CISSP Official Practice Tests by Mike Chapple, David Seidl

Chapter 2 ■ Asset Security (Domain 2) 47

For questions 86–88, please refer to the following scenario:

As shown in the following security lifecycle diagram (loosely based on the NIST reference

architecture), NIST uses a five-step process for risk management. Using your knowledge

of data roles and practices, answer the following questions based on the NIST framework

process.

Step 2

Select Security

Controls

Step 1

Categorize

Systems and Data

Step 5

Monitor Security

Step 4

Assess Security

Controls

Step 3

Implement Security

Controls

86. What data role will own responsibility for step 1, the categorization of information sys-
    tems; to whom will they delegate step 2; and what data role will be responsible for step 3?
    A. Data owners, system owners, custodians
    B. Data processors, custodians, users
    C. Business owners, administrators, custodians
    D. System owners, business owners, administrators

8 7. If the systems that are being assessed all handle credit card information (and no other sen-
sitive data), at what step would the PCI DSS first play an important role?
A. Step 1
B. Step 2
C. Step 3
D. Step 4

88. What data security role is primarily responsible for step 5?

A. Data owners

B. Data processors

C. Custodians

D. Users