ISC2 CC Security Principles Practice Test 1 — 15 Questions

Question 1

An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?

Accepted Answer

Multi-factor. Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.

Answer

Possession-based

Answer

Biometric

Answer

Single-factor

Question 2

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Authentication factors fall into three types: Type 1 is something you know (password, PIN), Type 2 is something you have (smart card, token, phone), and Type 3 is something you are (biometrics). A smart card is a physical device the user possesses, making it a Type 2 factor.

Answer

Answer

Password

Answer

Fingerprint

Question 3

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

A security token generating a one-time passcode. A security token generating a one-time passcode is a Type 2 authentication factor because it relies on something you have—a physical or software token that produces a changing code. Type 2 factors are possession-based, distinct from knowledge (Type 1) and inherence (Type 3). The token must be in the user's possession to generate the correct OTP.

Answer

A fingerprint

Answer

A password

Answer

A PIN

Question 4

Which of the following is an example of Type 2 (possession) authentication?

Accepted Answer

Smart card. Type 2 authentication, also known as possession-based authentication, relies on something the user possesses, such as a physical token or device. A smart card is a classic example because it is a physical item that the user must have in their possession to authenticate. The smart card typically contains a certificate or cryptographic key that is validated by a reader.

Answer

Answer

Password

Answer

Fingerprint scan

Question 5

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 6

An organization is developing a data classification policy. Which THREE of the following are common classification levels?

Accepted Answer

Confidential. Public, confidential, and restricted are typical classification levels.

Answer

Critical

Answer

Sensitive

Question 7

An organization requires employees to enter a password and then approve a push notification on their mobile device to access the corporate network. What type of authentication is this?

Accepted Answer

Two-factor authentication. This is two-factor authentication because it combines two different authentication factors: something you know (the password) and something you have (the mobile device receiving the push notification). Two-factor authentication requires exactly two distinct factor types, and password + push approval satisfies that definition. It is not multi-factor in the sense of three or more factors, and it is not single-factor or biometric.

Answer

Biometric authentication

Answer

Multi-layer authentication

Answer

Single-factor authentication

Question 8

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — always takes precedence over the others. This ordering means that when canons conflict, the safety and trust of society outweigh obligations to principals, professional conduct, or the profession itself. Candidates must memorize this hierarchy because exam questions frequently test the relative priority of the canons.

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 9

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited. A vulnerability is a weakness that can be exploited by a threat to cause harm.

Answer

A potential cause of an unwanted incident

Answer

The likelihood of a threat exploiting a weakness

Answer

A measure that reduces risk

Question 10

What is the primary purpose of a digital signature?

Accepted Answer

Provide non-repudiation and integrity. A digital signature uses asymmetric cryptography to provide non-repudiation (the signer cannot deny signing) and integrity (any modification invalidates the signature). The signer's private key creates the signature, and anyone with the public key can verify it, proving both origin and that the message was not altered. Confidentiality is not a goal of digital signatures — that requires encryption.

Answer

Ensure confidentiality

Answer

Authenticate users via password

Answer

Encrypt the data

Question 11

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

One-time passcode from a hardware token. Type 2 (possession) factors include something the user has, such as a smart card, OTP token, or mobile authenticator app.

Answer

Fingerprint scan

Answer

Password

Answer

Question 12

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?

Accepted Answer

Financial account numbers. Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.

Answer

Phone number

Answer

Name and email address

Question 13

A company is classifying data and wants to ensure that personally identifiable information (PII) receives appropriate protection. Which two of the following are considered PII? (Choose two.)

Accepted Answer

Social Security Number. A Social Security Number (A) is a classic example of PII because it is a unique government-issued identifier that can be used to trace or identify a specific individual, so it must be protected. An email address (B) is also PII since it directly identifies a person (e.g., name@domain.com) and can be used to contact or locate them, and it is often combined with other personal data. By contrast, an Employee ID number (C) is typically an internal, organization-specific identifier that is not inherently tied to a person outside the company, so it is generally not considered PII on its own. A Job title (D) and a Department name (E) describe a role or organizational unit rather than an individual, so they are not PII.

Answer

Employee ID number

Answer

Job title

Answer

Department name

Question 14

A financial institution is implementing data classification to protect customer information. They have identified data that includes medical records and financial account numbers. Which three labels are most appropriate for this data? (Choose three.)

Accepted Answer

Restricted. The data described—medical records and financial account numbers—is highly sensitive personal and financial information, so labels indicating the highest protection levels are appropriate. Option A (Restricted) is correct because restricted is typically the highest classification tier, reserved for data whose unauthorized disclosure causes severe harm, such as medical or financial records. Option B (Sensitive) is correct because sensitive data classification covers personally identifiable information (PII) and protected health information (PHI) that require strong safeguards. Option C (Confidential) is correct because confidential is a common classification for private customer information, including account numbers and health data, limiting access to authorized personnel. Option D (Internal) is not appropriate because internal data is only meant for employees and does not imply the strict regulatory and privacy protections required for medical and financial records. Option E (Public) is not appropriate because public data is freely shareable and would expose protected customer information, violating privacy regulations such as HIPAA and GLBA.

Answer

Internal

Answer

Public

Question 15

A small business owner implements a policy that requires all employees to lock their computers when leaving their desks. This policy is primarily an example of which type of control?

Accepted Answer

Technical control. Locking a computer screen is a technical control because it uses a software feature to enforce access restrictions. Technical controls are implemented through technology and include mechanisms like passwords, encryption, and screen locks. While the policy requiring it is administrative, the actual control mechanism is technical, as it operates within the operating system to prevent unauthorized access.

Answer

Physical control

Answer

Compensating control

Answer

Administrative control