These free CISSP Asset Security practice questions test your knowledge of Domain 2, which covers identifying, classifying, and protecting information assets throughout their lifecycle. This domain accounts for 10% of your exam score, and mastering it requires understanding the distinct roles of data owners versus custodians, the legal requirements for data retention, and the business risks of improper classification.
Thinking like a museum curator is the fastest way to master Asset Security. A curator doesn't just see a vase; they see its origin, its value, its handling requirements, and its place in the collection. The CISSP exam demands you see data the same way, not as bits and bytes, but as valued objects with a lifecycle, owners, and specific protection needs.
Key facts
- Domain Name: Asset Security (Domain 2)
- Exam Weighting: 10%
- Approximate Questions: 12-18 questions on the 125-175 question adaptive exam
- Passing Score: 700 out of 1000 points
- Key Frameworks: NIST SP 800-53 (Security Controls), NIST SP 800-88 (Media Sanitization), ISO/IEC 27002 (Controls)
- Official Body: (ISC)²
Why These Asset Security Questions Will Help You Pass
These questions are calibrated to test your managerial judgment, the same skill the real CISSP Computerized Adaptive Testing (CAT) exam evaluates. They mirror the scenario-based format where you must choose the best course of action, not just a technically correct one.
Each question aligns with the official (ISC)² CISSP Certification Exam Outline for Domain 2. You will find questions covering:
- Information and Asset Classification: The process and business criteria for classifying data.
- Ownership: Differentiating the accountabilities of data owners, custodians, and stewards.
- Privacy: Protecting sensitive data like Personally Identifiable Information (PII).
- Data Lifecycle Management: Securing data from creation to final disposition.
- Asset Handling: Implementing security controls based on classification.
After each question, the detailed rationale explains why the correct answer is best and, more importantly, why the distractors are tempting but wrong. Mastering that logic is the key to passing. Try VoraPrep's adaptive CISSP practice questions to target your weak areas across all 8 domains.
Studying for CISSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
CISSP Domain 2 Practice Questions
Read each scenario carefully. Select the single best answer from the perspective of a security manager responsible for managing risk.
Question 1
A financial services firm is implementing a data classification policy. A junior analyst suggests classifying all internal documents as "Confidential" to simplify the process. As the senior security manager, what is the primary risk of this approach?
- Why A is best: It directly addresses the business impact. Over-classification leads to over-spending on security controls, wasting budget that could be used to mitigate other risks. The CISSP exam wants you to think in terms of business risk.
- Why B is tempting but wrong: While it's true the data is "over-protected," this is a symptom, not the root business risk. "Excessively high cost" is a more precise and managerially relevant risk statement.
- Why C is wrong: This approach actually makes the policy less complex to follow, not more. The problem is its inefficiency and cost, not its complexity.
- Why D is wrong: The principle of least privilege applies to user permissions (granting users only the access they need to perform their jobs). It is not the primary principle governing a data classification scheme, although the two concepts are related.
Question 2
A hospital is decommissioning a server that was used to store patient electronic health records (EHR). The data on the server is classified as "Highly Sensitive." Which of the following data sanitization methods is most appropriate before the physical media is disposed of?
- Why D is best: It offers the highest level of assurance that the data is unrecoverable, which is required for the highest classification levels.
- Why A is tempting but wrong: Degaussing (a "Purge" method) uses a strong magnetic field to erase data. It is effective for traditional magnetic media (HDDs) but is completely ineffective against modern solid-state drives (SSDs). Furthermore, some high-coercivity magnetic tapes may require specialized, powerful degaussers. Without knowing the exact media type, physical destruction is the universally effective and most secure choice for this data classification.
- Why B is wrong: A single pass of zeros is a "Clear" method. It is not sufficient for highly sensitive data, as sophisticated forensic tools can often recover data that has been overwritten only once.
- Why C is wrong: Cryptographic erase (CE) relies on sanitizing the encryption key for the data on a self-encrypting drive (SED). While effective, its assurance depends on the proper implementation of the encryption. Physical destruction provides a higher, more verifiable level of assurance.
Question 3
Who is ultimately responsible for determining the classification level of a specific data set?
- Why B is best: The data owner has the business context and ultimate accountability for the asset.
- Why A and C are wrong: The security administrator and the data custodian are technical roles. They are responsible for implementing the security controls that the data owner specifies (e.g., setting up file permissions, managing backups). They do not have the authority to classify the data itself.
- Why D is wrong: The CISO is responsible for the overall information security program. They create the classification policy and framework, but they do not own every individual piece of data in the organization. They delegate that responsibility to the business-side data owners.
Data Roles Compared: Owner vs. Custodian vs. Steward
Confusing these three roles is one of the most common reasons candidates lose points on Domain 2. This table clarifies their primary accountabilities.
| Role | Primary Accountability | Typical Title | Key Action |
|---|---|---|---|
| Data Owner | Ultimate responsibility for the data asset. Accountable for its protection and use. | Director of Marketing, VP of Sales | Decides the data classification level and who can access it. |
| Data Custodian | Technical implementation of security controls. Manages the systems where data lives. | IT Administrator, DBA | Implements access controls, performs backups, applies patches. |
| Data Steward | Data quality and metadata management. Ensures data is fit for its purpose. | Data Analyst, Business Analyst | Defines data elements and ensures data quality is maintained. |
Question 4
Your company has developed a unique algorithm for financial modeling. It is considered a critical trade secret. Which of the following provides the strongest and longest-lasting legal protection for this type of intellectual property?
- Why D is best: Trade secret protection can last as long as secrecy is maintained and prevents competitors from learning the algorithm's inner workings.
- Why A is wrong: Copyright protects the specific expression of an idea (the written code), not the underlying algorithm or process. Another company could write their own code to perform the same function without infringing the copyright.
- Why B is tempting but wrong: A patent protects an invention or process. You could potentially patent the algorithm, but this requires full public disclosure of how it works and only provides protection for a limited time (typically 20 years). This is often undesirable for a core competitive advantage.
- Why C is wrong: A trademark protects a brand name, logo, or slogan. It is irrelevant to protecting an algorithm.
Question 5
A European company's data retention policy states that customer PII must be deleted after 5 years. However, a new regulation requires that financial transaction records, which include customer PII, must be kept for 7 years. In this scenario, what should the company do?
- Why C is best: It ensures compliance with the stricter legal requirement. External laws and regulations supersede internal policies.
- Why A is wrong: This would lead to a direct violation of the financial regulation.
- Why B is tempting but wrong: While data minimization is a good privacy principle, altering or anonymizing legally required records could be seen as tampering and may violate the integrity requirements of the financial regulation. The regulation likely requires the entire, original record to be preserved.
- Why D is wrong: The legal department's job is to ensure compliance with the law, not to seek exceptions that are unlikely to be granted. The correct managerial decision is to comply with the stricter requirement.
Question 6
An organization uses a cloud-based storage service (IaaS) to store archived data. According to the shared responsibility model, who is responsible for classifying the data stored in the cloud?
- Why B is best: Data ownership and the responsibility for classification never transfer to the cloud provider. It remains with the organization that created or collected the data.
- Why A is wrong: The cloud provider has no business context for the value or sensitivity of your data. They cannot and will not classify it for you.
- Why C is wrong: A cloud broker is an intermediary and has no ownership of or responsibility for the data itself.
- Why D is wrong in this context: While overall cloud security is a "shared responsibility," the specific task of data classification falls squarely on the data owner, which is the cloud consumer. The provider's responsibility is to secure the underlying infrastructure, not to manage the customer's data.
Question 7
During a data labeling exercise, an employee finds a document on a shared drive with no classification label. The document contains project plans and timelines. According to best practices, what should be the default handling for this data?
- Why D is best: It applies a reasonable, pre-defined level of protection to unlabeled data, which is a core component of a robust classification policy.
- Why A is wrong: The location of a file on a shared drive does not imply it is public. Many internal shared drives contain sensitive information. Assuming it's public is a dangerous default.
- Why B is tempting but wrong: Treating it as "Top Secret" could impede business operations unnecessarily. While some high-security environments might adopt this cautious policy, the more common and balanced best practice is to use a moderate default, protect it, and then identify the owner for proper classification.
- Why C is wrong: Deleting the document could destroy business-critical information. The proper response is to secure it and identify the owner, not destroy it.
Question 8
What is the primary purpose of applying metadata tags for data classification?
- Why B is best: Automation is the key technical benefit. Tags allow systems to enforce policy programmatically, consistently, and at scale.
- Why A, C, and D are tempting but wrong: These are all valid secondary benefits. However, from a security manager's perspective of implementing effective controls, automation is the most significant and primary driver for using metadata tags over simple human-readable labels. The CISSP exam will often ask you to identify the most impactful or primary reason.
Question 9
A marketing team wants to use a third-party analytics platform to process customer email addresses for a campaign. The email addresses are considered PII. Before transferring the data, what is the most critical step the data owner must ensure?
- Why C is best: It provides a comprehensive, legally binding framework for protecting the data, which is the most critical overarching control.
- Why A is tempting but wrong: Encrypting data in transit is a crucial technical control, but it is only one small part of the overall protection required. The agreement in (C) would mandate this and many other controls.
- Why B is wrong: An NDA is important but is generally focused on confidentiality and is less comprehensive than a full data sharing agreement, which specifies technical and procedural security controls.
- Why D is wrong: While user consent is critical (and legally required under regulations like GDPR), it doesn't protect the data once it's transferred. The data owner's primary responsibility is to ensure the controls are in place to protect the asset, which is accomplished through the agreement.
Question 10
Which of the following is an example of data aggregation leading to a security issue?
- Why C is best: It perfectly illustrates the concept of creating sensitive data through the aggregation of non-sensitive data points.
- Why A, B, and D are wrong: These are all valid security issues, but they do not describe the specific problem of data aggregation. They represent data theft, an authentication attack, and an availability attack, respectively.
Calculate Your CISSP Score & Study Hours by Domain
Adjust your practice scores across official CISSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How to Interpret Your Score
Analyze the pattern of your mistakes, not just the raw count.
- 8-10 Correct: You have a strong conceptual grasp of Asset Security. Your focus should be on practicing more nuanced, scenario-based questions. Ensure you can articulate why each distractor is wrong, not just why the right answer is right.
- 5-7 Correct: You have a decent foundation but likely have gaps in key areas, such as the specific accountabilities of data roles or the nuances of data sanitization standards. Re-read the explanations for the questions you missed and dive deep into those sub-topics in your study materials.
- 0-4 Correct: You need a more fundamental review of Domain 2. This score suggests you may be unfamiliar with the core principles of asset security. Your next step is to stop quizzing and return to foundational learning. A low score is a diagnostic tool telling you exactly where to focus your effort. If you're struggling to rebuild, our CISSP Exam Retake Strategy (2026) guide can help you structure your comeback.
Go Beyond a Quiz with a Complete CISSP Course
A short quiz is a great spot check, but passing the CISSP requires building deep, consistent judgment across all eight domains. That's what VoraPrep is designed for.
VoraPrep is a complete, 6-pillar interactive course built to replace overpriced, passive video-lecture bundles. When you sign up, you get:
- Textbook-Grade Lessons & Study Guides: Step-by-step guides covering every topic in the CISSP blueprint.
- Adaptive Practice Bank: Over 2,200 exam-calibrated questions that adapt to your weak spots.
- 1:1 Exam Simulators: Full-length, timed mock exams that replicate the real Pearson VUE experience.
- Spaced-Repetition Flashcards: FSRS flashcards to lock in key terms and frameworks.
- Personalized Study Plan: A dynamic calendar built around your exam date to keep you on track.
- Vory, Your 24/7 Personal Tutor: Stuck on a concept? Ask Vory inside any question or lesson for a step-by-step explanation.
Unlike traditional courses that cost thousands, VoraPrep provides this complete learning system for just $29/month. Learn more about VoraPrep's complete CISSP course.