CISSP Domain 2 practice questions
Asset Security
Asset Security is about knowing what you have, who is accountable for it, and how it is protected across its life cycle. Questions centre on classification, data roles, retention and secure disposal. The key is matching responsibility to the right role — owners decide, custodians implement.
Sample Domain 2 questions
Who is ultimately responsible for determining the classification level of a customer database?
An organisation is retiring laptops with self-encrypting SSDs that held confidential data. Devices will be resold. Which method BEST balances assurance and reuse?
During litigation, legal counsel issues a hold on email relating to a contract dispute. The normal retention policy would delete these messages next week. What should happen?
Common Domain 2 traps
- Treating the custodian as the person who decides classification (that is the owner).
- Choosing degaussing for SSDs — it does not work on flash media.
- Forgetting that classification should drive handling, not the other way round.
Key concepts to master
- Data owner, custodian, steward, processor and controller
- Classification and labelling schemes
- Data states: at rest, in transit, in use
- Retention, archiving and legal hold
- Sanitisation: clearing, purging, destruction; media types
Need the theory first? Read the CISSP Domain 2 study guide.
Find out where you stand
Start with the free 10-question CISSP practice test — no signup. Then create a free account for Practice Mode, or go Pro for Domain Quick-Fire, CAT-style adaptive exams and readiness analytics.