CISSP Practice Question (Domain 2: Asset Security / Data Governance)

An enterprise deploys agentic AI systems that autonomously collect data from internal systems and external sources to answer executive queries. Over time, agents begin retaining intermediate data and derived insights to improve future performance. Legal cannot determine what regulated data is being stored or reused. Leadership wants minimal friction.

What is the MOST appropriate action to take FIRST?

A. Encrypt all agent retained data using enterprise key management

B. Perform a data inventory and classification of agent memory and outputs

C. Restrict agents to real time queries with no local persistence

D. Update contracts with AI vendors to address derived data ownership

Come back for the answer tomorrow, or study more now!

16 comments