CISSP Practice Test

CISSP practice test: what's covered

• Asset Security

Free CISSP sample questions

1. A hospital is building a data classification program and the CISO wants to articulate its single most important security benefit. Which statement best captures the primary purpose of classification?

   • A. It applies proportional protection levels based on sensitivity, value, and impact of loss
   • B. It reduces overall storage and backup costs by compressing low-value records
   • C. It eliminates the need for periodic audits once labels are assigned to data
   • D. It accelerates database query performance by indexing files according to tier
   Show answer

   Correct: A. Classification exists to drive proportional control selection so that resources match the sensitivity, value, and potential impact of each asset. Cost reduction and faster queries are not the goal because controls usually add cost, and classification does not eliminate audits, which remain necessary to verify that labels and handling are correct.

2. A defense contractor must align its labeling with US government classification levels. Listed from highest to lowest sensitivity, which sequence is correct?

   • A. Public, then Confidential, then Secret, then Top Secret as the peak tier
   • B. Top Secret, then Secret, then Confidential, then Unclassified at the base
   • C. Critical, then Important, then Standard, then Routine for general records
   • D. Restricted, then Internal, then External, then anonymous public release
   Show answer

   Correct: B. US government classification runs Top Secret, Secret, Confidential, down to Unclassified, ordered by the damage unauthorized disclosure would cause. The Public-to-Top-Secret option inverts the order, while Critical/Important and Restricted/Internal are commercial-style schemes that are not the official government taxonomy.

3. A retail company without a formal scheme asks you to recommend a typical commercial data classification hierarchy. Which set of levels best reflects common private-sector practice?

   • A. Critical, High, Medium, and Low borrowed directly from risk ratings
   • B. Class A, Class B, and Class C used for accounting depreciation
   • C. Public, Internal, Confidential, and Restricted in ascending sensitivity
   • D. Tier 1, Tier 2, and Tier 3 inherited from the data center design
   Show answer

   Correct: C. Commercial schemes commonly use labels like Public, Internal, Confidential, and Restricted tied to business impact. The Critical/High/Medium/Low set describes risk severity rather than data sensitivity, and Class A/B/C and Tier 1/2/3 are accounting and infrastructure constructs, not data classification levels.

4. When a data owner decides what classification to assign to a new dataset, which combination of criteria should drive that decision most directly?

   • A. The personal preference of the executive who requested the report
   • B. The physical file size and the storage medium chosen for the data
   • C. The geographic location of the rack where the data is hosted today
   • D. Sensitivity, value to the organization, regulatory obligations, and disclosure impact
   Show answer

   Correct: D. Defensible classification combines sensitivity, organizational value, regulatory scope, and the impact of unauthorized disclosure or modification. Executive preference is arbitrary and not repeatable, while file size and rack location describe storage characteristics that do not determine how damaging a breach of the data would be.

5. A new security director discovers the organization has no maintained inventory of its systems and data. Which statements explain why establishing that inventory is foundational to the security program? (Choose TWO)

   • A. You cannot protect or classify assets you cannot identify
   • B. Visibility into assets must precede patching and monitoring of them
   • C. An inventory automatically encrypts every asset it records
   • D. An inventory removes the need to ever classify data again
   • E. An inventory guarantees the organization will pass every audit
   Show answer

   Correct: A and B. Inventory is foundational because unknown assets cannot be protected, classified, patched, or monitored, so visibility must precede every other control. It does not encrypt assets by itself, it does not eliminate the need to classify data, and it cannot guarantee passing audits, which still verify that controls actually work.

Last updated: 2026-10-19

CISSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test