Angela is an information security architect at a bank and has been assigned to ensure that transactions are secure as they traverse the network. She recommends that all transactions use TLS. What threat is she most likely attempting to stop, and what method is she using to protect against it?
COBIT, Control Objectives for Information and Related Technology, is a framework for IT management and governance. Which data management role is most likely to select and apply COBIT to balance the need for security controls against business requirements?
What term is used to describe a starting point for a minimum security standard?
When media is labeled based on the classification of the data it contains, what rule is typically applied regarding labels?
The need to protect sensitive data drives what administrative process?
How can a data retention policy help to reduce liabilities?
Staff in an IT department who are delegated responsibility for day-to-day tasks hold what data role?
Susan works for an American company that conducts business with customers in the European Union. What is she likely to have to do if she is responsible for handling PII from those customers?
Ben has been tasked with identifying security controls for systems covered by his organization’s information classification system. Why might Ben choose to use a security baseline?
What term is used to describe overwriting media to allow for its reuse in an environment operating at the same sensitivity level?
Which of the following classification levels is the US government’s classification label for data that could cause damage but wouldn’t cause serious or grave damage?
What issue is common to spare sectors and bad sectors on hard drives as well as overprovisioned space on modern SSDs?
What term describes data that remains after attempts have been made to remove the data?
For questions 14, 15, and 16, please refer to the following scenario:
Your organization regularly handles three types of data: information that it shares with customers, information that it uses internally to conduct business, and trade secret information that offers the organization significant competitive advantages. Information shared with customers is used and stored on web servers, while both the internal business data and the trade secret information are stored on internal file servers and employee workstations.
What civilian data classifications best fit this data?
What technique could you use to mark your trade secret information in case it was released or stolen and you need to identify it?
What type of encryption should you use on the file servers for the proprietary data, and how might you secure the data when it is in motion?
What does labeling data allow a DLP system to do?
Why is it cost effective to purchase high-quality media to contain sensitive data?
Chris is responsible for workstations throughout his company and knows that some of the company’s workstations are used to handle proprietary information. Which option best describes what should happen at the end of their lifecycle for workstations he is responsible for?
Which is the proper order from least to most sensitive for US government classifications?
What scenario describes data at rest?
If you are selecting a security standard for a Windows 10 system that processes credit cards, what security standard is your best choice?
Use the following scenario for questions 23, 24, and 25.
The Center for Internet Security (CIS) works with subject matter experts from a variety of industries to create lists of security controls for operating systems, mobile devices, server software, and network devices. Your organization has decided to use the CIS benchmarks for your systems. Answer the following questions based on this decision.
The CIS benchmarks are an example of what practice?
Adjusting the CIS benchmarks to your organization’s mission and your specific IT systems would involve what two processes?
How should you determine what controls from the baseline a given system or software package should receive?
What problem with FTP and Telnet makes using SFTP and SSH better alternatives?
The government defense contractor that Saria works for has recently shut down a major research project and is planning on reusing the hundreds of thousands of dollars of systems and data storage tapes used for the project for other purposes. When Saria reviews the company’s internal processes, she finds that she can’t reuse the tapes and that the manual says they should be destroyed. Why isn’t Saria allowed to degauss and then reuse the tapes to save her employer money?
Information maintained about an individual that can be used to distinguish or trace their identity is known as what type of information?
What is the primary information security risk to data at rest?
Full disk encryption like Microsoft’s BitLocker is used to protect data in what state?
Sue’s employer has asked her to use an IPsec VPN to connect to its network. When Sue connects, what does the IPsec VPN allow her to do?
What is the primary purpose of data classification?
Fred’s organization allows downgrading of systems for reuse after projects have been finished and the systems have been purged. What concern should Fred raise about the reuse of the systems from his Top Secret classified project for a future project classified as Secret?
Which of the following concerns should not be part of the decision when classifying data?
Which of the following is the least effective method of removing data from media?
Safe Harbor is part of a US program to meet what European Union law?
Use the following scenario to answer questions 37, 38, and 39.
The healthcare company that Lauren works for handles HIPAA data as well as internal business data, protected health information, and day-to-day business communications. Its internal policy uses the following requirements for securing HIPAA data at rest and in transit.
Classification | Handling Requirements |
Confidential (HIPAA) | Encrypt at rest and in transit. Full disk encryption required for all workstations. Files can only be sent in encrypted form, and passwords must be transferred under separate cover. Printed documents must be labeled with “HIPAA handling required.” |
Private (PHI) | Encrypt at rest and in transit. PHI must be stored on secure servers, and copies should not be kept on local workstations. Printed documents must be labeled with “Private.” |
Sensitive (business confidential) | Encryption is recommended but not required. |
Public | Information can be sent unencrypted. |
Using the table, answer the following questions.
What type of encryption would be appropriate for HIPAA documents in transit?
Lauren’s employer asks Lauren to classify patient X-ray data that has an internal patient identifier associated with it but does not have any way to directly identify a patient. The company’s data owner believes that exposure of the data could cause damage (but not exceptional damage) to the organization. How should Lauren classify the data?
What technology could Lauren’s employer implement to help prevent confidential data from being emailed out of the organization?
A US government database contains Secret, Confidential, and Top Secret data. How should it be classified?
What tool is used to prevent employees who leave from sharing proprietary information with their new employers?
What encryption algorithm is used by both BitLocker and Microsoft’s Encrypting File System?
Chris is responsible for his organization’s security standards and has guided the selection and implementation of a security baseline for Windows PCs in his organization. How can Chris most effectively make sure that the workstations he is responsible for are being checked for compliance and that settings are being applied as necessary?
What term is used to describe a set of common security configurations, often provided by a third party?
What type of policy describes how long data is retained and maintained before destruction?
Which attack helped drive vendors to move away from SSL toward TLS-only by default?
What security measure can provide an additional security control in the event that backup tapes are stolen or lost?
Joe works at a major pharmaceutical research and development company and has been tasked with writing his organization’s data retention policy. As part of its legal requirements, the organization must comply with the US Food and Drug Administration’s Code of Federal Regulations Title 21. To do so, it is required to retain records with electronic signatures. Why would a signature be part of a retention requirement?
What protocol is preferred over Telnet for remote server administration via the command line?
What method uses a strong magnetic field to erase media?
What primary issue does personnel retention deal with?
Alex works for a government agency that is required to meet US federal government requirements for data security. To meet these requirements, Alex has been tasked with making sure data is identifiable by its classification level. What should Alex do to the data?
Ben is following the NIST Special Publication 800-88 guidelines for sanitization and disposition as shown in the following diagram. He is handling information that his organization classified as sensitive, which is a moderate security categorization in the NIST model. If the media is going to be sold as surplus, what process does Ben need to follow?
What methods are often used to protect data in transit?
Which data role is described as the person who has ultimate organizational responsibility for data?
What US government agency oversees compliance with the Safe Harbor framework for organizations wishing to use the personal data of EU citizens?
For questions 57, 58, and 59, use the following scenario.
Chris has recently been hired into a new organization. The organization that Chris belongs to uses the following classification process:
Use the classification process to answer the following questions.
If Chris is one of the data owners for the organization, what steps in this process is he most likely responsible for?
Chris manages a team of system administrators. What data role are they fulfilling if they conduct steps 6, 7, and 8 of the classification process?
If Chris’s company operates in the European Union and has been contracted to handle the data for a third party, what role is his company operating in when it uses this process to classify and handle data?
Which of the following is not a part of the European Union’s Data Protection principles?
Ben’s company, which is based in the EU, hires a third-party organization that processes data for it. Who has responsibility to protect the privacy of the data and ensure that it isn’t used for anything other than its intended purpose?
Major Hunter, a member of the US armed forces, has been entrusted with information that, if exposed, could cause serious damage to national security. Under US government classification standards, how should this data be classified?
When a computer is removed from service and disposed of, the process that ensures that all storage media has been removed or destroyed is known as what?
Linux systems that use bcrypt are using a tool based on what DES alternative encryption scheme?
Susan works in an organization that labels all removable media with the classification level of the data it contains, including public data. Why would Susan’s employer label all media instead of labeling only the media that contains data that could cause harm if it was exposed?
Data stored in RAM is best characterized as what type of data?
What issue is the validation portion of the NIST SP 800-88 sample certificate of sanitization intended to help prevent?
Why is declassification rarely chosen as an option for media reuse?
NIST SP 800-60 provides a process shown in the following diagram to assess information systems. What process does this diagram show?
The following image shows a typical workstation and server and their connections to each other and the Internet. Use the image to answer questions 70, 71, and 72.
Which letters should be associated with data at rest?
What would be the best way to secure data at points B, D, and F?
What is the best way to secure files that are sent from workstation A via the Internet service (C) to remote server E?
Incineration, crushing, shredding, and disintegration all describe what stage in the life cycle of media?
The European Union (EU) Data Protection Directive’s seven principles do not include which of the following key elements?
Why might an organization use unique screen backgrounds or designs on workstations that deal with data of different classification levels?
Charles has been asked to downgrade the media used for storage of private data for his organization. What process should Charles follow?
Which of the following tasks are not performed by a system owner per NIST SP 800-18?
Susan needs to provide a set of minimum security requirements for email. What steps should she recommend for her organization to ensure that the email remains secure?
What term describes the process of reviewing baseline security controls and selecting only the controls that are appropriate for the IT system you are trying to protect?
What data role does a system that is used to process data have?
Which of the following will be superceded in 2018 by the European Union’s General Data Protection Regulation (GDPR)
What type of health information is the Health Insurance Portability and Accountability Act required to protect?
What encryption algorithm would provide strong protection for data stored on a USB thumb drive?
Lauren’s multinational company wants to ensure compliance with the EU Data Protection Directive. If she allows data to be used against the requirements of the notice principle and against what users selected in the choice principle, what principle has her organization violated?
What is the best method to sanitize a solid-state drive (SSD)?
For questions 86, 87, and 88, use the following scenario.
As shown in the following security life cycle diagram (loosely based on the NIST reference architecture), NIST uses a five-step process for risk management. Using your knowledge of data roles and practices, answer the following questions based on the NIST framework process.
What data role will own responsibility for step 1, the categorization of information systems, to whom will they delegate step 2, and what data role will be responsible for step 3?
If the systems that are being assessed all handle credit card information (and no other sensitive data), at what step would the PCI DSS first play an important role?
What data security role is primarily responsible for step 5?
Susan’s organization performs a zero fill on hard drives before they are sent to a third-party organization to be shredded. What issue is her organization attempting to avoid?
Embedded data used to help identify the owner of a file is an example of what type of label?
Retaining and maintaining information for as long as it is needed is known as what?
Which of the following activities is not a consideration during data classification?
What type of encryption is typically used for data at rest?
Which data role is tasked with granting appropriate access to staff members?
Which California law requires conspicuously posted privacy policies on commercial websites that collect the personal information of California residents?
Fred is preparing to send backup tapes off site to a secure third-party storage facility. What steps should Fred take before sending the tapes to that facility?
Which of the following does not describe data in motion?
A new law is passed that would result in significant financial harm to your company if the data that it covers was stolen or inadvertently released. What should your organization do about this?
Ed has been asked to send data that his organization classifies as confidential and proprietary via email. What encryption technology would be appropriate to ensure that the contents of the files attached to the email remain confidential as they traverse the Internet?
Which mapping correctly matches data classifications between nongovernment and government classification schemes?