ISC2 CC Practice Test 19 — 15 Questions

Question 1

An organization wants to ensure that an email message has not been altered during transmission. Which security control should be used?

Accepted Answer

Digital signature. Digital signatures provide integrity and non-repudiation by detecting any changes to the message.

Answer

Access control

Answer

Encryption

Answer

Load balancing

Question 2

What is the primary purpose of hashing in information security?

Accepted Answer

To ensure data integrity. Hashing is used to verify data integrity by detecting changes to the data.

Answer

To provide availability

Answer

To encrypt data for confidentiality

Answer

To authenticate users

Question 3

A company is classifying data and wants to ensure that personally identifiable information (PII) receives appropriate protection. Which two of the following are considered PII? (Choose two.)

Accepted Answer

Social Security Number. PII includes any data that can identify an individual. Social Security Number (SSN) and email address are both considered PII because they can be used to identify a person.

Answer

Employee ID number

Answer

Job title

Answer

Department name

Question 4

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Type 2 factors are something you have, such as a physical token.

Answer

Answer

Password

Answer

Fingerprint

Question 5

Which TWO of the following are examples of multi-factor authentication? (Select TWO.)

Accepted Answer

Password and SMS one-time code. MFA requires two or more different factor types. Password (knowledge) + SMS code (possession) and smart card (possession) + fingerprint (inherence) qualify.

Answer

Smart card and RSA token

Answer

Fingerprint and retina scan

Answer

Password and security question

Question 6

A company is implementing risk management for a new project. Which THREE of the following are valid risk treatment options? (Select THREE.)

Accepted Answer

Risk acceptance. Risk treatment options include mitigation, transfer, avoidance, and acceptance. All four are correct, but only three are listed.

Answer

Risk communication

Answer

Risk analysis

Question 7

A security professional is reviewing authentication methods. Which TWO are examples of Type 2 (possession) factors? (Select TWO)

Accepted Answer

A hardware OTP token. Type 2 factors are something you have; a smart card and a hardware token are physical devices.

Answer

A PIN

Answer

A fingerprint

Answer

A password

Question 8

According to the (ISC)² Code of Ethics, which of the following has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics has four canons in order of priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; Advance and protect the profession.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 9

A vulnerability assessment reveals that a legacy system has unpatched software. The organization decides to accept the risk because the system is isolated and has compensating controls. This decision is an example of:

Accepted Answer

Risk acceptance. Risk acceptance is acknowledging the risk and deciding not to mitigate it.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 10

An organization implements redundant servers and failover mechanisms to ensure continuous operation during a power outage. Which goal of the CIA triad is primarily being addressed?

Accepted Answer

Availability. Redundancy and failover ensure systems remain accessible, which supports availability.

Answer

Confidentiality

Answer

Integrity

Answer

Authentication

Question 11

After a data breach, an organization discovers that an attacker exploited a known vulnerability in an outdated web server. The organization had previously identified the vulnerability but decided not to patch it due to potential downtime. Which risk management strategy did the organization employ?

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and its potential impact without taking action to reduce it.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 12

A company experiences a data breach involving personal data of EU residents. Under GDPR, what is the maximum time within which the organization must notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires data controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 13

An organization is re-evaluating its disaster recovery site options. Which TWO of the following describe characteristics of a warm site?

Accepted Answer

It typically provides a Recovery Time Objective (RTO) of several days.. A warm site has partially configured hardware and software, but requires some setup before use. It typically has a longer RTO (days) compared to a hot site (hours). Hot sites mirror production exactly, cold sites are empty, and cloud-based recovery can be quickly spun up.

Answer

It is an empty facility with power and cooling, but no IT equipment installed.

Answer

It is a fully operational duplicate of the primary site, ready to take over within hours.

Answer

It uses virtual machines in the cloud that can be spun up on demand.

Question 14

During a data breach incident, the incident response team discovers that personally identifiable information (PII) of European Union residents was compromised. According to GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 15

A company is creating a backup strategy for its critical database. The database is updated continuously, and the company can tolerate up to 2 hours of data loss. Which TWO backup methods would best help achieve a recovery point objective (RPO) of 2 hours? (Select TWO.)

Accepted Answer

Hourly full backups. To achieve an RPO of 2 hours, backups must be taken at least every 2 hours. Hourly full backups or transaction log backups (which capture changes frequently) can meet this RPO. Daily full backups alone would cause up to 24 hours of loss.

Answer

Monthly full backups

Answer

Weekly full backups

Answer

Daily full backups