I85PREP
⌘ K
SCLE Module 6 study materials
SCLE Module 6 study resources

SCLE Module 6 practice questions

One question at a time. Build your SCLE Module 6 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Risk Management

Which principle of the CIA triad is most directly violated when an unauthorized employee reads payroll records without altering them?

  1. Integrity
  2. Non-repudiation
  3. Availability
  4. Confidentiality Correct answer.

Explanation

Confidentiality protects information from unauthorized disclosure, so reading payroll data without permission is a confidentiality breach even if nothing is changed. Integrity concerns unauthorized modification, availability concerns timely access, and non-repudiation concerns proving an action occurred.

Question 2Security and Risk Management

A risk practitioner calculates that a threat occurs about twice per year and each occurrence costs roughly $50,000. What is the annualized loss expectancy (ALE)?

  1. $100,000 Correct answer.
  2. $25,000
  3. $50,000
  4. $200,000

Explanation

ALE equals single loss expectancy multiplied by annualized rate of occurrence. Here $50,000 times 2 per year yields $100,000 per year, which is the expected annual cost used to justify controls.

Question 3Security and Risk Management

Which statement best describes the difference between a policy and a procedure?

  1. A policy describes technical configurations, while a procedure describes management intent
  2. A policy is optional guidance, while a procedure is legally binding
  3. A policy is a mandatory high-level statement of intent, while a procedure gives step-by-step instructions Correct answer.
  4. A policy is created by auditors, while a procedure is created by regulators

Explanation

Policies express management's mandatory direction and are intentionally broad, while procedures translate that direction into specific, repeatable steps. Standards and baselines sit between them, specifying measurable requirements and configurations.

Question 4Security and Risk Management

An organization wants to reduce risk by transferring it. Which action achieves that goal?

  1. Installing a firewall to block malicious traffic
  2. Purchasing a cyber insurance policy Correct answer.
  3. Accepting the risk after documenting it
  4. Removing the vulnerable system from service

Explanation

Risk transfer shifts the financial consequence of a risk to another party, and insurance is the classic example. Firewalls mitigate, acceptance retains the risk, and decommissioning avoids it.

Question 5Security and Risk Management

What is the primary purpose of a data classification scheme?

  1. To encrypt every data store uniformly
  2. To eliminate the need for access reviews
  3. To determine handling requirements based on sensitivity Correct answer.
  4. To replace the organization's risk register

Explanation

Classification labels data by sensitivity so that appropriate handling, access, and protection controls can be applied consistently. It drives control selection rather than replacing other governance activities.

Question 6Security and Risk Management

Which document typically defines the minimum security configuration for a specific operating system?

  1. Incident response plan
  2. Security baseline Correct answer.
  3. Enterprise risk appetite statement
  4. Business impact analysis

Explanation

A baseline specifies the minimum mandatory configuration settings for a given technology, such as an OS hardening standard. Risk appetite, BIA, and incident response planning address different governance needs.

Question 7Security and Risk Management

Which role is ultimately accountable for accepting residual risk in an organization?

  1. The external penetration tester
  2. The security analyst who performed the assessment
  3. The senior management or risk owner with authority Correct answer.
  4. The vendor supplying the firewall

Explanation

Risk acceptance requires authority to commit the organization, which rests with senior management or the designated risk owner. Analysts, testers, and vendors provide input but cannot accept risk on the organization's behalf.

Question 8Security and Risk Management

A control that reduces the likelihood of an event occurring is best classified as which type?

  1. Preventive Correct answer.
  2. Compensating
  3. Detective
  4. Corrective

Explanation

Preventive controls act before an event to stop it or lower its likelihood. Detective controls discover events after they occur, corrective controls restore operations, and compensating controls substitute for another control.

Question 9Security and Risk Management

A company must comply with a regulation requiring encryption of cardholder data at rest. Which governance artifact most directly records this obligation and its associated controls?

  1. A compliance obligation register mapped to controls Correct answer.
  2. A vulnerability scan summary
  3. A threat model for the payment application
  4. A disaster recovery test report

Explanation

A compliance obligation register captures regulatory requirements and maps each to the controls that satisfy them, enabling traceability. Threat models, DR tests, and scan summaries support security but do not record legal obligations systematically.

Question 10Security and Risk Management

During a risk assessment, a team scores likelihood as 4 and impact as 5 on a 1-5 scale, producing a score of 20. The organization's threshold for mandatory treatment is 15. What is the most appropriate next step?

  1. Accept the risk because the score is only slightly above threshold
  2. Develop a treatment plan to reduce the risk to an acceptable level Correct answer.
  3. Close the risk because impact alone does not matter
  4. Re-score using a different scale to lower the number

Explanation

A score above the treatment threshold requires a documented treatment plan, such as mitigation, transfer, or avoidance, until residual risk is acceptable. Manipulating the scale or ignoring the threshold undermines the risk process.

Question 11Security and Risk Management

Which metric best measures whether a vulnerability management program is keeping pace with exposure over time?

  1. Total number of vulnerabilities ever recorded
  2. Median time to remediate critical vulnerabilities Correct answer.
  3. Number of scanners deployed
  4. Count of security policies approved

Explanation

Median time to remediate critical vulnerabilities reflects how quickly exposure is reduced and can be tracked over time. Raw totals, tool counts, and policy counts measure activity or volume rather than remediation effectiveness.

Question 12Security and Risk Management

An organization defines its risk appetite as low for data confidentiality but moderate for service disruption. A proposed change increases outage tolerance while improving encryption. How should the risk practitioner evaluate it?

  1. Defer to the vendor's risk assessment
  2. Reject it because any outage increase exceeds appetite
  3. Assess the change against each risk category separately Correct answer.
  4. Approve it because encryption always outweighs availability

Explanation

Risk appetite is expressed per risk category, so the change must be evaluated against confidentiality and availability tolerances separately. A single blanket judgment or vendor deference ignores the organization's own defined thresholds.

Question 13Security and Risk Management

What is the key distinction between a business impact analysis (BIA) and a risk assessment?

  1. A BIA is quantitative, while a risk assessment is always qualitative
  2. A BIA is performed only after an incident, while a risk assessment is performed only before
  3. A BIA replaces the need for a risk register
  4. A BIA focuses on consequences to business functions, while a risk assessment evaluates likelihood and impact of threats Correct answer.

Explanation

A BIA identifies critical business functions and the consequences of their disruption, often setting recovery objectives. A risk assessment analyzes threats, vulnerabilities, likelihood, and impact to prioritize risk treatment.

Question 14Security and Risk Management

A third party will process sensitive customer data. Which action best supports ongoing supplier risk management?

  1. Transferring all responsibility for the data to the vendor
  2. Signing the contract once and filing it permanently
  3. Relying solely on the vendor's marketing materials
  4. Defining contractual security requirements and periodically reviewing assurance evidence Correct answer.

Explanation

Supplier risk management requires contractual obligations plus recurring verification, such as audits, certifications, or questionnaires. One-time filing, marketing claims, and blanket responsibility transfer do not provide ongoing assurance.

Question 15Security and Risk Management

Which activity best demonstrates due care in security governance?

  1. Delegating all security decisions to the IT help desk
  2. Documenting and enforcing security controls consistently across the organization Correct answer.
  3. Purchasing the most expensive security product available
  4. Publishing a policy without any enforcement mechanism

Explanation

Due care means the organization actively implements and enforces reasonable safeguards, not merely planning them. Documented, consistently enforced controls show that management exercised the expected level of diligence.

Question 16Security and Risk Management

A risk register entry lists a threat, the affected asset, current controls, and an owner. Which element is still missing for the entry to support treatment decisions?

  1. The vendor's support phone number
  2. The names of all employees with access
  3. The assessed risk level and proposed treatment Correct answer.
  4. The asset's purchase price

Explanation

A risk register must capture the assessed risk level and the planned treatment so decisions and progress can be tracked. Purchase price, access lists, and support contacts are asset details that do not drive treatment prioritization.

Question 17Security and Risk Management

Which statement correctly distinguishes a standard from a guideline?

  1. A standard describes incident steps, while a guideline describes legal obligations
  2. A standard is mandatory and measurable, while a guideline is recommended practice with discretion Correct answer.
  3. A standard is optional, while a guideline is mandatory
  4. A standard applies only to vendors, while a guideline applies only to employees

Explanation

Standards set mandatory, often measurable requirements that support policy, whereas guidelines offer recommended approaches where discretion is allowed. Both derive authority from policy but differ in binding force.

Question 18Security and Risk Management

An organization discovers that a critical system lacks current backups. Leadership decides to proceed unchanged and record the decision. Which risk response has occurred?

  1. Avoidance
  2. Mitigation
  3. Transfer
  4. Acceptance Correct answer.

Explanation

Acceptance means the organization acknowledges the risk and chooses to retain it, documenting the decision with appropriate authority. Avoidance would remove the activity, mitigation would add controls, and transfer would shift financial impact.

Question 19Security and Risk Management

Which approach best aligns security awareness training with risk management?

  1. Requiring staff to sign an attendance sheet only
  2. Tailoring content to role-based risks and measuring behavior change Correct answer.
  3. Delivering the same annual slide deck to all staff
  4. Outsourcing training with no internal oversight

Explanation

Effective awareness programs target the risks each role actually faces and measure outcomes such as phishing report rates or reduced incidents. Uniform content and attendance-only metrics show activity without evidence of reduced risk.

Question 20Security and Risk Management

A risk assessment team uses a qualitative 1-5 scale. Which weakness is most inherent to this approach?

  1. Results depend on subjective judgment and may vary between assessors Correct answer.
  2. It always overstates low-probability events
  3. It cannot be performed without actuarial data
  4. It requires monetary valuation of every asset

Explanation

Qualitative scales rely on expert judgment, so ratings can differ between assessors and lack the precision of quantitative methods. They do not require actuarial data or monetary valuation, which are characteristics of quantitative approaches.

Question 21Security and Risk Management

An organization identifies that a single administrator holds all privileged access with no oversight. Which control combination best addresses this governance weakness?

  1. Encrypting the administrator's workstation disk
  2. Implementing least privilege and independent review of privileged activity Correct answer.
  3. Adding a second firewall at the perimeter
  4. Increasing the administrator's password length only

Explanation

Concentration of privileged access without oversight is a segregation-of-duties and monitoring gap. Least privilege limits excessive rights, and independent review provides detection, together reducing the risk of misuse or undetected error.

Question 22Security and Risk Management

A quantitative risk analysis shows a control costing $40,000 per year reduces ALE from $150,000 to $90,000. How should the risk practitioner interpret this result?

  1. The control is justified because residual risk falls below zero
  2. The control's value cannot be assessed without a qualitative score
  3. The control delivers $60,000 in annual benefit and is cost-justified Correct answer.
  4. The control should be rejected because it does not eliminate risk

Explanation

The control reduces expected annual loss by $60,000 while costing $40,000, yielding a positive net benefit of $20,000, so it is cost-justified. Residual risk remains but at a lower level, which is the normal goal of mitigation.

Question 23Security and Risk Management

A regulator requires breach notification within 72 hours. Which governance arrangement best ensures this obligation is met reliably?

  1. Relying on employees to report breaches when convenient
  2. Embedding the deadline in the incident response plan with defined roles, escalation paths, and tested timelines Correct answer.
  3. Documenting the requirement only in the annual compliance report
  4. Assigning notification to the vendor that hosts the data

Explanation

Meeting a hard regulatory deadline requires the obligation to be operationalized in the incident response plan, with clear roles, escalation, and rehearsed timing. Passive reliance, documentation alone, or delegating to a vendor leaves the organization's accountability unmanaged.

Question 24Security and Risk Management

Two business units assess the same shared database risk and assign scores of 8 and 16 on identical scales. Which explanation most plausibly accounts for the divergence and should be investigated first?

  1. Different assumptions about asset criticality and threat exposure were used Correct answer.
  2. The organization has too few security policies
  3. The database is encrypted at rest
  4. The risk register has too many columns

Explanation

Divergent scores on the same scale usually reflect different assumptions about asset value, threat exposure, or impact criteria. Reconciling those assumptions through a common risk methodology is the first step toward consistent, comparable ratings.

Question 25Security and Risk Management

An organization outsources a critical service and later learns the provider suffered an undetected breach months earlier. Which governance failure is most directly implicated?

  1. Overstaffing of the internal security team
  2. Use of multifactor authentication internally
  3. Lack of defined assurance monitoring and incident notification obligations for the supplier Correct answer.
  4. Excessive encryption of internal data

Explanation

The failure lies in supplier governance: without contractual notification duties and recurring assurance monitoring, breaches at providers can go unnoticed by the customer. Encryption, staffing, and MFA are unrelated to the supplier oversight gap described.

Question 26Security and Risk Management

An organization classifies information so that owners know how each asset must be handled. Which statement best describes the role of data classification within a security program?

  1. It guarantees that regulatory encryption mandates are satisfied for every stored record.
  2. It maps assets to handling requirements and protection levels based on sensitivity and criticality. Correct answer.
  3. It replaces the need for a risk assessment because sensitivity is already known.
  4. It assigns technical configuration baselines directly to each endpoint device.

Explanation

Data classification labels information by sensitivity and criticality so that appropriate handling, access, and protection requirements can be applied consistently. It is an input to risk-based decisions and control selection, not a substitute for them, and it does not itself configure systems or certify compliance.

Question 27Security and Risk Management

A security manager wants a control framework that lets the organization compare its program against a widely recognized, auditable set of security and privacy control objectives. Which type of reference best fits that purpose?

  1. An internal style guide for writing security policies.
  2. A penetration test report from the previous year.
  3. A vendor product hardening guide for a single operating system.
  4. A recognized control framework such as ISO/IEC 27001 or NIST SP 800-53. Correct answer.

Explanation

Recognized control frameworks provide structured, auditable control objectives that an organization can use to design and assess its security program. Hardening guides, style guides, and past test reports are narrower inputs that do not supply a comprehensive, comparable control baseline.

Question 28Security and Risk Management

A security team is deciding how to treat a risk involving an outdated internal application. Leadership chooses to keep operating the application while adding monitoring and a compensating network control, and formally records the decision. Which risk treatment option has been selected?

  1. Risk mitigation Correct answer.
  2. Risk transfer
  3. Risk avoidance
  4. Risk acceptance

Explanation

Risk mitigation reduces exposure by applying controls, here monitoring plus a compensating network control, while the activity continues. Because the organization is actively lowering the risk rather than simply tolerating it unchanged, the treatment is mitigation even though a residual risk decision is documented.

Question 29Security and Risk Management

An organization wants to confirm that a critical supplier's security controls operate effectively over time, not just at contract signing. Which arrangement best supports this objective?

  1. Reviewing the supplier once during procurement and then closing the file.
  2. Delegating all oversight to the supplier's own internal audit team without review.
  3. Relying on the supplier's marketing materials and public website claims.
  4. Requiring periodic independent assurance reports and defined breach notification obligations. Correct answer.

Explanation

Ongoing supplier risk management depends on recurring evidence such as independent assurance reports and contractual duties to notify the customer of incidents. These mechanisms give the customer continuing visibility into control effectiveness after onboarding rather than a one-time snapshot.

Question 30Security and Risk Management

A risk analyst is choosing between a qualitative and a quantitative approach for a new assessment. Which consideration most accurately reflects a key limitation of purely quantitative risk analysis?

  1. It cannot express results in monetary terms, so executives cannot compare it to control costs.
  2. It depends on historical loss data and estimates that may be scarce, incomplete, or poorly suited to novel threats. Correct answer.
  3. It produces results that cannot be aggregated across multiple assets or business units.
  4. It is inherently subjective because it relies on ordinal rating scales rather than measured values.

Explanation

Quantitative analysis expresses risk in monetary terms but relies on credible loss frequency and magnitude data, which are often limited or unavailable for new or emerging threats. When input data are weak, the apparent precision of the output can mislead decision makers.

Question 31Asset Security

An organization classifies data so that labels can be applied consistently and handling rules can be enforced. Which characteristic of information does a classification scheme primarily describe?

  1. Its encryption algorithm and key length
  2. Its sensitivity and the impact of unauthorized disclosure Correct answer.
  3. Its storage media type and physical location
  4. Its retention period and destruction date

Explanation

Data classification expresses sensitivity, usually as the potential impact if the information is disclosed, altered, or lost. Handling rules, retention, and controls are then derived from the assigned class rather than from media type or cryptography.

Question 32Asset Security

A company stores customer records and must decide who owns the risk if the records are mishandled. Which role is accountable for the data and for defining the rules for its protection?

  1. The system administrator who configures access
  2. The security auditor who reviews controls
  3. The data custodian who performs daily backups
  4. The data owner who is accountable for the data asset Correct answer.

Explanation

The data owner is the business role accountable for a data asset, including classification and defining protection requirements. Custodians and administrators implement and operate controls on the owner's behalf.

Question 33Asset Security

A retail firm is defining how long transaction records must be kept to satisfy tax law and how they must be destroyed afterward. Which practice addresses this requirement?

  1. Data remanence management
  2. Data retention policy Correct answer.
  3. Data minimization
  4. Data masking

Explanation

A retention policy specifies how long each data category is kept and the conditions and methods for disposal. It ties legal and business requirements to lifecycle actions.

Question 34Asset Security

Which statement correctly distinguishes data remanence from data destruction?

  1. Remanence is encryption at rest, while destruction is key revocation
  2. Remanence is the residual representation of data after attempted erasure, while destruction makes recovery infeasible Correct answer.
  3. Remanence applies only to paper records, while destruction applies only to electronic media
  4. Remanence is a legal hold, while destruction is a backup rotation schedule

Explanation

Remanence is what remains recoverable after ordinary deletion or overwrite attempts. Destruction is the process that ensures the media or data can no longer be recovered.

Question 35Asset Security

An organization wants to reduce the volume of sensitive data it holds so that a breach would expose fewer records. Which principle should guide this effort?

  1. Data aggregation
  2. Data replication
  3. Data deduplication
  4. Data minimization Correct answer.

Explanation

Data minimization limits collection and retention to what is necessary for the stated purpose, which reduces exposure if a breach occurs. It is a foundational privacy and asset-reduction principle.

Question 36Asset Security

A security team needs to label information so employees know how to handle it and so automated tools can enforce controls. Which asset security activity produces these labels?

  1. Data classification Correct answer.
  2. Configuration baseline creation
  3. Capacity planning
  4. Vulnerability scanning

Explanation

Classification assigns sensitivity labels that drive handling procedures and automated enforcement. It is the prerequisite for consistent protection of information assets.

Question 37Asset Security

A hospital wants records usable for analytics without exposing patient identities to analysts. Which technique best supports this goal?

  1. Network segmentation of the analytics subnet
  2. Multi-factor authentication for analysts
  3. Data anonymization or pseudonymization of identifiers Correct answer.
  4. Full-disk encryption of the analytics server

Explanation

Anonymization or pseudonymization removes or replaces identifying values so analysts can work with records while reducing privacy exposure. Encryption, segmentation, and authentication protect the environment but still expose identities to authorized users.

Question 38Asset Security

A company must dispose of solid-state drives that held confidential data and cannot degauss them. Which approach is appropriate?

  1. Overwrite each drive once and return it to inventory
  2. Store the drives in a locked cabinet indefinitely
  3. Delete the partition table and reformat the drives
  4. Cryptographic erasure or physical destruction of the drives Correct answer.

Explanation

Flash media can retain data in spare blocks, so degaussing is ineffective and simple overwrite may not reach all cells. Cryptographic erasure with verified key destruction or physical destruction reliably prevents recovery.

Question 39Asset Security

A team wants to use production customer data in a development environment for testing. Which control best reduces risk while preserving realistic test data?

  1. Masking sensitive fields in a test data set Correct answer.
  2. Copying the full production database to development
  3. Granting developers production read access
  4. Encrypting the development database with a shared key

Explanation

Masking preserves data format and realism while removing sensitive values, which limits exposure in lower-trust environments. Copying raw data or broadening production access increases risk.

Question 40Asset Security

A data owner must decide the classification of a new marketing data set. Which input is most relevant to that decision?

  1. The number of servers hosting the data
  2. The backup schedule used for the database
  3. The vendor that supplied the storage hardware
  4. The impact to the organization if the data were disclosed Correct answer.

Explanation

Classification is driven by the potential impact of compromise, such as disclosure, alteration, or loss. Operational details like backup schedules and hardware vendors are control considerations, not sensitivity criteria.

Question 41Asset Security

A company is ending a contract with a cloud provider and must ensure its data is removed from the provider's systems. Which action best verifies the requirement is met?

  1. Obtain a certificate of destruction or attestation of secure erasure Correct answer.
  2. Confirm the data is no longer visible in the web console
  3. Rely on the provider's standard deletion statement in the contract
  4. Change the account password and disable the account

Explanation

A certificate of destruction or attestation provides documented evidence that data was securely erased in accordance with the agreement. Console visibility and account changes do not prove media sanitization.

Question 42Asset Security

A privacy regulation requires that personal data be kept only as long as necessary for its purpose. Which combination best satisfies this requirement?

  1. Archiving all data to offline tape
  2. Encrypting all stored personal data
  3. Defined retention periods plus automated deletion at expiry Correct answer.
  4. Indefinite retention with annual review

Explanation

Storage limitation is met by defining retention periods tied to purpose and enforcing deletion when they expire. Reviews without deletion or indefinite archiving do not satisfy the requirement.

Question 43Asset Security

During an asset inventory review, a team finds unlabeled files on a shared drive containing what appear to be HR records. What is the most appropriate first step?

  1. Classify the data and assign an owner before deciding handling Correct answer.
  2. Move the files to a public share for review
  3. Encrypt the files and leave ownership undefined
  4. Delete the files to eliminate the risk

Explanation

Unknown data must be identified and classified, and an accountable owner assigned, before handling decisions are made. Deleting data without authority risks destroying records under legal hold.

Question 44Asset Security

An organization wants to protect data throughout its lifecycle. Which sequence best reflects the asset lifecycle from creation to disposal?

  1. Storage, classification, destruction, use, sharing, archiving
  2. Sharing, use, storage, classification, archiving, destruction
  3. Destruction, archiving, sharing, use, storage, classification
  4. Classification, storage, use, sharing, archiving, destruction Correct answer.

Explanation

Data is typically classified early so that controls can be applied during storage, use, sharing, and archiving, and finally destroyed. Classification after distribution leaves data unprotected during its most exposed phases.

Question 45Asset Security

A company uses a labeling scheme of Public, Internal, Confidential, and Restricted. A system owner proposes storing Restricted data on removable media without encryption. What should the security practitioner recommend?

  1. Approve it because removable media is not covered by classification
  2. Require encryption and tracking consistent with the Restricted handling rules Correct answer.
  3. Downgrade the data to Internal to avoid the control
  4. Allow it if the media stays in the office

Explanation

Handling rules for the highest classification govern the media used, so Restricted data on removable media requires strong protection such as encryption and tracking. Downgrading data to avoid controls undermines the classification scheme.

Question 46Asset Security

An organization must prove to regulators that sensitive records were destroyed at the end of retention. Which evidence is most defensible?

  1. An email stating that deletion was planned
  2. A signed destruction log with date, method, and asset identifiers Correct answer.
  3. A verbal confirmation from the IT technician
  4. A screenshot of an empty folder

Explanation

Auditable destruction records identify what was destroyed, when, and by which method, and are signed by responsible parties. Informal confirmations and empty folders do not demonstrate that sanitization occurred.

Question 47Asset Security

A multinational firm must reconcile conflicting privacy laws across regions when setting retention periods for employee data. Which approach is most defensible?

  1. Retain data indefinitely until legal advises otherwise
  2. Apply the shortest lawful retention period that satisfies all applicable obligations Correct answer.
  3. Let each department choose its own retention period
  4. Apply the longest period from any region to all data

Explanation

Where multiple regimes apply, the organization must satisfy all of them, which generally means honoring the most restrictive lawful limit. Applying the longest period or leaving decisions to departments can violate storage-limitation requirements.

Question 48Asset Security

A data custodian discovers that backups containing Confidential data are stored on tapes that are not encrypted and are transported by a third party. Which risk treatment best aligns with asset security principles?

  1. Accept the risk because backups are rarely accessed
  2. Reclassify the backups as Public to remove the requirement
  3. Apply encryption to the tapes and use a vetted transport with chain of custody Correct answer.
  4. Reduce backup frequency to lower exposure

Explanation

Confidential data in transit and at rest requires protection commensurate with its classification, such as encryption and custody controls. Reclassifying or reducing frequency does not address the exposure of unencrypted tapes.

Question 49Asset Security

An organization is selecting a sanitization method for magnetic hard drives that will be reused internally at a lower classification. Which consideration is most important?

  1. Verification that the chosen overwrite or purge method meets the target classification Correct answer.
  2. The drive's warranty status
  3. The physical weight of the drive
  4. The operating system installed on the drive

Explanation

Reuse requires sanitization sufficient for the new, lower classification, with verification that the method actually removed residual data. Warranty, weight, and prior OS are not sanitization criteria.

Question 50Asset Security

A security architect argues that tokenizing card numbers removes the need to classify the token store as sensitive. Which response is most accurate?

  1. Tokenization eliminates all retention obligations
  2. Tokens are always safe because they are random strings
  3. Tokens should be stored with the original card numbers for reconciliation
  4. The token vault and mapping data remain sensitive and must be protected at the highest applicable classification Correct answer.

Explanation

Tokenization reduces exposure in downstream systems, but the vault and mapping that link tokens to real values remain highly sensitive. They must be classified and protected accordingly, and retention obligations still apply.