ISC2 CC Security Principles — 30 Questions

Question 1

A security team decides to implement multi-factor authentication for all remote access. Which combination of factors would constitute multi-factor authentication?

Accepted Answer

Smart card and fingerprint scan. Multi-factor authentication requires two or more different types of factors (knowledge, possession, inherence). The correct answer, 'Smart card and fingerprint scan', uses a possession factor (smart card) and an inherence factor (fingerprint), which are different factor types, thus satisfying the requirement for MFA.

Answer

Fingerprint scan and retina scan

Answer

Two different passwords

Answer

Password and PIN

Question 2

An organization wants to implement multi-factor authentication (MFA) for remote access. Which two types of authentication factors would meet the definition of MFA? (Choose two.)

Accepted Answer

Password. Multi-factor authentication requires at least two different types of factors. A password is Type 1 (knowledge) and a smart card is Type 2 (possession), so combining them qualifies as MFA.

Answer

Retina scan

Answer

Fingerprint scan

Answer

OTP token

Question 3

Which principle of the CIA triad ensures that data is not disclosed to unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality is the principle that prevents unauthorized disclosure of information.

Answer

Authentication

Answer

Integrity

Answer

Availability

Question 4

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Type 2 authentication is based on possession, such as a smart card.

Answer

Answer

Password

Answer

Fingerprint

Question 5

An organization implements redundant servers and failover mechanisms to ensure continuous operation during a power outage. Which goal of the CIA triad is primarily being addressed?

Accepted Answer

Availability. Redundancy and failover ensure systems remain accessible, which supports availability.

Answer

Confidentiality

Answer

Integrity

Answer

Authentication

Question 6

According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?

Accepted Answer

Protect society. The Code of Ethics prioritizes protecting society, the common good, and the public trust.

Answer

Advance the profession

Answer

Act honourably

Answer

Provide diligent service

Question 7

A security analyst is reviewing a log that shows an unauthorized user attempted to modify a payroll database. Which security principle is most directly threatened?

Accepted Answer

Integrity. Unauthorized modification threatens integrity.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 8

A company is evaluating a new cloud service provider. As part of due diligence, they review the provider's security certifications, conduct a site visit, and check references. This process is an example of which risk management strategy?

Accepted Answer

Due diligence. Due diligence involves investigating before taking action to identify and assess risks.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 9

Which of the following is classified as sensitive PII?

Accepted Answer

Medical records. Sensitive PII includes medical records, financial data, and biometrics.

Answer

Email address

Answer

Telephone number

Answer

Date of birth

Question 10

Which risk management strategy involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Risk mitigation. Risk mitigation applies controls to reduce risk.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 11

A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?

Accepted Answer

Digital signature. Digital signatures provide integrity and non-repudiation.

Answer

Symmetric encryption

Answer

Access control list

Answer

Hashing

Question 12

An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?

Accepted Answer

Multi-factor. Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.

Answer

Possession-based

Answer

Biometric

Answer

Single-factor

Question 13

A vulnerability assessment reveals that a legacy system has unpatched software. The organization decides to accept the risk because the system is isolated and has compensating controls. This decision is an example of:

Accepted Answer

Risk acceptance. Risk acceptance is acknowledging the risk and deciding not to mitigate it.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 14

Which of the following best describes the difference between due care and due diligence in security governance?

Accepted Answer

Due care is the minimum standard of care; due diligence is the investigation and assessment. Due care is implementing basic security; due diligence is investigating and assessing risks.

Answer

Due care is proactive, due diligence is reactive

Answer

They are synonymous

Answer

Due care applies to vendors; due diligence applies to employees

Question 15

A security analyst is evaluating controls to protect the confidentiality of customer data. Which TWO of the following are effective controls? (Select TWO).

Accepted Answer

Encryption of data at rest. Encryption protects data at rest and in transit; access controls restrict unauthorized access.

Answer

Hashing of passwords

Answer

Redundant network links

Answer

Regular data backups

Question 16

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Restricted data includes trade secrets, classified government info, and biometric data.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 17

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication relies on biometric characteristics.

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 18

A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?

Accepted Answer

Integrity. File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 19

A company is deploying a multi-factor authentication (MFA) solution. Which combination represents two different authentication factors?

Accepted Answer

Smart card and PIN. MFA requires two or more different types: something you know (password), something you have (OTP token), and something you are (fingerprint).

Answer

Password and security question

Answer

OTP token and mobile authenticator app

Answer

Fingerprint and retina scan

Question 20

An organization decides to accept the risk of using a legacy system that cannot be patched due to critical business operations. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate, transfer, or avoid it.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation