PRIMARY purpose = decide the level of protection (sensitivity is what you measure, not why you classify). Classify at creation. The owner classifies and reviews periodically.
Roles
Owner = accountable, classifies, approves access · Custodian = implements (backups, permissions) · Steward = data quality and metadata · Controller = decides purpose and means (GDPR) · Processor = acts on the controller’s behalf · Subject = the person the data is about.
Government levels
Top Secret → Secret → Confidential → (Sensitive but) Unclassified.
Try each question before opening the answer. The full bank has many more Domain 2 questions with filters and progress tracking.
Question 1 · FIRST
A new customer database containing personal information has just been created. Which of the following should happen FIRST?
Configure DLP rules for the data
Encrypt the database at rest
Define the archival and retention schedule
Have the data owner classify the data
Show answer & explanation
Answer: D — Have the data owner classify the data
Data lifecycle: CREATE → Store → Use → Share → Archive → Destroy. Classify at creation, because classification drives protection: encryption, DLP and retention all depend on it.
Question 2 · NEXT
Legal counsel has just placed a litigation hold on the mailboxes of five executives. What should the e-discovery team do NEXT?
Collect the preserved data into a central review repository
Delete duplicate emails to reduce storage costs
Produce the documents to opposing counsel
Identify which employees may hold relevant information
Show answer & explanation
Answer: A — Collect the preserved data into a central review repository
EDRM: Identify → Preserve (legal hold) → Collect → Process → Review → Analyze → Produce → Present. Identification is already done (holds were placed), and production comes much later. Deleting anything under hold is spoliation.
Question 3 · LEAST
Which data protection technique LEAST reduces the risk if a test database copied from production is stolen?
Masking national ID numbers in the test data set
Restricting the test database to a separate VLAN
Replacing real customer names with realistic synthetic data
Tokenising card numbers before the copy is made
Show answer & explanation
Answer: B — Restricting the test database to a separate VLAN
Once data is stolen, network placement no longer protects it. Synthetic data, tokenisation and masking remove or alter the sensitive values themselves, so stolen copies have little value.
Question 4 · NOT
Which of the following is NOT a responsibility of a data custodian?
Deciding the classification level of the data
Maintaining the systems that store the data
Implementing the access permissions approved by the owner
Performing and testing regular backups of the data
Show answer & explanation
Answer: A — Deciding the classification level of the data
The data owner decides classification and approves access. The custodian implements those decisions day to day: backups, permissions and system maintenance.
Question 5 · BEST
A company is selling its old laptops, which contain SSDs, to an outside reseller. What is the BEST way to sanitize the drives while keeping them usable for resale?
Delete files and empty the recycle bin
Incinerate the drives
Perform a cryptographic erase
Degauss the drives
Show answer & explanation
Answer: C — Perform a cryptographic erase
Resale = the drive must stay usable → purge via cryptographic erase. Degaussing doesn't work on SSDs, incineration destroys resale value, and deleting files leaves remanence.
Question 6 · PRIMARY
A data owner has completed classifying a new set of customer records. What is the PRIMARY reason this classification was performed?
To determine the level of protection the records require
To determine the sensitivity of the records
To assign a data custodian
To label the records for storage systems
Show answer & explanation
Answer: A — To determine the level of protection the records require
Means vs end: sensitivity is what you MEASURE; the PURPOSE of classification is deciding the protection level.
Question 7 · MOST
An asset manager must assign a classification to a server before deploying it. Which factors should MOST directly determine the hardware asset's classification?
The vendor's brand reputation in the latest analyst market report
The sensitivity of data processed, function criticality, and regulatory scope
The physical color and rack-unit height of the device in the cabinet
The retail purchase price and the warranty term of the chassis
Show answer & explanation
Answer: B — The sensitivity of data processed, function criticality, and regulatory scope
Hardware inherits its classification from the sensitivity of data it handles, how critical its function is, and any regulatory scope such as PCI it falls under. Purchase price, physical color and size, and vendor reputation describe procurement or aesthetics and do not reflect the protection the asset's role and data actually require.
Question 8
A database administrator performs nightly backups and maintains access controls on a payroll database as directed by the finance director. What is the DBA's role?
Data steward
Data owner
Data controller
Data custodian
Show answer & explanation
Answer: D — Data custodian
Implements controls (backups, access) as the owner directs = custodian. The finance director is the owner (accountable).
Question 9 · FIRST
A newly appointed data governance lead finds that nobody knows which systems hold personal data. What should be done FIRST?
Deploy DLP to block all outbound personal data immediately
Create an inventory of data assets with their owners and locations
Encrypt all databases in the organisation
Classify every file share as Confidential until reviewed
Show answer & explanation
Answer: B — Create an inventory of data assets with their owners and locations
You cannot classify, protect or monitor data you have not identified. An inventory with owners is the foundation for classification, DLP rules and encryption decisions.
Question 10 · LEAST
A company is retiring SSDs that held confidential data and will donate the laptops to a school. Which sanitisation method is LEAST appropriate?
Cryptographic erase using the drive's built-in encryption
Removing and physically destroying the SSDs
Vendor secure-erase command verified by sampling
Degaussing the SSDs
Show answer & explanation
Answer: D — Degaussing the SSDs
SSDs store data in flash memory, not magnetic media, so degaussing does not remove data. Crypto-erase and verified secure-erase are suitable when the device is reused; destruction is the strongest option.
Ready for the full bank?
2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.
