ISC2 CC Practice Test 18 — 15 Questions

Question 1

A security analyst is implementing a solution to ensure that data transmitted between two servers cannot be read by unauthorized parties. Which security principle is the analyst primarily addressing?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals or systems. Encryption is a key mechanism to protect confidentiality of data in transit.

Answer

Integrity

Answer

Availability

Answer

Authentication

Question 2

According to the (ISC)² Code of Ethics, if a conflict arises between protecting society and providing diligent service to your employer, which should take precedence?

Accepted Answer

Protect society. The (ISC)² Code of Ethics has a priority order: protect society first, then act honorably, provide diligent service, and advance the profession.

Answer

Advance the profession

Answer

Act honorably

Answer

Provide diligent service

Question 3

Which of the following is a control that can reduce the risk of a DDoS attack?

Accepted Answer

Load balancing. Load balancers can distribute traffic and absorb some DDoS attacks; DDoS protection services are also common controls.

Answer

Access control lists

Answer

Encryption

Answer

Digital signatures

Question 4

A security analyst is evaluating controls to protect the confidentiality of customer data. Which TWO of the following are effective controls? (Select TWO).

Accepted Answer

Encryption of data at rest. Encryption protects data at rest and in transit; access controls restrict unauthorized access.

Answer

Hashing of passwords

Answer

Redundant network links

Answer

Regular data backups

Question 5

An organization is evaluating a new vendor that will process customer data. The security team performs a thorough assessment of the vendor's security controls and background checks. This process best demonstrates:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before making a decision, such as vendor risk assessments and background checks.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Due care

Question 6

Which principle of the CIA triad ensures that data is not disclosed to unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality is the principle that prevents unauthorized disclosure of information.

Answer

Authentication

Answer

Integrity

Answer

Availability

Question 7

Refer to the exhibit. An administrator notices that external access to the MySQL database (port 3306) is blocked, but internal access should be allowed. What change should be made?

Accepted Answer

Create a rule to allow traffic from internal IP range to port 3306. The exhibit shows a DROP rule for port 3306 in the INPUT chain, which blocks all incoming traffic to the MySQL database. To allow internal access while keeping external access blocked, a specific rule must be added to ACCEPT traffic from the internal IP range to port 3306, placed before the DROP rule. This ensures that internal packets are matched first and permitted, while external packets hit the DROP rule and are rejected. Simply modifying or removing the DROP rule would allow all traffic, violating the requirement to block external access.

Answer

Change the DROP rule to ACCEPT for port 3306

Answer

Allow port 3306 in the FORWARD chain

Answer

Remove the DROP rule for port 3306

Question 8

Which of the following controls is primarily designed to ensure availability?

Accepted Answer

Redundant servers. Redundancy (e.g., backup servers, failover) ensures systems remain available even if one component fails.

Answer

Encryption

Answer

Digital signatures

Answer

Access control lists

Question 9

An organization is conducting a risk assessment. Which THREE of the following are considered assets? (Select THREE)

Accepted Answer

Customer database. Assets are items of value to the organization, including data, hardware, and personnel.

Answer

Probability of a data breach

Answer

Vulnerability in software

Question 10

A security analyst is designing a multi-factor authentication system for remote access. Which TWO of the following combinations represent true multi-factor authentication? (Select TWO)

Accepted Answer

Fingerprint and password. Multi-factor requires at least two different types. A password (Type 1) and smart card (Type 2) are different factors. A fingerprint (Type 3) and password (Type 1) are also different factors.

Answer

Smart card and OTP token

Answer

Fingerprint and retina scan

Answer

Password and PIN

Question 11

Which of the following best describes the difference between due care and due diligence in security governance?

Accepted Answer

Due care is the minimum standard of care; due diligence is the investigation and assessment. Due care is implementing basic security; due diligence is investigating and assessing risks.

Answer

Due care is proactive, due diligence is reactive

Answer

They are synonymous

Answer

Due care applies to vendors; due diligence applies to employees

Question 12

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Type 2 authentication is based on possession, such as a smart card.

Answer

Answer

Password

Answer

Fingerprint

Question 13

Which of the following is an example of a Type 1 authentication factor?

Accepted Answer

PIN code. Type 1 is knowledge-based, such as a password.

Answer

One-time password (OTP) token

Answer

Smart card

Answer

Fingerprint scan

Question 14

A company stores customer records that include names, addresses, and Social Security numbers. According to ISC2 Code of Ethics, which canon has the highest priority when handling this sensitive data?

Accepted Answer

Protect society, the common good, and the public trust. The Code of Ethics prioritizes: Protect society, the common good, and the public trust first.

Answer

Act honorably, honestly, justly, and responsibly

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Question 15

An organization labels data as 'Confidential' and requires encryption both at rest and in transit. This classification is an example of:

Accepted Answer

Data classification. Data classification labels (e.g., Confidential) define handling requirements, such as encryption, to protect the data.

Answer

Risk transfer

Answer

Due care

Answer

Data retention