ISC2 CC Security Principles Practice Test 10 — 15 Questions

Question 1

An organization wants to implement multi-factor authentication (MFA) for remote access by requiring a password and a smart card. Which two authentication factors are used in this MFA implementation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password. Multi-factor authentication requires at least two different types of factors. A password is Type 1 (knowledge) and a smart card is Type 2 (possession), so combining them qualifies as MFA.

Answer

Retina scan

Answer

Fingerprint scan

Answer

OTP token

Question 2

A security team is conducting a risk assessment for a new cloud application. They have identified a vulnerability in the application that could allow unauthorized access to sensitive data. Which three risk management strategies should they consider? (Choose three.)

Accepted Answer

Risk avoidance. Risk avoidance (B) is correct because it involves eliminating the vulnerability by not deploying the cloud application or removing the vulnerable component entirely, thus preventing any possibility of unauthorized access to sensitive data. This strategy is appropriate when the risk exceeds the organization's risk appetite and cannot be effectively reduced through other means.

Answer

Risk ignorance

Answer

Risk acceptance

Question 3

A security professional is advising a company on adherence to the (ISC)² Code of Ethics. Which two of the following actions align with the Code's canons? (Choose two.)

Accepted Answer

Reporting a discovered vulnerability to the software vendor promptly. Option C is correct because the (ISC)² Code of Ethics requires members to act honorably, honestly, justly, responsibly, and legally, and responsibly disclosing a discovered vulnerability to the software vendor reflects the canon to protect society and the infrastructure. Option D is correct because safeguarding confidential client information and refusing to release a password to an unauthorized third party upholds the canon to advance the profession and act responsibly toward clients and employers. Option A is wrong because using unlicensed software is illegal and unethical, violating the canon to act legally and avoid conflicts with laws. Option B is wrong because sharing a colleague's password without consent violates privacy, confidentiality, and the canon to act honorably and responsibly. Option E is wrong because concealing a breach is dishonest and harms stakeholders, contradicting the canons to act honestly and protect society.

Answer

Using a vendor's software without a license to test its security

Answer

Sharing a colleague's password with a manager without the colleague's consent to improve efficiency

Answer

Concealing a security breach to avoid negative publicity

Question 4

An organization wants to ensure the integrity of a software update before deployment. Which two methods can be used to verify integrity? (Choose two.)

Accepted Answer

Digital signature. Option C (Digital signature) is correct because a digital signature, created by the software publisher using their private key and verified with their public key, cryptographically proves both the integrity and authenticity of the update — any modification to the package invalidates the signature. Option E (Hashing) is correct because computing a hash (e.g., SHA-256) of the downloaded update and comparing it to the publisher's published hash value detects any alteration of the file's contents, confirming integrity. Option A (Encryption) is not correct because encryption provides confidentiality, not integrity verification, and does not by itself prove the file was unmodified. Option B (Redundant servers) is not correct because redundancy only improves availability and fault tolerance, not data integrity. Option D (Access control lists) is not correct because ACLs restrict who may access a resource, which is an authorization control rather than a mechanism for verifying that a file's contents are intact.

Answer

Encryption

Answer

Redundant servers

Answer

Access control lists

Question 5

A small clinic stores patient records on a server. The IT administrator ensures that only authorized staff can view these records, and that the records remain accurate and available when needed. Which security principle is best illustrated by restricting access to the records?

Accepted Answer

Confidentiality. The correct answer is confidentiality. Restricting access to patient records ensures that only authorized individuals can view them, directly supporting the confidentiality principle. Integrity, availability, and non-repudiation address different aspects of information security and are not the primary focus of the described action. Confidentiality is a foundational concept in the CIA triad and is specifically about preventing unauthorized disclosure.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 6

A financial institution wants to ensure that a wire transfer request cannot be denied by the sender later. The security team implements a mechanism where the sender's private key is used to sign the transaction. Which security principle does this primarily support?

Accepted Answer

Non-repudiation. The correct answer is non-repudiation. Using a private key to sign a wire transfer provides proof of origin and prevents the sender from denying the transaction. While digital signatures also support integrity, the specific requirement to prevent denial makes non-repudiation the primary principle. Confidentiality and availability are unrelated to this scenario's goal.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 7

A healthcare organization wants to ensure that only authorized clinicians can view patient records, while also maintaining a detailed log of every access for compliance audits. Which security principle is primarily being addressed by restricting access and recording all access attempts?

Accepted Answer

Confidentiality. Confidentiality is the principle that ensures information is not disclosed to unauthorized individuals. Restricting access to authorized clinicians directly supports confidentiality by preventing unauthorized viewing of patient records. Logging access attempts supports accountability and auditability, but the core security objective here is to protect the confidentiality of sensitive health information.

Answer

Integrity

Answer

Accountability

Answer

Availability

Question 8

A security manager is assessing the risk of a new web application. The manager identifies that the application has a known SQL injection vulnerability, and that attackers frequently scan for such flaws. Which term best describes the SQL injection flaw itself?

Accepted Answer

Vulnerability. The correct answer is vulnerability. A vulnerability is a weakness or flaw in a system that can be exploited by a threat. The SQL injection flaw is a specific weakness in the web application. Threat refers to the attacker or attack method, risk is the potential for loss, and impact is the resulting harm. Therefore, the flaw itself is a vulnerability.

Answer

Risk

Answer

Impact

Answer

Threat

Question 9

An organization implements a defense-in-depth strategy by deploying firewalls, intrusion detection systems, and endpoint protection. Which security principle does this approach primarily demonstrate?

Accepted Answer

Defense in depth. The correct answer is defense in depth. This principle involves implementing multiple layers of security controls so that if one fails, others still provide protection. Firewalls, intrusion detection systems, and endpoint protection are classic examples of layered defenses. Least privilege, separation of duties, and zero trust are related but distinct concepts that do not directly describe the scenario.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 10

A security analyst is reviewing access control models. Which two of the following are characteristics of the principle of least privilege? (Choose two.)

Accepted Answer

Users are granted only the minimum access rights necessary to perform their job functions.. The correct answers are granting only minimum necessary access and limiting access duration to when needed. These directly reflect the principle of least privilege, which aims to restrict user rights to the bare minimum required for their duties and only for as long as necessary. Role-based access, default read-only access, and permanent admin rights do not embody least privilege.

Answer

Administrative privileges are permanently assigned to senior management.

Answer

All users are granted read-only access to all resources by default.

Answer

Access rights are based on the user's role within the organization.

Question 11

A healthcare provider must ensure that patient records remain unaltered during storage and transmission between clinics. Which security principle is being addressed when the organization implements hashing and digital signatures on those records?

Accepted Answer

Integrity. The scenario centers on preventing and detecting unauthorized modification of patient records while they are stored and moved between clinics. Integrity controls such as hashing and digital signatures make any change detectable and bind the data to its source. Confidentiality hides contents, availability keeps data reachable, and non-repudiation proves who did something; none of those directly satisfies the requirement that the records stay unaltered.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Availability

Question 12

A security analyst is assessing the risk associated with a new web application. The analyst identifies that the application has a SQL injection vulnerability, and there is a known exploit available that could allow an attacker to extract sensitive data. The application is exposed to the internet and is used by customers. Which two factors are most directly involved in determining the level of risk? (Choose two.)

Accepted Answer

The likelihood of the vulnerability being exploited. Risk is typically defined as the combination of the likelihood of a threat exploiting a vulnerability and the impact of that exploitation. In this scenario, the known exploit and internet exposure increase likelihood, while potential sensitive data extraction increases impact. These two factors are directly involved in determining the risk level, making them the correct choices.

Answer

The color scheme of the user interface

Answer

The number of lines of code in the application

Answer

The programming language used to develop the application

Question 13

A junior security administrator at a hospital is told that only nurses and physicians on the current shift should be able to view patient records, and that records must be protected from disclosure to anyone else. Which security principle is this requirement primarily enforcing?

Accepted Answer

Confidentiality. The requirement limits access to patient records so only authorized on-shift nurses and physicians can view them, which is a disclosure control. Confidentiality is the security principle that prevents information from being disclosed to unauthorized individuals. Integrity addresses unauthorized changes, availability addresses timely access, and non-repudiation addresses proof of actions, so confidentiality is the correct principle.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 14

A retail company's security policy states that no single employee should be able to both create a vendor payment and approve it. The company assigns these duties to two different people. Which security principle is the policy enforcing?

Accepted Answer

Separation of duties. The policy prevents any single employee from completing a sensitive transaction end to end by requiring two different people to create and approve a vendor payment. That is separation of duties, an administrative control that limits the opportunity for fraud and error. Least privilege limits what each user can access, defense in depth layers controls, and job rotation changes assignments over time; none of those captures the requirement that two distinct people must be involved in one process.

Answer

Least privilege

Answer

Job rotation

Answer

Defense in depth

Question 15

A hospital's IT department is choosing a security control to protect patient records. The control must render data unreadable to anyone who does not hold the cryptographic key, even if the storage media is stolen. Which type of control BEST meets this requirement?

Accepted Answer

Encryption of the data at rest. The requirement is that stored records stay unreadable without the cryptographic key, which is precisely what encryption at rest delivers. Access control, monitoring, and backups all have security value, but none of them transform the data itself, so a thief holding the physical media could still read every record. Only encryption makes the stolen media useless to an attacker lacking the key.

Answer

Role-based access control on the records

Answer

Full database activity monitoring

Answer

Daily offsite backup of the database