Domain 4.3 & 4.4

Which phase of the asset lifecycle involves ensuring devices are from trusted vendors and free of backdoors?

• Assignment/Accounting

• Monitoring/Tracking

• Acquisition/Procurement

• Disposal/Decommissioning

During which phase of the asset lifecycle should ownership be assigned and data sensitivity classified?

• Disposal/Decommissioning

• Assignment/Accounting

• Monitoring/Tracking

• Acquisition/Procurement

Explain why every phase of the asset lifecycle has security implications. Provide an example for one phase.

• Only the acquisition phase has security implications because of vendor trust.

• Security implications are present in every phase, such as preventing data leakage during disposal.

• Only the monitoring phase is important for security.

• Security is only relevant during assignment/accounting.

A company is planning to dispose of several old computers. What should be their primary security concern during this process?

• Maximizing resale value

• Preventing data leakage from discarded devices

• Upgrading software before disposal

• Assigning new ownership

When acquiring new hardware or software, which of the following is NOT a recommended step in the acquisition/procurement process?

• Source from unverified vendors

• Source from trusted vendors

• Verify integrity (check hashes, digital signatures)

• Ensure compliance with security policies

What is a primary security concern with low-cost IoT devices?

• Counterfeit products may have hidden backdoors

• They are always more energy efficient

• They are guaranteed to be virus-free

• They come with lifetime warranties

Which of the following best describes the role of a responsible owner in asset management?

• Ensures the asset is secure and compliant

• Uses the asset for personal tasks

• Sells the asset when not needed

• Ignores the asset’s security status

What is the main goal of monitoring and asset tracking in an organization?

• Prevent Shadow IT and detect unauthorized devices

• Increase the number of devices on the network

• Reduce the number of employees

• Lower the cost of hardware

Which tool might be used to actively scan a network to discover devices as part of enumeration?

• Nmap

• Microsoft Word

• Photoshop

• Excel

What is Shadow IT?

• Employees using unauthorized tools.

• Employees working overtime.

• IT department managing all software.

• Marketing department using approved tools.