the operational responsibilities of maintaining systems and data.

Question 324

Which role is primarily responsible for implementing and maintaining the security controls required by the data owner?

1. Data subject
2. Data owner
3. Data custodian
4. Auditor

Correct Answer: 3

Explanation

A data custodian is responsible for implementing and maintaining controls that protect information according to requirements established by the data owner. Responsibilities may include backups, storage management, access provisioning, encryption, system maintenance, and technical safeguards. The custodian generally does not determine the business value or classification of the information. Instead, the custodian operates the systems and controls needed to meet the owner’s requirements. Clear separation between ownership and custodianship helps establish accountability and ensures that security decisions are aligned with organizational business needs.

Question 325

Which privacy principle requires personal information to be used only for the purpose for which it was originally collected unless an appropriate additional basis exists?

1. Purpose limitation
2. Data duplication
3. Open access
4. Resource pooling

Correct Answer: 1

Explanation

Purpose limitation requires organizations to collect and use personal information for specified, legitimate purposes and avoid incompatible secondary uses without an appropriate legal or organizational basis. This principle helps prevent information collected for one reason from being reused indiscriminately for unrelated activities. Organizations should document collection purposes and evaluate proposed secondary uses before processing information. Purpose limitation works together with data minimization, retention controls, access restrictions, and privacy governance. Clear notices and internal policies can help personnel understand how information may appropriately be used.

Question 326

Which technique replaces sensitive information with a non-sensitive substitute value that can be mapped back to the original data under controlled conditions?

1. Hashing
2. Tokenization
3. Compression
4. Encoding

Correct Answer: 2

Explanation

Tokenization replaces sensitive data with a token that has no direct meaningful value outside the approved tokenization system. The original information is maintained separately in a protected environment, and authorized processes can use the token to reference it. Tokenization can reduce the exposure of sensitive information in applications, databases, and transaction systems. It differs from hashing because tokenization can support controlled retrieval of the original data, whereas cryptographic hashing is generally designed as a one-way transformation. Proper access controls and protection of the token mapping system remain essential.

Question 327

Which control helps ensure that information is removed when it reaches the end of its approved retention period?

1. Data retention and disposal policy
2. Network segmentation
3. Intrusion prevention
4. Password management

Correct Answer: 1

Explanation

A data retention and disposal policy defines how long information should be retained and what should happen when the retention period expires. Retention requirements may be influenced by business needs, legal obligations, regulations, contracts, and litigation requirements. Once information is no longer required and no preservation obligation applies, secure disposal can reduce unnecessary exposure. Disposal methods should match the media and sensitivity of the information, such as secure deletion, cryptographic erasure, or physical destruction. Retention schedules should be reviewed periodically as requirements change.

Question 328

Which process securely removes information from storage media so that it cannot be practically recovered using normal techniques?

1. Media sanitization
2. Data indexing
3. Data classification
4. Network hardening

Correct Answer: 1

Explanation

Media sanitization is the process of removing sensitive information from storage media so that the data cannot be practically recovered using appropriate recovery techniques. Methods can include secure erasure, cryptographic erasure, clearing, purging, or physical destruction depending on the medium and security requirements. Simply deleting a file may leave recoverable information behind. Organizations should select sanitization methods according to the sensitivity of the information, type of media, reuse or disposal plans, and applicable requirements. Sanitization activities should also be documented when appropriate.

Question 329

Which security concept ensures that sensitive data remains protected while traveling between two systems?

1. Data confidentiality in transit
2. Data classification
3. Data retention
4. Data aggregation

Correct Answer: 1

Explanation

Protecting data in transit means safeguarding information while it moves between systems, networks, applications, or users. Encryption protocols such as TLS and secure VPN technologies can provide confidentiality and integrity for transmitted information. Appropriate authentication can also help ensure that communication occurs with the intended endpoint. Organizations should identify sensitive data flows and select secure protocols instead of relying on unprotected communication channels. Protection should extend across relevant network segments because information may pass through multiple systems before reaching its destination.

Question 330

Which security measure provides a secure encrypted channel for remote employees accessing organizational resources over the internet?

1. VPN
2. NAT
3. DNS
4. DHCP

Correct Answer: 1

Explanation

A virtual private network provides an encrypted communication channel between a remote endpoint and an organizational network or service. VPNs can protect traffic from interception over untrusted networks and may enforce authentication and access policies before allowing connections. Remote-access VPNs are commonly used by employees who need access to internal resources from external locations. Organizations should combine VPNs with strong authentication, endpoint security, least privilege, logging, and appropriate network segmentation. A VPN secures the connection but does not eliminate security risks associated with compromised endpoints or unauthorized accounts.

Question 331

Which email security mechanism allows receiving mail systems to determine whether a message was sent from an authorized server for the sender’s domain?

1. SPF
2. LDAP
3. SNMP
4. NTP

Correct Answer: 1

Explanation

Sender Policy Framework, or SPF, allows a domain owner to publish information identifying mail servers authorized to send messages on behalf of that domain. Receiving mail systems can compare the sending server against the published SPF policy. SPF can help reduce certain forms of sender-address spoofing, but it is not a complete email security solution and does not by itself encrypt email or guarantee that a message is legitimate. Organizations commonly use SPF alongside DKIM and DMARC to create a more comprehensive email authentication strategy.

Question 332

Which email security mechanism uses cryptographic signatures to allow recipients to verify that an email was authorized by a domain and was not altered after signing?

1. SPF
2. DKIM
3. DNS
4. RADIUS

Correct Answer: 2

Explanation

DomainKeys Identified Mail, or DKIM, uses cryptographic signatures to associate an email message with a sending domain. The sending system signs selected message information using a private key, while the corresponding public key is published through DNS. Receiving systems can verify the signature and determine whether the signed content was altered after signing. DKIM provides message authentication and integrity for the signed portions but does not encrypt the email itself. Organizations should protect DKIM private keys and rotate them according to appropriate security and operational practices.

Question 333

Which email security standard allows a domain owner to specify how receiving systems should handle messages that fail certain SPF or DKIM authentication checks?

1. DMARC
2. DNSSEC
3. TLS
4. SFTP

Correct Answer: 1

Explanation

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, allows a domain owner to publish policies describing how receiving systems should handle messages that fail specified authentication and alignment requirements. DMARC works with mechanisms such as SPF and DKIM and can provide reporting information to domain owners. Policies can instruct recipients to monitor, quarantine, or reject certain messages depending on the organization’s configuration. Proper implementation requires accurate domain configuration, monitoring of legitimate senders, and gradual policy enforcement to reduce the risk of disrupting valid email flows.

Question 334

Which technology validates that DNS responses originate from an authorized source and have not been altered in transit?

1. DNSSEC
2. DHCP
3. FTP
4. Telnet

Correct Answer: 1

Explanation

Domain Name System Security Extensions, or DNSSEC, provides authentication and integrity protection for DNS data by using digital signatures. It allows validating resolvers to verify that DNS responses are associated with an authorized DNS zone and have not been modified. DNSSEC does not provide confidentiality because DNS information remains visible to parties capable of observing the traffic. Correct deployment requires appropriate key management, signed zones, and validation configuration. DNSSEC can help reduce risks associated with manipulated DNS responses and certain forms of DNS cache poisoning.

Question 335

Which protocol securely transfers files between systems by using SSH for authentication and encrypted communication?

1. SFTP
2. TFTP
3. FTP
4. Telnet

Correct Answer: 1

Explanation

SSH File Transfer Protocol, or SFTP, provides secure file transfer capabilities through the SSH protocol. It protects authentication credentials and transferred information using SSH’s security mechanisms. SFTP is different from traditional FTP, which does not inherently protect credentials or file contents with encryption. It is also distinct from TFTP, which is designed as a simple file transfer protocol with minimal functionality and security. Organizations using SFTP should still enforce strong authentication, appropriate permissions, secure key management, and logging for sensitive file transfers.

Question 336

Which protocol is commonly used to securely manage network devices through an encrypted command-line session?

1. SSH
2. HTTP
3. FTP
4. Telnet

Correct Answer: 1

Explanation

Secure Shell, or SSH, provides encrypted remote access and is commonly used to administer servers, routers, switches, and other network devices. It protects credentials and session information against interception when properly configured. SSH can support password authentication, public-key authentication, and other mechanisms. Administrators should disable insecure remote management protocols where practical, use strong authentication, restrict administrative access, and keep SSH implementations updated. Logging and monitoring administrative sessions can also support accountability and incident investigations.

Question 337

Which authentication protocol commonly uses tickets to allow users to authenticate to services without repeatedly sending passwords across the network?

1. Kerberos
2. RADIUS
3. LDAP
4. TACACS+

Correct Answer: 1

Explanation

Kerberos is a network authentication protocol that uses tickets and a trusted authentication service to support secure access to network resources. After authenticating, a user can obtain tickets that can be presented to authorized services rather than repeatedly transmitting a password. Kerberos is widely associated with enterprise directory environments and supports mutual authentication in appropriate configurations. It depends on reliable time synchronization because ticket validity is time-sensitive. Protecting the authentication infrastructure and maintaining accurate system clocks are therefore important for secure and reliable Kerberos operation.

Question 338

Which attack attempts to deceive users into revealing credentials or sensitive information by pretending to be a trusted person or organization?

1. Phishing
2. Port scanning
3. Fragmentation
4. Hash collision

Correct Answer: 1

Explanation

Phishing is a social engineering attack in which an attacker attempts to deceive a victim into providing information, opening malicious content, transferring funds, or performing another unauthorized action. Messages may impersonate trusted organizations, colleagues, service providers, or other entities. Effective defenses include security awareness training, multifactor authentication, email authentication technologies, secure web filtering, and procedures for reporting suspicious messages. Organizations should also avoid relying solely on users to detect phishing because attackers continually adapt their techniques and can exploit highly convincing communication.

Question 339

Which physical security attack occurs when an unauthorized person follows an authorized individual through a controlled entry point?

1. Tailgating
2. Dumpster diving
3. Shoulder surfing
4. Wardriving

Correct Answer: 1

Explanation

Tailgating occurs when an unauthorized person follows an authorized individual through a controlled physical access point without independently authenticating. It can allow attackers to enter restricted areas and potentially reach sensitive systems, equipment, or information. Controls can include security awareness training, access badges, mantraps, security personnel, visitor procedures, turnstiles, and physical monitoring. Employees should be trained not to allow unknown individuals to follow them through secured entrances. Organizations should balance security requirements with practical access procedures so that controls are consistently followed.

Question 340

Which physical security control uses two sequential doors so that one door is normally closed before the second door can be opened?

1. Mantrap
2. Bollard
3. Fence
4. Security camera

Correct Answer: 1

Explanation

A mantrap is a physical security area containing two or more interlocking doors designed to control entry and exit. Typically, one door must close before another can open, allowing authentication or inspection between the controlled points. Mantraps can help prevent unauthorized individuals from following authorized personnel into restricted areas. They are particularly useful for facilities containing highly sensitive systems or information. Organizations should also consider emergency egress requirements, accessibility, fire safety, and operational procedures when implementing mantraps.