CCT 145: Practice CISSP Questions - Data Classification and Protection for the Exam (Domain 2.1.1)

Ever wondered how to navigate the complexities of data classification within your organization? Get ready to sharpen your cybersecurity skills and elevate your knowledge as we dissect CISSP Question Thursday, focusing on domain 2.1.1. This week, we also bring you an intriguing piece of news about ARPA-H, a groundbreaking new agency inspired by DARPA but aimed at revolutionizing healthcare through cutting-edge technology. With a starting fund of $50 million, ARPA-H is set to tackle critical issues like ransomware in the healthcare sector, presenting immense opportunities for those in the cybersecurity field.

We go beyond the basics as we cover crucial aspects of data classification and security protocols across diverse organizational contexts. Learn how to classify different types of data, from marketing campaign materials to sensitive patient information, and understand why encryption is essential for protecting data at rest. We also discuss the limitations of Data Loss Prevention (DLP) solutions and offer key security considerations for managing user geolocation data in mobile apps. This episode is a must-listen for anyone preparing for the CISSP exam or looking to enhance their cybersecurity expertise.

Gain access to 60 FREE CISSP Practice Questions each and every month for the next 6 months by going to FreeCISSPQuestions.com and sign-up to join the team for Free. That is 360 FREE questions to help you study and pass the CISSP Certification. Join Today!

Transcript

Speaker 1: 0:00

Welcome to the CISSP Cyber Training Podcast, where we provide you the training and tools you need to pass the CISSP exam the first time. Hi, my name is Sean Gerber and I'm your host for this action-packed, informative podcast. Join me each week as I provide the information you need to pass the CISSP exam and grow your cybersecurity knowledge. All right, let's get started. Let's go cybersecurity knowledge.

Speaker 2: 0:26

All right, let's get started. Good morning it's Sean Gerber with CISSP Cyber Training, and hope you all are having a wonderful day today. Yes, today is CISSP Question Thursday, so that's exciting stuff. We're going to be talking about some awesome CISSP questions related to domain 2.1.1. And that is all a follow-on for our podcast that we had on Monday that goes over the various concepts that we talked about, right? So data classification and so forth. So that is what today's CISSP questions are going to be about.

Speaker 2: 0:59

One thing that we wanted to bring up though obviously we had you try to have something in at the beginning a little bit about, maybe, some news that I saw that I thought was interesting, and especially as it relates to the CISSP, if possible. But this was an interesting article that just came out, as it relates to in the register and it's around. I don't know if you all have heard of a not a company, it's not the right word, but an organization within the US government called DARPA, and DARPA is the US Defense Advanced Research Projects Agency and, to put it in perspective, these guys come up with really cool Gucci stuff. They work with the US Skunk Works and they have like really neat weapons that they develop and some of these weapons actually are brought into the civilian sector not necessarily to destroy and kill people, unfortunately, into the civilian sector. Not necessarily to destroy and kill people, unfortunately, but they are designed in other ways than they advance research projects that get put into the commercial side. Well, I guess, according to a couple of years ago, there was a new agency that was stood up called ARPA-H, and what it is is it's the same thing, it's a very similar concept as DARPA, but it's for the hospital and healthcare industry, and it's an same thing. It's a very similar concept as DARPA, but it's for the hospital and healthcare industry, and it's an interesting piece. They actually have a video interview from the inaugural director, kind of going over looking for technology in the healthcare space to be able to help create more innovative ideas, and so it's really cool in the fact that it's they see ways that it can help with people's, because right now, you see, all the new technology that's coming out is going to be a dramatic impact to the healthcare industry as well. I'd say the one thing that's going to hurt the healthcare industry the most is the bureaucracy of getting stuff through. But because they stood this up, this is going to be an amazing thing. I feel it's going to be really great to help the overall industry as a whole.

Speaker 2: 2:46

Well, what they had they also mentioned the fact is that, as we all know, ransomware has been a huge factor in the healthcare industry for years, and it continues to be a big thing, and, like I mentioned in the podcast a few weeks ago, how it impacted me and my family directly, how it impacted me and my family directly Well, the neat part about this is there's going to be money available for healthcare professionals that want to do more research in this space, and it can help, as it includes cybersecurity, and that's a really neat area in the fact of now there's other ways to help provide some sort of funding and, potentially, some help in regards to correcting issues that deal with ransomware in the healthcare industry as well. So I saw it was kind of an interesting piece of this. So they're only starting off with $50 million, and I say only, I mean right, all of us that would go okay. I just take like 1 million would be amazing. It would totally change my life forever. But $50 million, they're starting off small, but the ultimate goal, though, is that they're trying to figure out different ways to utilize the tech industry in the healthcare aspect. So if you are a researcher and you're studying for your CISSP and you're trying to figure out other ways to help that industry, arpa-h is an option for you and it's an article that was in the register. It basically says this is the title from Rupert Goodwin's take two APIs and call me in the morning. But the ultimate goal is you can kind of dig into it a little bit and figure out what works best for you. It's just. The neat part is that there are more and more options available to you, especially in security. As you can see, this space is just exploding and it's really great that you all are working to get your CISSP, just because, or if you're in the tech industry as a whole, because there is so much opportunity here for you and is in such desperate need for individuals like yourselves that are wanting to get into security to help make a difference.

Speaker 2: 4:42

Okay so, let's roll into our questions for this week. Okay, so, again, as I talked about, you are a become a member of the CISSP Cyber Training Club. You can gain access to all of these questions directly and test your skills on what you know. But if you don't and you want the free content, hey, that is totally fine too, I get it and that is available to you at CISSP Cyber Training. You can actually just watch the videos on the blog or you can go to YouTube and you'll see them eventually at some point in time as well. So those are available to you. But if you want to actually go take the test, cisspcybertrainingcom is the best place to go to get that. And again, we've talked about before these questions are examples of what you may see on the CISSP exam. They are not CISSP questions that somehow, miraculously, I got a hold of yeah, no, they're not that. But they will give you an idea of what you may experience as it relates to the exam. So you're better prepared to deal with it. Well, let's get started.

Speaker 2: 5:39

Question one a company develops a new marketing campaign with catchy slogans and product images. The information is most likely classified as A confidential data, b private data, c sensitive data or D public data. Okay, so this is catchy slogans, product images. What would it be considered from a data classification standpoint? And the answer is C sensitive. Well, the information isn't highly confidential because they didn't say that. Right, catchy slogans and product images may not be something that is that confidential. They would be considered sensitive and you wouldn't necessarily want it all to be out to the public. Now you're probably saying, well, it's going to be released to the public anyway, yes, but what happens is when you add those catchy slogans to those pictures before they are potentially released, that would be sensitive data, obviously. Once they're released to the public, then all bets are off. It doesn't really matter at that point.

Speaker 2: 6:36

Question two you are a security analyst for a health care provider. A new regulation mandates stricter controls for patient social security numbers. Those are SSNs, you may see the abbreviation. These controls would likely fall under the umbrella of A PII, that's, personal identifiable information. B PHI personal health care or health information. C proprietary data or D government classified information. Okay, so social security numbers and you're looking for a health care provider. So that probably would fall under, potentially, the PHI. Now, ssns are typically PII, but they fall under the stricter regulations of HIPAA and health care data. Then this is why it would fall under the PHI. It's a tough one, right? You may want to bite off on the fact that. Well, it's a social security number. The key part is understanding the healthcare provider piece of this.

Speaker 2: 7:32

Question three your company is developing a revolutionary new battery technology. The blueprints and specifications of this technology would be considered what? A? Class zero low impact. B. Class one moderate impact. C. Class two high impact. Class three severe impact. Again, you're developing a revolutionary battery technology. So what would it be? It would be class three severe impact, such as a data breach, would have devastating results on the company's competitive advantage, and so, therefore, it would be a class three.

Speaker 2: 8:08

Question four you are designing a data classification policy for your organization. Which of the following is the least important factor to consider? Again, you're designing this data classification policy for your organization. Which of the following is the least important factor to consider? A regulatory compliance for requirements. B sensitivity of the data. C the ease of implementation for the employees. Or D alignment to the organization's risk tolerance. So now, all of those, obviously, are important, except for C. Right, we want to make these things as easy as possible for our employees, because the more complex you make it, they're just not going to do it. So you want to have some level of ease or comfort in helping deploy these solutions. However, that is the least important factor in the ones that were provided Every one of those other ones are very important, especially with your organization's risk tolerance. This is one thing that I've seen. Companies really need to truly understand what is their risk around IP or data loss.

Speaker 2: 9:14

And it's the thing you have to understand. If you are a business owner and you're dealing with IP, you will lose data. It's a given. It's a matter of not if, but when. The question comes into is how sensitive is that data and how much of that data are you willing to lose? That's what will really drive the fact of. Do you want to put in a DLP product or other type of protection around your intellectual property? Question five a hacker gains access to database containing employee names, email addresses and salary information. This scenario represents a breach of what type of data? A public data, b non-classified, sensitive data. C personally identifiable information or D all of the above? Okay, a database contains names, email addresses and salary information. Which is that of? It? Is D all of the above right Public data, non-classified and personal data. It's all involved in this breach?

Speaker 2: 10:10

Question five If you are an IT manager at a governmental agency, a report details the deployment schedule for a new national security system, this information would be considered or classified as A unclassified, b sensitive but unclassified, c secret or D top secret.

Speaker 2: 10:31

Say you are the IT manager for a government agency. The report details a deployment, a report, a report details the deployment schedule for a new national security system. This information would be would likely be classified as what? And the answer is C secret. Right Now you're probably asking well, what could it be Top secret? It possibly could, but the question is that with this question here, I would default to the lower part. Now, if it mentioned that it was dealing with military secrets or something along those lines, then top secret may be the better option. But you're going to have to. This is the ultimate goal is how are you thinking through this as a manager? It's an IT manager for a government agency. To put it in perspective, it people within the government have pretty much everybody has a secret clearance that especially you deal with any sort of systems within the government. They all, everybody gets secret, where very few people get top secret, and so therefore, if you're looking at a system that's dealing with the US government. Secret is probably the highest level most people will deal with. So unless it got into very specific questions around the military system, then I would err to the fact that it would just be secret, not top secret.

Speaker 2: 11:48

Question seven which of the following security controls is most effective in protecting data at rest? A data loss prevention, b access controls, c encryption or D activity monitoring. So which of the following security controls is most effective most in protecting the data at rest? And the answer is C, obviously, encryption. Right. Encrypted data at rest renders it potentially unreadable, right, without the decryption key. As long as you have. Hey, you've used a good encryption algorithm to do this, but it offers the best protection when you're dealing with data at rest.

Speaker 2: 12:26

Question eight your company uses cloud storage device to store customer credit card information. Which of the following best describes the data ownership and responsibilities in this scenario? So your company uses cloud storage service to store customer credit card information. Which of the following best describes the data ownership and the responsibilities in this scenario? A a cloud service provider owns the data and solely responsible for its security. B your company retains ownership of the data but shares responsibility with the cloud provider C, the customer who provided the credit card information owns the data, and D ownership is irrelevant. Both companies and cloud providers are responsible for security. So those seem pretty good. Right, but we're looking at what best describes the data ownership and responsibilities in this specific scenario.

Speaker 2: 13:21

So a company uses cloud storage to store a customer's credit card information. So the customer gave the credit card over to the purchaser or the vendor. The vendor then put it in the cloud and the cloud stores it, right? Well, you, as a company who provided that service to the from the so basically, the customer gave you their card you provided that information to the cloud you own, you retain the ownership of the data, but you share the responsibility with the cloud provider. You never lose responsibility. The moment you take that data from the customer, you now own it, and so, therefore, if it's breached, it's just as much your fault as the cloud provider's fault as well. You can try to pass the buck and point fingers at them, but at the end of it, let's say, for example, they take the data and they store the data and they do all that they can to protect it, but the breach occurs and you're like well, I didn't do it, I had no control over the data at all. That's true. However, you have the reputational aspects that you'll take a hit on, so you have joint ownership of this Question.

Speaker 2: 14:25

Nine you suspect a data breach has occurred involving employee performance reviews. What is the most important action to take after confirming the breach? You suspect a data breach has occurred involving employee performance reviews. What is the most important action to take after confirming the breach? A Implement a new data encryption protocol. B Terminate the employee responsible for the breach. C notify infected employees of the regulatory bodies, if applicable. And then D conduct a security awareness training for all employees. Okay, so all of those things are probably going to be in factor right, to include, probably most likely terminating the employee who is responsible, depending upon the situation, obviously, but the best or the most important action is to notify the affected employees and the regulatory bodies as soon as you possibly can. So, again, when you're dealing with all of these aspects and you don't want to go and start doing this right away, right, you want to figure out what actually occurred. How did it occur? But there are regulatory timers that are enabled if you get a data breach of some kind right or an incident of some kind. So therefore, it's important that you do notify the employees and the regulatory bodies in the event that that happens and then start going through the laundry list of things you should do to help mitigate the problem even further.

Speaker 2: 15:45

Question 10. A company implements a data classification system with four categories public, internal, confidential and top secret. Okay, so they came up with their own strategy and they got public, internal, confidential and top secret. This classification scheme is most likely used by whom? Okay, a a government agency, b a healthcare provider, c a financial institution or D a retail store chain. And the answer is A a government agency. Now, like we mentioned before, the government agencies typically will follow a certain path. However, they don't have to. They can have their own that they want to use, except, I will say, the top secret piece of this the secret, top secret. If you deal with any sort of secret or top secret information, that labeling is done by itself. Same with unclassified. But if you're going to label top secret, you better be using top secret. You can't just arbitrarily come up with your own idea on that term. So the top secret piece really kind of lends itself to being a government agency.

Speaker 2: 16:49

Question 11, which of the following statements about data classification is most accurate? Okay, again, most accurate All data within the organization should be classified at the same level. B the data classification should be a one-time process upon data creation. C data classification helps organizations prioritize security controls based on impact. And then D publicly available data always requires the least stringent security measures. So question 11 is which of the following statements about data classification is most accurate? And the answer is C data classification helps organization prioritize security controls based on impact. So again you have. You ultimately go as you want to classify the data. You now can understand how do you best protect it if you know that the impact would be substantial and therefore you will then protect it better or put different controls in place to manage its risk.

Speaker 2: 17:46

Question 12, you are a security consultant tasked to improving a company's data security posture and ie, reduce cyber risk. Question 12. You are a security consultant tasked to improving a company's data security posture and ie, reduce cyber risk. Sean Gerber, by the way, I got to throw a plug, got to throw a plug. The current classification system defines sensitive data as any information not publicly available. This approach is a problematic because, okay, so your security consultant asks what's improving company's data security posture.

Speaker 2: 18:09

The current classification system defines sensitive data as an information not publicly available. This approach is problematic because why? A it doesn't consider the potential impact of a data breach. B it creates an overly complex classification schema. C it doesn't differentiate between internal and external use. And. D it provides insufficient guidance for employees. Okay, so their current classification system defines sensitive data as any information not publicly available. Okay, so that's a lot? Right, that's totally a lot. And what ends up happening is it doesn't really consider the potential impact of a data breach, right? So not all non-public data has the same impact. So sensitive data should be further classified based on the potential harm of a breach. So you're going digging deeper into this.

Speaker 2: 19:04

If you say, well, everything is sensitive. Well, okay, so you buy. I'll use an example. I'm trying to find a good example in my head as I sent an email to Bill about the deployment of a F5 load balancer is considered sensitive. Well, I didn't tell him anything about IPs. I didn't tell him anything about the location of where it's going to be in the data center. I just said we have F5 load balancers and when are you going to put those in? That is not as sensitive as okay, well, this is the IP address, this is where it's at, this is so-and-so and so-and-so and so forth, that would be two separate things. And if I want bad guys to try to get in my network and they go well, hey, you've got an F5 load balancer. Well, so what right? I mean I say that loosely because they could figure out ways to potentially pop the box on it, break it open. However, if I'm not given a much more detail other than the fact that it's a load balancer, it's not nearly to the same level of sensitivity as if I told them hey, this one's in the DMZ, this is the IP address, hey, by the way, we have some vulnerabilities with it, but we're not able to patch because X, y and Z. That is much more sensitive than just saying I have a load balancer, all right.

Speaker 2: 20:14

Question 13. A company implements data loss prevention solution to prevent unauthorized data exfiltration. Which of the following data types would DLP be least effective in protecting? Okay, so they're implementing a DLP solution to prevent unauthorized data exfiltration. Which would be the least effective in protecting? A customer credit card information stored electronically. B printed documents containing confidential trade secrets. C employee messages with sensitive company information. Or D. All the above, because they all can be protected with DLP with proper configurations. And the answer is B obviously, printed documents containing confidential trade secrets. Yeah, if they're not digital, dlp is not going to help you a whole lot. Now, if they printed it off and it has a watermark across the front, that would help. I mean, it would help a little, but printed documents have always been a problem for DLP for any sort of electronic data management.

Speaker 2: 21:11

Question 14.

Speaker 2: 21:11

Your company is developing a new mobile map application that collects user geolocation data.

Speaker 2: 21:16

What security considerations are most important when handling this type of data? Okay so, new app collecting user geo data, and what are the most important things when handling this kind of information? A implementing strong access controls and encryption for the data? B obtaining explicit user consent for the data collection and usage? C minimizing the amount of geolocation data collected to what is strictly necessary for the app and for the means, or? D all of the above, they're all important. And the answer is D all of the above, right, they're all very important. When you're dealing with this type of data and obviously you get with Apple or any of these other ones they have to allow the use of it, even though people click through it, and all of these are an important factor when you're dealing with geolocation data. Again, it's very sensitive If I know where Bill is walking and I'm a bad guy or girl and I want to go mug Bill.

Speaker 2: 22:10

Well, now I can follow and track him or her. I saw this in a I'll just kind of a real quick tangent. I know of some very I know of people that have like in the stars and individuals that are more out there. They have ways to track their kids, watch what their kids are doing. Well, this is a good example of how they would do that. All right, the last question, question 15.

Speaker 2: 22:35

A company experiences a data breach involving a database containing customer purchase history and product reviews. The scenario highlights the importance of what. Again, a company experienced a data breach involving a database containing customer purchase history and product reviews. This highlights the importance of what A. Implementing multi-factor for all user accounts. B regularly updating software and patching vulnerabilities. C conducting penetration testing to identify and address security weaknesses. Or. D all of the above security practices as they are important for preventing data breaches. And the answer is D all of the above right Multi-factor is important for all user accounts If you can do it regularly.

Speaker 2: 23:19

Updating software and patching vulnerabilities is extremely important, and conducting pen tests to identify and address security weaknesses is extremely important. And conducting pen tests to identify and address security weaknesses is an important factor. Now, again, we talk about pen tests, though Keep in mind, pen tests are only a point in time and space. They also are very targeted. They are not a broad brush assessment. So pen tests are great, but they're not always the best for every situation. You have to kind of decide which is best for you and your organization is the best for every situation. You have to kind of decide which is best for you and your organization. All right, that is all I have for today.

Speaker 2: 23:48

So, if you like what you heard, go to CISSP Cyber Training, check it out. There's a great information. My blueprint is there. It'll help you pass the CISSP, guaranteed it will. It'll walk you through step by step by step. If you're interested in some consulting services, I've got that available to you as well. Through CISSP Cyber Training I've got. Or through Reduce Cyber Risk, I've got mentoring. Through CISSP Cyber Training, there's mentoring available. I actually mentor quite a few individuals on their cybersecurity programs as well as through helping them grow their cybersecurity businesses and their CISSP as well. So I'm here for you to give you the experience you need. I bring in 20 some years of experience with backgrounds from military to multinational corporations to now consulting, and I can help you. If you need it, I guarantee I can, and if I can't, I can also find you people that will help you with what you need. All right, have a wonderful, wonderful day and we will catch you on the flip side, see ya.