ISC2 CC Security Principles — 25 Questions

Question 1

An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?

Accepted Answer

Multi-factor. Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.

Answer

Possession-based

Answer

Biometric

Answer

Single-factor

Question 2

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Authentication factors fall into three types: Type 1 is something you know (password, PIN), Type 2 is something you have (smart card, token, phone), and Type 3 is something you are (biometrics). A smart card is a physical device the user possesses, making it a Type 2 factor.

Answer

Answer

Password

Answer

Fingerprint

Question 3

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

A security token generating a one-time passcode. A security token generating a one-time passcode is a Type 2 authentication factor because it relies on something you have—a physical or software token that produces a changing code. Type 2 factors are possession-based, distinct from knowledge (Type 1) and inherence (Type 3). The token must be in the user's possession to generate the correct OTP.

Answer

A fingerprint

Answer

A password

Answer

A PIN

Question 4

Which of the following is an example of Type 2 (possession) authentication?

Accepted Answer

Smart card. Type 2 authentication, also known as possession-based authentication, relies on something the user possesses, such as a physical token or device. A smart card is a classic example because it is a physical item that the user must have in their possession to authenticate. The smart card typically contains a certificate or cryptographic key that is validated by a reader.

Answer

Answer

Password

Answer

Fingerprint scan

Question 5

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 6

An organization is developing a data classification policy. Which THREE of the following are common classification levels?

Accepted Answer

Confidential. Public, confidential, and restricted are typical classification levels.

Answer

Critical

Answer

Sensitive

Question 7

An organization requires employees to enter a password and then approve a push notification on their mobile device to access the corporate network. What type of authentication is this?

Accepted Answer

Two-factor authentication. This is two-factor authentication because it combines two different authentication factors: something you know (the password) and something you have (the mobile device receiving the push notification). Two-factor authentication requires exactly two distinct factor types, and password + push approval satisfies that definition. It is not multi-factor in the sense of three or more factors, and it is not single-factor or biometric.

Answer

Biometric authentication

Answer

Multi-layer authentication

Answer

Single-factor authentication

Question 8

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — always takes precedence over the others. This ordering means that when canons conflict, the safety and trust of society outweigh obligations to principals, professional conduct, or the profession itself. Candidates must memorize this hierarchy because exam questions frequently test the relative priority of the canons.

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 9

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited. A vulnerability is a weakness that can be exploited by a threat to cause harm.

Answer

A potential cause of an unwanted incident

Answer

The likelihood of a threat exploiting a weakness

Answer

A measure that reduces risk

Question 10

What is the primary purpose of a digital signature?

Accepted Answer

Provide non-repudiation and integrity. A digital signature uses asymmetric cryptography to provide non-repudiation (the signer cannot deny signing) and integrity (any modification invalidates the signature). The signer's private key creates the signature, and anyone with the public key can verify it, proving both origin and that the message was not altered. Confidentiality is not a goal of digital signatures — that requires encryption.

Answer

Ensure confidentiality

Answer

Authenticate users via password

Answer

Encrypt the data

Question 11

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

One-time passcode from a hardware token. Type 2 (possession) factors include something the user has, such as a smart card, OTP token, or mobile authenticator app.

Answer

Fingerprint scan

Answer

Password

Answer

Question 12

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?

Accepted Answer

Financial account numbers. Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.

Answer

Phone number

Answer

Name and email address

Question 13

A company is classifying data and wants to ensure that personally identifiable information (PII) receives appropriate protection. Which two of the following are considered PII? (Choose two.)

Accepted Answer

Social Security Number. A Social Security Number (A) is a classic example of PII because it is a unique government-issued identifier that can be used to trace or identify a specific individual, so it must be protected. An email address (B) is also PII since it directly identifies a person (e.g., name@domain.com) and can be used to contact or locate them, and it is often combined with other personal data. By contrast, an Employee ID number (C) is typically an internal, organization-specific identifier that is not inherently tied to a person outside the company, so it is generally not considered PII on its own. A Job title (D) and a Department name (E) describe a role or organizational unit rather than an individual, so they are not PII.

Answer

Employee ID number

Answer

Job title

Answer

Department name

Question 14

A financial institution is implementing data classification to protect customer information. They have identified data that includes medical records and financial account numbers. Which three labels are most appropriate for this data? (Choose three.)

Accepted Answer

Restricted. The data described—medical records and financial account numbers—is highly sensitive personal and financial information, so labels indicating the highest protection levels are appropriate. Option A (Restricted) is correct because restricted is typically the highest classification tier, reserved for data whose unauthorized disclosure causes severe harm, such as medical or financial records. Option B (Sensitive) is correct because sensitive data classification covers personally identifiable information (PII) and protected health information (PHI) that require strong safeguards. Option C (Confidential) is correct because confidential is a common classification for private customer information, including account numbers and health data, limiting access to authorized personnel. Option D (Internal) is not appropriate because internal data is only meant for employees and does not imply the strict regulatory and privacy protections required for medical and financial records. Option E (Public) is not appropriate because public data is freely shareable and would expose protected customer information, violating privacy regulations such as HIPAA and GLBA.

Answer

Internal

Answer

Public

Question 15

A small business owner implements a policy that requires all employees to lock their computers when leaving their desks. This policy is primarily an example of which type of control?

Accepted Answer

Technical control. Locking a computer screen is a technical control because it uses a software feature to enforce access restrictions. Technical controls are implemented through technology and include mechanisms like passwords, encryption, and screen locks. While the policy requiring it is administrative, the actual control mechanism is technical, as it operates within the operating system to prevent unauthorized access.

Answer

Physical control

Answer

Compensating control

Answer

Administrative control

Question 16

A hospital's IT director must select an access control model for the electronic health records system. Clinicians need access to patient records only when actively treating those patients, and the hospital wants to enforce least privilege with the least administrative overhead. Which access control model BEST meets these requirements?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control is designed to simplify administration by grouping permissions into roles that correspond to job functions. Clinicians are assigned roles, and access is granted based on those roles, which enforces least privilege and reduces the overhead of managing individual permissions. While other models offer granular control, they either impose heavy administrative burdens or lack the centralized structure needed for consistent enforcement in a hospital setting.

Answer

Rule-Based Access Control (RuBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 17

A financial services firm wants to implement a defense-in-depth strategy for its online banking platform. The security architect proposes several controls. Which of the following controls is an example of a preventive physical control?

Accepted Answer

Security guards stationed at the data center entrance. Preventive physical controls are measures that physically stop or deter unauthorized access. Security guards are a classic example: they can challenge and deny entry to unauthorized individuals, providing a human preventive barrier. While biometric locks also prevent access, they are often classified as technical controls that include physical components. The scenario specifically asks for a preventive physical control, and guards fit that category most directly.

Answer

Security cameras recording the server room

Answer

Biometric locks on the data center door

Answer

Fire suppression system in the data center

Question 18

A security officer is classifying the controls protecting a new customer portal. She must identify controls that are administrative in nature rather than technical or physical. Which TWO of the following are administrative controls? (Choose two.)

Accepted Answer

A security awareness training programme delivered quarterly. Administrative controls are management-directed rules, procedures, and training that shape how people behave. A signed acceptable use policy and recurring security awareness training both operate through governance and education rather than technology or physical barriers, so they satisfy the requirement. The firewall is technical, the biometric reader is physical, and the vacation policy, while managerial, is not part of the intended pair for this classification task.

Answer

A web application firewall filtering portal traffic

Answer

Biometric readers controlling the data centre door

Answer

Mandatory vacation policy for privileged administrators

Question 19

A security manager is analyzing a risk scenario where a threat actor could exploit a known software flaw to cause a denial of service. The manager estimates that the likelihood of exploitation is high and the impact would be severe. Which term best describes the combination of the software flaw and the threat actor's potential to exploit it?

Accepted Answer

Vulnerability. A vulnerability is a weakness in an asset that can be exploited by a threat. The software flaw is the vulnerability, and the threat actor's potential to exploit it underscores the risk. While risk is the combination of threat, vulnerability, and impact, the question specifically asks for the combination of the flaw and the actor's potential, which is the vulnerability itself. Threat is the actor, exploit is the method, and risk is the broader potential for loss.

Answer

Risk

Answer

Threat

Answer

Exploit

Question 20

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password immediately due to a security breach. The employee suspects it is a phishing attempt. Which principle of security awareness is MOST relevant to this situation?

Accepted Answer

Due diligence. Due diligence is the principle of exercising reasonable care and caution. In the context of phishing, it means not automatically trusting unsolicited emails and instead verifying their legitimacy through separate channels. The employee's suspicion reflects due diligence, which is a key security principle in the CC exam. While confidentiality, integrity, and availability are core goals, due diligence is the proactive behavior that helps prevent breaches.

Answer

Confidentiality

Answer

Integrity

Answer

Availability