ISC2 CC Security Principles — 10 Questions

Question 1

An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?

Accepted Answer

Multi-factor. Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.

Answer

Possession-based

Answer

Biometric

Answer

Single-factor

Question 2

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Authentication factors fall into three types: Type 1 is something you know (password, PIN), Type 2 is something you have (smart card, token, phone), and Type 3 is something you are (biometrics). A smart card is a physical device the user possesses, making it a Type 2 factor.

Answer

Answer

Password

Answer

Fingerprint

Question 3

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

A security token generating a one-time passcode. A security token generating a one-time passcode is a Type 2 authentication factor because it relies on something you have—a physical or software token that produces a changing code. Type 2 factors are possession-based, distinct from knowledge (Type 1) and inherence (Type 3). The token must be in the user's possession to generate the correct OTP.

Answer

A fingerprint

Answer

A password

Answer

A PIN

Question 4

Which of the following is an example of Type 2 (possession) authentication?

Accepted Answer

Smart card. Type 2 authentication, also known as possession-based authentication, relies on something the user possesses, such as a physical token or device. A smart card is a classic example because it is a physical item that the user must have in their possession to authenticate. The smart card typically contains a certificate or cryptographic key that is validated by a reader.

Answer

Answer

Password

Answer

Fingerprint scan

Question 5

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 6

An organization is developing a data classification policy. Which THREE of the following are common classification levels?

Accepted Answer

Confidential. Public, confidential, and restricted are typical classification levels.

Answer

Critical

Answer

Sensitive

Question 7

An organization requires employees to enter a password and then approve a push notification on their mobile device to access the corporate network. What type of authentication is this?

Accepted Answer

Two-factor authentication. This is two-factor authentication because it combines two different authentication factors: something you know (the password) and something you have (the mobile device receiving the push notification). Two-factor authentication requires exactly two distinct factor types, and password + push approval satisfies that definition. It is not multi-factor in the sense of three or more factors, and it is not single-factor or biometric.

Answer

Biometric authentication

Answer

Multi-layer authentication

Answer

Single-factor authentication

Question 8

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — always takes precedence over the others. This ordering means that when canons conflict, the safety and trust of society outweigh obligations to principals, professional conduct, or the profession itself. Candidates must memorize this hierarchy because exam questions frequently test the relative priority of the canons.

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 9

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited. A vulnerability is a weakness that can be exploited by a threat to cause harm.

Answer

A potential cause of an unwanted incident

Answer

The likelihood of a threat exploiting a weakness

Answer

A measure that reduces risk

Question 10

What is the primary purpose of a digital signature?

Accepted Answer

Provide non-repudiation and integrity. A digital signature uses asymmetric cryptography to provide non-repudiation (the signer cannot deny signing) and integrity (any modification invalidates the signature). The signer's private key creates the signature, and anyone with the public key can verify it, proving both origin and that the message was not altered. Confidentiality is not a goal of digital signatures — that requires encryption.

Answer

Ensure confidentiality

Answer

Authenticate users via password

Answer

Encrypt the data