CISSP - Security Operations - Section 7.5

Apply resource protection including media management and media protection techniques.

Apply resource protection practices covering media management, media protection techniques, and secure storage of sensitive assets. Recognise when physical media requires additional controls - such as locked storage, transport encryption, or tracked inventory - based on the sensitivity of the data it holds.

media managementmedia protectionsecure storageasset protection

Practice question for this objective

Free sampleSecurity Operationseasy

A hospital stores nightly backup tapes of patient records in a fire-rated cabinet in the same data centre that hosts the production servers. During a tabletop exercise, the CISO is asked to recommend the BEST improvement to the media protection strategy. Which option should the CISO recommend?

  • AReplace the magnetic tapes with higher-capacity LTO cartridges to extend retention.
  • BAdd a second fire-rated cabinet in the same data centre and split the tapes between them.
  • CMove a copy of the backup tapes to a secure offsite storage facility with environmental controls. Correct
  • DIncrease the frequency of backups from nightly to every six hours.
Apply the principle that backup media must be protected against site-level events through secure offsite storage. Resource protection requires that backup media be stored separately from the systems they protect so that a single fire, flood, or physical compromise cannot destroy both the production data and its only recovery copy.

Why A is wrong: Upgrading the tape format improves capacity and read speed, but it does not address the underlying risk that production data and backups can be destroyed by the same site-level event.

Why B is wrong: Two cabinets in the same room still share fire, flood, and physical-access threats, so the control reduces the likelihood of cabinet failure but not the dominant site-level risk.

Why C is correct: Storing a copy of backup media offsite in a secure, environmentally controlled facility protects against a single disaster destroying both production data and its only backup, which is the core principle of media protection for recovery.

Why D is wrong: More frequent backups improve the recovery point objective, but creating more tapes in the same vulnerable location does not protect the media from a site-wide loss.

See more CISSP practice questions with worked answers.

More in this domain

Back to all Security Operations objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.