ISC2 CC Practice Test 17 — 15 Questions

Question 1

A company uses redundant servers and automated failover to ensure that its website remains accessible during a server outage. Which principle of the CIA triad is being addressed?

Accepted Answer

Availability. Redundancy and failover ensure that authorized users can access systems when needed, which is availability.

Answer

Non-repudiation

Answer

Integrity

Answer

Confidentiality

Question 2

A company performs background checks on potential employees before hiring. This action demonstrates which concept?

Accepted Answer

Due diligence. Due diligence involves investigating before acting, such as background checks.

Answer

Risk avoidance

Answer

Due care

Answer

Risk transfer

Question 3

A company is evaluating a new cloud service provider. As part of due diligence, they review the provider's security certifications, conduct a site visit, and check references. This process is an example of which risk management strategy?

Accepted Answer

Due diligence. Due diligence involves investigating before taking action to identify and assess risks.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 4

An organization uses a digital signature to verify the authenticity of a software update. This supports which part of the CIA triad?

Accepted Answer

Integrity. Digital signatures verify integrity and authenticity.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 5

Which of the following is an example of Type 2 authentication?

Accepted Answer

Smart card. Type 2 authentication relies on something the user possesses, such as a smart card or token.

Answer

Fingerprint scan

Answer

Password

Answer

Question 6

A security administrator is configuring a system to detect unauthorized changes to critical files by calculating and storing a hash value for each file. Which security goal is primarily supported?

Accepted Answer

Integrity. Hashing ensures that any modification to the file can be detected, supporting integrity.

Answer

Authentication

Answer

Confidentiality

Answer

Availability

Question 7

An organization decides to accept the risk of using an older software version known to have vulnerabilities because the cost of upgrading outweighs the potential impact. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation

Question 8

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication relies on biometric characteristics.

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 9

A security analyst is implementing controls to prevent unauthorized disclosure of sensitive information. Which element of the CIA triad is being addressed?

Accepted Answer

Confidentiality. Preventing unauthorized disclosure directly relates to confidentiality.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 10

A company stores customer PII including social security numbers and medical records. Under privacy principles, these data elements are best described as:

Accepted Answer

Sensitive PII. Medical records and SSNs are examples of sensitive PII that require additional protection.

Answer

Confidential data

Answer

Internal data

Answer

Public data

Question 11

An organization wants to ensure the integrity of a software update before deployment. Which two methods can be used to verify integrity? (Choose two.)

Accepted Answer

Digital signature. Integrity ensures data has not been altered. Hashing produces a digest that can be compared to verify the file has not changed. Digital signatures use asymmetric cryptography to verify authenticity and integrity. Encryption provides confidentiality, not integrity. Access controls limit who can modify data but do not verify integrity after the fact. Redundancy supports availability.

Answer

Encryption

Answer

Redundant servers

Answer

Access control lists

Question 12

A security analyst is reviewing a log that shows an unauthorized user attempted to modify a payroll database. Which security principle is most directly threatened?

Accepted Answer

Integrity. Unauthorized modification threatens integrity.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 13

During a vendor risk assessment, a company discovers that a potential vendor has poor security practices. The company decides not to hire the vendor. This is an example of:

Accepted Answer

Risk avoidance. Risk avoidance involves eliminating the risk by not engaging in the activity.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 14

According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?

Accepted Answer

Protect society. The Code of Ethics prioritizes protecting society, the common good, and the public trust.

Answer

Advance the profession

Answer

Act honourably

Answer

Provide diligent service

Question 15

Which of the following is considered Sensitive PII?

Accepted Answer

Social Security Number. Sensitive PII includes information that could cause harm if disclosed, such as medical records, financial account numbers, and biometric data.

Answer

Email address

Answer

Phone number

Answer

Name