I85PREP
⌘ K
GISP study materials
GISP study resources

GISP practice questions

One question at a time. Build your GISP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Risk Management

Under the CIA triad, which property is most directly compromised when an unauthorized user reads a payroll database without altering any records?

  1. Confidentiality Correct answer.
  2. Non-repudiation
  3. Integrity
  4. Availability

Explanation

Confidentiality ensures information is not disclosed to unauthorized parties, so unauthorized reading of payroll data is a confidentiality breach. Integrity concerns unauthorized modification, availability concerns timely access, and non-repudiation concerns proving an action occurred.

Question 2Security and Risk Management

A security manager wants a single metric expressing the expected yearly monetary loss from a specific threat. Which calculation should be used?

  1. Total cost of ownership
  2. Return on security investment
  3. Annualized loss expectancy Correct answer.
  4. Net present value

Explanation

Annualized loss expectancy (ALE) equals single loss expectancy multiplied by annualized rate of occurrence, giving expected yearly loss for a threat. The other measures address investment return, ownership cost, or financial valuation, not expected threat loss.

Question 3Security and Risk Management

Which statement best describes the purpose of a risk register in a security program?

  1. It documents the technical configuration of firewalls
  2. It stores the results of penetration tests only
  3. It records identified risks with owners, ratings, and treatment status Correct answer.
  4. It lists every employee authorized to access the data center

Explanation

A risk register is the central log tracking identified risks, their assessment, assigned owners, and treatment progress. It is a governance tool rather than an access list, a configuration repository, or a test-results archive.

Question 4Security and Risk Management

In risk treatment, what does risk transfer mean?

  1. Accepting the risk without further action
  2. Eliminating the threat source entirely
  3. Shifting financial consequences to another party such as an insurer Correct answer.
  4. Reducing likelihood through new controls

Explanation

Risk transfer shifts the financial impact of a risk to a third party, commonly through insurance or contractual indemnity. The underlying risk usually remains, so it differs from avoidance, acceptance, or mitigation.

Question 5Security and Risk Management

Which principle holds that a subject should receive only the access necessary to perform its assigned duties?

  1. Need-to-know for classification only
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Defense in depth

Explanation

Least privilege grants subjects the minimum access required for their assigned tasks, limiting potential damage from misuse or compromise. Separation of duties divides tasks among people, defense in depth layers controls, and need-to-know is a related data-handling concept rather than the general access principle.

Question 6Security and Risk Management

A company classifies data so handling rules follow the information throughout its lifecycle. Which classification level typically requires the strictest controls?

  1. Internal
  2. Confidential Correct answer.
  3. Public
  4. Declassified

Explanation

Confidential (or equivalent top-tier) data demands the strongest protections because disclosure could cause serious harm. Internal and public data carry progressively lighter handling requirements, and declassified data is no longer sensitive.

Question 7Security and Risk Management

What is the primary role of a steering committee in an information security program?

  1. Conducting vulnerability scans
  2. Providing governance and strategic direction for security initiatives Correct answer.
  3. Writing firewall rule sets
  4. Performing daily log monitoring

Explanation

A steering committee provides governance, prioritizes initiatives, and aligns security with business strategy. Operational tasks such as monitoring, rule authoring, and scanning are performed by technical teams, not governance bodies.

Question 8Security and Risk Management

Which document defines the high-level intentions and direction of an organization regarding information security?

  1. Baseline configuration
  2. Incident ticket
  3. Security policy Correct answer.
  4. Standard operating procedure

Explanation

A security policy states management's intent and high-level requirements for protecting information. Procedures, baselines, and tickets are lower-level operational artifacts that implement or record activity.

Question 9Security and Risk Management

A risk assessment finds a vulnerability with high likelihood and severe impact, but the control to fix it costs far more than the expected loss. Which treatment is most defensible?

  1. Accept the risk and monitor it Correct answer.
  2. Transfer the risk through insurance
  3. Avoid the activity entirely
  4. Implement the costly control anyway

Explanation

When the cost of treatment exceeds expected loss and the risk is tolerable, acceptance with monitoring is a rational business decision. Transfer shifts only financial impact, avoidance may be impractical, and overspending on a control is not cost-effective.

Question 10Security and Risk Management

An organization calculates single loss expectancy of 200,000 and annualized rate of occurrence of 0.25 for a threat. What is the annualized loss expectancy?

  1. 25,000
  2. 800,000
  3. 50,000 Correct answer.
  4. 200,000

Explanation

ALE equals SLE multiplied by ARO, so 200,000 times 0.25 yields 50,000. The other values result from misapplying the formula, such as dividing or multiplying incorrectly.

Question 11Security and Risk Management

A payment processor must ensure no single employee can both create a vendor and approve payment to that vendor. Which control is being applied?

  1. Job rotation
  2. Separation of duties Correct answer.
  3. Mandatory vacation
  4. Least privilege

Explanation

Separation of duties splits a sensitive process so no one person controls all critical steps, preventing fraud. Least privilege limits access scope, while rotation and mandatory vacation are detective deterrents rather than step-splitting controls.

Question 12Security and Risk Management

During due diligence, a firm must decide how much risk to retain after buying cyber insurance. What is the retained portion called?

  1. Risk appetite
  2. Inherent risk
  3. Risk capacity
  4. Residual risk Correct answer.

Explanation

Residual risk is what remains after controls and transfers are applied. Inherent risk is the level before treatment, appetite is the willingness to accept risk, and capacity is the maximum risk an organization can bear.

Question 13Security and Risk Management

A security team wants to compare the cost of a proposed control against the monetary benefit it produces. Which metric applies?

  1. Return on security investment Correct answer.
  2. Single loss expectancy
  3. Annualized rate of occurrence
  4. Exposure factor

Explanation

Return on security investment compares the loss avoided by a control against the control's cost. ARO, SLE, and exposure factor are inputs to loss estimation, not cost-benefit comparison measures.

Question 14Security and Risk Management

An auditor finds that terminated employees retain active directory accounts for weeks. Which risk response most directly addresses the root cause?

  1. Raise the data classification of HR records
  2. Increase the password length requirement
  3. Formalize and automate the deprovisioning process Correct answer.
  4. Add another firewall at the perimeter

Explanation

The root cause is a missing or manual offboarding control, so formalizing and automating deprovisioning removes lingering access. Password length, perimeter firewalls, and reclassification do not fix the termination workflow.

Question 15Security and Risk Management

Which activity best demonstrates continuous risk monitoring rather than a point-in-time assessment?

  1. Performing a baseline configuration audit at project close
  2. Tracking key risk indicators against thresholds on a dashboard Correct answer.
  3. Completing an annual questionnaire once a year
  4. Running a one-time penetration test before launch

Explanation

Continuous monitoring relies on ongoing measurement such as key risk indicators compared against thresholds. Annual questionnaires, one-time tests, and closeout audits are periodic snapshots rather than continuous oversight.

Question 16Security and Risk Management

A multinational must comply with a regulation requiring breach notification within a fixed period. Which governance artifact should map the requirement to internal controls?

  1. A change advisory board calendar
  2. A network diagram
  3. An asset inventory spreadsheet
  4. A compliance control matrix Correct answer.

Explanation

A compliance control matrix maps regulatory requirements to the controls that satisfy them and the evidence produced. Asset inventories, network diagrams, and meeting calendars support operations but do not tie obligations to controls.

Question 17Security and Risk Management

An organization defines tolerance for downtime of a critical service. Which pair of metrics expresses maximum tolerable outage and acceptable data loss?

  1. Recovery time objective and recovery point objective Correct answer.
  2. Mean time to repair and mean time between failures
  3. Service level agreement and operating level agreement
  4. Annualized loss expectancy and exposure factor

Explanation

Recovery time objective sets the maximum acceptable time to restore service, while recovery point objective sets the maximum acceptable data loss measured in time. MTTR and MTBF describe reliability, SLAs and OLAs are agreements, and ALE and EF are risk metrics.

Question 18Security and Risk Management

A vendor will process regulated customer data. Which action best manages third-party risk before contract signature?

  1. Conduct a security assessment and require contractual security terms Correct answer.
  2. Delegate all accountability to the vendor
  3. Rely on the vendor's marketing materials
  4. Skip review because the vendor is well known

Explanation

Third-party risk management requires assessing the vendor's controls and codifying obligations in the contract before engagement. Marketing claims, reputation alone, and full delegation leave the organization accountable without assurance.

Question 19Security and Risk Management

Which statement correctly distinguishes a threat from a vulnerability?

  1. A threat is a control, while a vulnerability is a policy
  2. A threat is a loss amount, while a vulnerability is a likelihood
  3. A threat is a potential cause of harm, while a vulnerability is a weakness that can be exploited Correct answer.
  4. A threat is a weakness, while a vulnerability is an attacker

Explanation

A threat is any potential source of harm such as an attacker or natural event, and a vulnerability is a weakness that a threat could exploit. The other options confuse these with actors, controls, policies, or quantitative risk terms.

Question 20Security and Risk Management

A manager must choose between two controls with similar cost. One reduces likelihood, the other reduces impact. Which consideration is most relevant when the threat cannot be prevented?

  1. Prioritize the control that reduces likelihood
  2. Choose neither and accept the risk
  3. Choose the control with the longer name
  4. Prioritize the control that reduces impact Correct answer.

Explanation

When a threat cannot be prevented, likelihood reduction has limited effect, so controls that reduce impact such as backups or segmentation are more valuable. Accepting risk ignores available mitigation, and naming is irrelevant to control selection.

Question 21Security and Risk Management

An organization adopts a framework, then tailors its controls to its own environment and documents the rationale. What is this practice called?

  1. Risk avoidance
  2. Control exemption
  3. Framework tailoring Correct answer.
  4. Framework certification

Explanation

Tailoring adapts a framework's controls to the organization's context while documenting justified deviations. Certification asserts conformity, exemption removes a requirement, and avoidance eliminates an activity.

Question 22Security and Risk Management

A risk analysis shows a newly discovered zero-day affects an internet-facing service with no compensating control. Leadership asks for the fastest defensible action. Which response best fits?

  1. Close the finding because a patch is not yet available
  2. Apply interim mitigation such as segmentation or virtual patching while a permanent fix is developed Correct answer.
  3. Accept the risk permanently without monitoring
  4. Transfer the entire risk to the software vendor

Explanation

Interim mitigations reduce exposure while a permanent remedy is developed, which is defensible for an urgent zero-day. Permanent acceptance, closing an unresolved finding, and assuming full transfer to a vendor all leave the organization exposed.

Question 23Security and Risk Management

Two business units rate the same risk differently because one uses a five-point scale and the other uses dollar estimates. What governance step best enables consistent prioritization?

  1. Average the two ratings without adjustment
  2. Defer to the unit with the larger budget
  3. Define a common risk scoring methodology and criteria Correct answer.
  4. Exclude qualitative risks from the register

Explanation

Consistent prioritization requires a shared scoring methodology with defined criteria and scales so ratings are comparable. Averaging incompatible scales, weighting by budget, or dropping qualitative risks undermines objective comparison.

Question 24Security and Risk Management

An organization's risk appetite is low, but a critical legacy system cannot be patched and must remain online. Which combination of responses is most appropriate?

  1. Immediate decommissioning regardless of business impact
  2. Silent acceptance by the operations team
  3. Compensating controls plus documented acceptance with executive sign-off Correct answer.
  4. Reclassification of the system as low risk

Explanation

When a risk cannot be eliminated and exceeds appetite, compensating controls plus documented, executive-approved acceptance provide accountability. Unilateral acceptance, reckless decommissioning, and misclassification all bypass governance.

Question 25Security and Risk Management

A control is effective on paper but staff routinely bypass it during peak workload. Which conclusion best reflects a mature risk assessment?

  1. The control is effective because it is documented
  2. The bypasses should be removed from the audit record
  3. The control's operational effectiveness is deficient and the risk rating should reflect real behavior Correct answer.
  4. The risk is eliminated because a control exists

Explanation

Mature assessment distinguishes design from operating effectiveness; routine bypasses mean the control is not working and risk must reflect actual practice. Documentation alone, suppressed evidence, or the mere existence of a control do not reduce real risk.

Question 26Asset Security

Under a data classification policy, which role is accountable for determining the classification level of a newly created dataset and for approving its handling requirements?

  1. The data custodian
  2. The data owner Correct answer.
  3. The internal audit function
  4. The systems administrator

Explanation

The data owner is the business-level accountable party who assigns classification and approves handling rules based on sensitivity and business value. Custodians implement the controls the owner specifies but do not set classification policy themselves.

Question 27Asset Security

A data retention schedule states that records must be kept for seven years after account closure. Which practice best satisfies this requirement while limiting exposure?

  1. Archive the records to unmanaged personal storage for the retention period
  2. Retain the records indefinitely in case of future litigation
  3. Retain the records for seven years and then destroy them through an approved method Correct answer.
  4. Delete the records at account closure to minimize storage cost

Explanation

A retention schedule defines both a minimum retention period and a disposal point, so records are kept exactly as long as required and then destroyed using an approved, documented method. Indefinite retention increases breach exposure and storage liability without a legal basis.

Question 28Asset Security

Which statement correctly distinguishes data remanence from data in use?

  1. Remanence is data being actively processed, while data in use is residual data on media
  2. Remanence applies only to paper records, while data in use applies only to cloud storage
  3. Remanence is residual data left on media after attempted deletion, while data in use is being actively processed Correct answer.
  4. Remanence and data in use both describe data at rest on backup tapes

Explanation

Data remanence refers to residual representations of data that persist on storage media after deletion or overwrite attempts. Data in use is a separate state describing information actively processed in memory or by an application.

Question 29Asset Security

Which control is the most appropriate method for sanitizing a solid-state drive that is being retired and will leave organizational control?

  1. Quick format of the drive's primary partition
  2. Moving the files to the recycle bin and emptying it
  3. Cryptographic erasure of the self-encrypting drive, verified by the vendor Correct answer.
  4. Deletion of the file index entries referencing the data

Explanation

Cryptographic erasure destroys the media encryption key so previously written data becomes unrecoverable, which is an accepted sanitization method for self-encrypting solid-state media. Formatting, index deletion, and recycle-bin operations leave recoverable remnants.

Question 30Asset Security

An organization classifies data as public, internal, confidential, and restricted. Which action best reflects correct application of the scheme?

  1. Treat internal data with the same handling rules as restricted data
  2. Allow employees to self-select the classification of any dataset they touch
  3. Label restricted datasets and enforce need-to-know access with strong encryption Correct answer.
  4. Apply the same access controls to all four levels to simplify administration

Explanation

A classification scheme is only effective when each level carries distinct handling requirements, and the most sensitive level should receive labeling, strict need-to-know access, and strong encryption. Uniform controls or employee self-classification undermine the scheme's purpose.

Question 31Asset Security

Which element is essential to a defensible data retention and disposal policy?

  1. A documented schedule mapping record types to retention periods and disposal methods Correct answer.
  2. A policy that applies only to paper records and excludes electronic data
  3. A blanket rule that all data is kept until storage reaches capacity
  4. Discretion for each employee to destroy records when convenient

Explanation

A defensible policy ties each record type to a defined retention period and a corresponding disposal method, with documentation supporting legal and regulatory obligations. Discretionary or capacity-driven destruction cannot be defended in an audit or legal hold.

Question 32Asset Security

During litigation, counsel issues a legal hold. What is the primary obligation this places on asset custodians?

  1. Migrate all records to a public cloud region for accessibility
  2. Encrypt all records and discard the decryption keys
  3. Suspend routine destruction of potentially relevant records and preserve them Correct answer.
  4. Immediately destroy records to reduce organizational liability

Explanation

A legal hold requires the organization to preserve potentially relevant information by suspending normal retention-based destruction and disposal. Destroying or rendering records unrecoverable after a hold is issued can constitute spoliation.

Question 33Asset Security

Which practice best supports the principle of least privilege for privileged administrative accounts?

  1. Disable logging on administrative actions to protect privacy
  2. Use separate named administrative accounts with just-in-time elevation
  3. Grant standing administrative rights to all IT staff for convenience Correct answer.
  4. Share a single administrator account among the team

Explanation

Least privilege for privileged access is achieved by separating administrative identities from everyday accounts and granting elevated rights only when needed through just-in-time mechanisms. Standing, shared, or unlogged administrative access expands the attack surface and weakens accountability.

Question 34Asset Security

Which statement accurately describes the purpose of data labeling in an asset security program?

  1. It permanently encrypts the data at the file system level
  2. It guarantees that data cannot be copied by authorized users
  3. It communicates sensitivity so handling controls can be applied consistently Correct answer.
  4. It replaces the need for access control lists on file shares

Explanation

Labels convey the classification of an asset so that people and automated tools apply the correct handling, storage, and sharing rules. Labeling is a communication and enforcement aid, not a substitute for access control or encryption.

Question 35Asset Security

An asset inventory is being built for a security program. Which attribute is most important for supporting risk-based protection decisions?

  1. The physical color of the asset's housing
  2. The order in which assets were purchased
  3. The number of help desk tickets the asset generated
  4. The asset's owner, classification, and location Correct answer.

Explanation

An asset inventory supports risk decisions when it records who owns each asset, how sensitive it is, and where it resides, because these drive applicable controls and obligations. Cosmetic, procurement-order, and ticket-count attributes do not inform protection requirements.

Question 36Asset Security

Which approach best addresses data remanence risk when virtual machines are decommissioned in a shared hypervisor environment?

  1. Rely on the hypervisor to zero the storage automatically without verification
  2. Delete the virtual machine object and assume the disks are destroyed
  3. Securely wipe or cryptographically erase the virtual disks before releasing the storage Correct answer.
  4. Reassign the virtual disks to a new tenant without any sanitization

Explanation

Virtual disks can leave residual blocks on shared physical storage, so sanitization must be performed and verified before the storage is reused or released. Assuming automatic zeroing or simply deleting the VM object does not reliably eliminate remanence.

Question 37Asset Security

Which control most directly reduces the risk of sensitive data being exposed through an unsanctioned cloud storage service?

  1. Shortening the session timeout on the VPN concentrator
  2. Deploying data loss prevention with cloud access visibility and blocking policy Correct answer.
  3. Increasing the password length requirement for domain accounts
  4. Adding more frequent antivirus signature updates

Explanation

Data loss prevention combined with visibility into cloud service usage detects and blocks sensitive data moving to unsanctioned destinations. Password, session, and antivirus controls address other threat vectors and do not govern data exfiltration to cloud services.

Question 38Asset Security

Which statement best characterizes the difference between a data controller and a data processor under common privacy frameworks?

  1. The controller determines the purposes of processing, while the processor acts on the controller's instructions Correct answer.
  2. The processor determines the purposes of processing, while the controller only stores the data
  3. The controller and processor are always the same legal entity
  4. The processor bears sole legal responsibility for the controller's processing decisions

Explanation

The controller decides why and how personal data is processed and bears primary accountability, while the processor handles data on the controller's documented instructions. This allocation shapes contractual and security obligations between the parties.

Question 39Asset Security

A team proposes storing production backups in a region that lacks an adequate data protection agreement. What is the most appropriate asset security response?

  1. Block the transfer until a lawful transfer mechanism and required safeguards are in place Correct answer.
  2. Approve the transfer because backups are encrypted at rest
  3. Approve the transfer because backups are rarely accessed
  4. Approve the transfer if the storage cost is lower than domestic options

Explanation

Cross-border transfers of personal or regulated data require a lawful transfer mechanism and appropriate safeguards regardless of encryption or access frequency. Encryption supports but does not by itself authorize an otherwise impermissible transfer.

Question 40Asset Security

Which practice best supports secure disposal of paper records containing confidential information?

  1. Tearing records into several pieces by hand
  2. Cross-cut shredding or approved incineration with a documented certificate of destruction Correct answer.
  3. Placing records in a standard office recycling bin
  4. Storing records indefinitely in an unlocked storage room

Explanation

Confidential paper records should be destroyed by cross-cut shredding or approved incineration, ideally through a vendor that provides a certificate of destruction for audit evidence. Recycling, unlocked storage, and hand tearing leave information recoverable.

Question 41Asset Security

An organization wants to reduce the risk of orphaned accounts that retain access to sensitive data after staff depart. Which control is most effective?

  1. Requiring annual password changes for all staff
  2. Adding multifactor authentication to the VPN
  3. Integrating the HR termination feed with the identity provisioning system Correct answer.
  4. Publishing an acceptable use policy to all employees

Explanation

Automated deprovisioning triggered by the HR termination feed removes access promptly and prevents orphaned accounts. Password rotation, policy publication, and multifactor authentication improve general hygiene but do not reliably revoke access for departed staff.

Question 42Asset Security

Which statement about encryption and key management for data at rest is most accurate?

  1. Encryption is only as strong as the protection and separation of its keys Correct answer.
  2. Key management is unnecessary when using AES-256
  3. Encrypting data eliminates the need for access controls
  4. Storing keys alongside the encrypted data is an accepted best practice

Explanation

The protective value of encryption depends on keeping keys confidential, well-managed, and separated from the data they protect. Strong algorithms do not compensate for weak key custody, and encryption complements rather than replaces access control.

Question 43Asset Security

What is the primary security purpose of tokenization of payment card data?

  1. Compressing the data to reduce storage costs
  2. Converting the data into a human-readable report format
  3. Making the data available to all staff without restriction
  4. Replacing sensitive values with non-sensitive substitutes so the original is not stored in scope Correct answer.

Explanation

Tokenization substitutes a sensitive value with a token that has no exploitable value outside the tokenization system, reducing the systems and data within compliance scope. It is not a compression, reporting, or broad-access technique.

Question 44Asset Security

Which practice best supports data quality and integrity for a dataset used in regulatory reporting?

  1. Relying on a single employee to manually verify each record
  2. Archiving the dataset without any review before submission
  3. Allowing free-text entry without any validation rules
  4. Applying input validation and periodic reconciliation against authoritative sources Correct answer.

Explanation

Input validation prevents malformed data at entry, and reconciliation against authoritative sources detects discrepancies before they reach regulators. Unvalidated entry, single-person review, and unreviewed archiving increase the risk of inaccurate reporting.

Question 45Asset Security

Which statement best describes the relationship between data ownership and data stewardship?

  1. Ownership and stewardship are identical roles with no distinction
  2. The steward is legally accountable, while the owner performs routine data entry
  3. The steward approves classification, while the owner cleans records
  4. The owner is accountable for the data, while the steward handles day-to-day quality and compliance activities Correct answer.

Explanation

Accountability for a data asset rests with the owner, while the steward carries out operational responsibilities such as maintaining quality, documenting definitions, and monitoring compliance. Confusing the two roles blurs accountability.

Question 46Asset Security

A security team must protect sensitive data stored on a laptop that may be lost or stolen. Which combination provides the strongest defense in depth?

  1. Storing the data in a hidden folder on the desktop
  2. A screensaver password alone
  3. Full-disk encryption plus remote wipe capability and asset tracking Correct answer.
  4. Renaming sensitive files to obscure titles

Explanation

Full-disk encryption protects data if the device is lost, while remote wipe and asset tracking reduce the window of exposure and support recovery. Screensavers, hidden folders, and obscure names provide only trivial obfuscation.

Question 47Asset Security

Which scenario most clearly indicates a failure of the data classification program rather than a technology failure?

  1. A firewall rule was misconfigured and blocked legitimate traffic
  2. Confidential records were shared externally because no one knew the dataset's classification Correct answer.
  3. A backup job failed due to insufficient storage capacity
  4. A server rebooted unexpectedly because of a hardware fault

Explanation

A classification program fails when data lacks clear labeling and ownership, so staff cannot apply the correct handling rules and sensitive records leave the organization. Firewall, backup, and hardware incidents are technology or operations failures rather than classification governance failures.

Question 48Asset Security

Which practice best supports secure handling of sensitive data in non-production environments?

  1. Disabling access logging in test environments to reduce noise
  2. Using de-identified or masked data that preserves the required format Correct answer.
  3. Sharing a single test account among all developers
  4. Copying full production data to developer laptops for convenience

Explanation

Non-production environments should use de-identified or masked data that retains the structure needed for testing without exposing real sensitive values. Copying production data, disabling logging, and sharing accounts all increase exposure and weaken accountability.

Question 49Asset Security

An organization must prove to an auditor that retired storage media were sanitized before disposal. Which evidence is most persuasive?

  1. A photograph of the media being removed from the building
  2. A general statement in the security policy that media are wiped
  3. A sanitization log with media identifiers, method, date, and operator, plus vendor certificates Correct answer.
  4. A verbal assurance from the IT manager

Explanation

Auditable evidence requires a record linking each media item to the sanitization method, date, and responsible operator, supported by vendor certificates of destruction where applicable. Verbal assurances and general policy statements do not demonstrate that the activity actually occurred.

Question 50Asset Security

Which statement best describes the security rationale for minimizing the collection of personal data?

  1. Data minimization increases storage costs and should be avoided
  2. Collecting more data always improves security monitoring accuracy
  3. Less data collected reduces the potential impact of a breach and the scope of compliance obligations Correct answer.
  4. Minimization applies only to paper records

Explanation

Data minimization limits what an attacker could obtain in a breach and narrows the systems and records subject to privacy and regulatory obligations. It reduces rather than increases cost and applies to all data formats.