ISC2 CC Security Principles Practice Test 11 — 15 Questions

Question 1

A hospital's IT department wants to ensure that only authorized clinicians can view patient records, while also guaranteeing that those records have not been tampered with. Which security principle is primarily concerned with preventing unauthorized disclosure of the records?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confidentiality. Confidentiality is the security principle that ensures information is not made available or disclosed to unauthorized individuals, entities, or processes. In the hospital scenario, the goal is to restrict patient record access to authorized clinicians, which is a classic confidentiality objective. Integrity addresses unauthorized modification, availability addresses timely access, and non-repudiation addresses proof of actions.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 2

A company's security policy states that employees must wear identification badges visibly at all times while on premises. A security guard checks badges at the entrance. Which type of control is the badge check?

Accepted Answer

Preventive control. The badge check by a security guard is a preventive control because it stops unauthorized individuals from entering the premises. Preventive controls are designed to avoid incidents before they happen, and this is a classic example of a physical preventive control. Other control types like detective, corrective, or compensating do not fit the scenario.

Answer

Compensating control

Answer

Detective control

Answer

Corrective control

Question 3

A financial services company wants to ensure that a terminated employee cannot continue to use an active badge to enter the building after their last day. The security manager reviews physical access control procedures. Which control type is being applied when the badge is deactivated in the access control system?

Accepted Answer

Preventive control. Deactivating a badge stops the terminated employee from entering the facility, which is the definition of a preventive control. Preventive controls aim to stop unauthorized actions before they happen. Detective controls identify events after the fact, corrective controls address incidents after they occur, and compensating controls substitute for missing controls. Since the action blocks access in advance, preventive is correct.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 4

A company experiences a ransomware attack that encrypts its file servers. The security team restores operations from offline backups taken the previous night. Which security principle does the restoration from backups primarily support?

Accepted Answer

Availability. Ransomware encryption makes the file servers unavailable, and restoring from an offline backup taken the previous night brings the data and services back online with minimal loss. That is the availability objective of the CIA triad. Confidentiality protects against disclosure, integrity protects against unauthorized alteration, and non-repudiation proves actions; the recovery activity here is specifically about regaining access to systems and data.

Answer

Integrity

Answer

Confidentiality

Answer

Non-repudiation

Question 5

A financial institution wants to implement a control that verifies the identity of a user by requiring something the user knows and something the user has. Which of the following authentication mechanisms best meets this requirement?

Accepted Answer

Smart card and PIN. Multi-factor authentication requires combining two or more different types of factors: something you know, something you have, something you are, somewhere you are, or something you do. The scenario explicitly requires something the user knows and something the user has. A smart card (possession) and a PIN (knowledge) meet this requirement, while the other options use factors of the same type or do not include a possession factor.

Answer

Fingerprint and retina scan

Answer

Username and password

Answer

Password and security question

Question 6

A payroll administrator can view salary records for all employees during normal business hours, but only after her manager approves each access request and the system logs the action. Which security principle is BEST illustrated by limiting her access to what her job requires and only when needed?

Accepted Answer

Least privilege. Least privilege means granting only the access required to perform a job and only when it is required. The payroll administrator sees salary data tied to her role, must obtain approval for each request, and works within defined hours, all of which narrow access to the minimum necessary. Approval and logging reinforce accountability but do not change the underlying principle being demonstrated.

Answer

Non-repudiation

Answer

Defense in depth

Answer

Separation of duties

Question 7

A security manager is reviewing the organization's approach to risk. The manager decides to purchase cyber insurance to transfer some of the financial risk associated with a data breach. Which risk management strategy is being used?

Accepted Answer

Risk transference. Risk transference involves shifting the financial impact of a risk to another party, often through insurance or contracts. Cyber insurance is a common method of transferring the financial consequences of a data breach. The organization still owns the risk of the breach occurring, but the financial loss is partially borne by the insurer. This strategy is distinct from avoidance, mitigation, and acceptance.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation

Question 8

A software development team is designing a new application that will process credit card payments. The security architect recommends that the application should not store the card verification value (CVV) after the transaction is authorized. Which principle is the architect applying?

Accepted Answer

Data minimization. The architect recommends not retaining the CVV after the transaction, which reduces the amount of sensitive data the application holds. This is data minimization, the practice of limiting collection and retention to what is necessary. Least privilege is about access rights, separation of duties is about dividing tasks, and defense in depth is about layered controls, so data minimization is the correct principle.

Answer

Least privilege

Answer

Separation of duties

Answer

Defense in depth

Question 9

A hospital's compliance officer must decide how to protect patient records. The records must remain readable only to authorized clinicians while in storage and in transit. Which security principle is the compliance officer primarily applying?

Accepted Answer

Confidentiality. Confidentiality is the security principle that prevents unauthorized disclosure of information. The scenario requires that patient records remain readable only to authorized clinicians, both at rest and in transit, which is exactly what confidentiality controls such as encryption and access control provide. The other principles address availability, proof of origin, or protection from modification, none of which is the primary requirement described.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 10

An e-commerce company notices that its product reviews are being scraped by automated bots far more aggressively than expected, and the resulting traffic is degrading checkout performance for real customers. The security team wants a control that slows automated abuse without challenging legitimate buyers. Which security principle does this control primarily support?

Accepted Answer

Availability. The scenario centers on keeping the storefront usable for legitimate customers despite aggressive automated traffic. Rate limiting and similar anti-automation controls protect the ability of authorized users to reach and use the system, which is the definition of availability. Confidentiality, integrity, and non-repudiation address disclosure, modification, and proof of action respectively, none of which describes degraded checkout performance caused by resource consumption.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 11

A security manager is documenting how the organization decides which safeguards to apply to a new customer database. The team identifies the value of the data, the threats that could exploit weaknesses, and the potential business impact, then selects controls that reduce risk to an acceptable level. Which concept best describes this activity?

Accepted Answer

Risk management. The manager is following a structured process: identify and value the asset, determine threats and vulnerabilities, assess potential business impact, and choose safeguards that bring risk to an acceptable level. That end-to-end process is risk management, which includes risk identification, analysis, evaluation, and treatment. Business continuity planning addresses disruptions, awareness training changes user behavior, and vulnerability assessment only finds weaknesses; none of those encompasses the full decision cycle described.

Answer

Vulnerability assessment

Answer

Business continuity planning

Answer

Security awareness training

Question 12

A hospital wants to ensure that patient records can only be viewed by authorized clinical staff, and that any modification to a record is traceable to the individual who made it. Which security principle directly supports both of these requirements?

Accepted Answer

Accountability. The hospital needs two things: only authorized clinical staff can view records, and every modification is attributable to a person. Accountability supplies both, because actions are bound to authenticated identities and recorded in logs. Availability concerns uptime, non-repudiation concerns denying actions, and least privilege concerns permission scope, so none of them covers traceability as directly as accountability does.

Answer

Non-repudiation

Answer

Least privilege

Answer

Availability

Question 13

A security officer at a healthcare provider is reviewing the organization's risk management program. The officer must distinguish between threats and vulnerabilities when documenting risks. Which two of the following are examples of vulnerabilities rather than threats? (Choose two.)

Accepted Answer

An unpatched web server that is missing a critical security update. Vulnerabilities are weaknesses or gaps in protection that can be exploited, such as an unpatched web server and an unencrypted database. Threats are potential causes of harm, including ransomware groups, phishing campaigns, and natural disasters. The two correct choices describe internal weaknesses, while the other options describe threat actors or events that could exploit those weaknesses.

Answer

A ransomware group that is actively targeting healthcare organizations

Answer

A natural disaster such as a hurricane that could damage a data center

Answer

A phishing campaign that delivers malicious attachments to employees

Question 14

A security manager is conducting a risk assessment for a new cloud-based customer relationship management (CRM) system. The manager needs to identify which of the following are considered threats rather than vulnerabilities or risks. (Choose two.)

Accepted Answer

A hacker group known for targeting SaaS providers. In risk management, a threat is any actor or event with the potential to cause harm, such as a hacker group or a natural disaster. Vulnerabilities are weaknesses that can be exploited, like unpatched software or weak password policies. Risk is the potential for loss when a threat exploits a vulnerability. The question asks for threats, so the hacker group and natural disaster are correct.

Answer

Weak password policy allowing easy guessing

Answer

The potential financial loss from a data breach

Answer

Unpatched software in the CRM application

Question 15

A retail company wants to reduce the risk of fraudulent online purchases. The security manager proposes requiring customers to enter a password plus a code sent to their registered mobile phone. Which security concept does this proposal best illustrate?

Accepted Answer

Multi-factor authentication. Multi-factor authentication combines factors from different categories, such as something you know and something you have. The password represents knowledge, while the code sent to a registered mobile phone represents possession of that device. This pairing raises the difficulty for an attacker who steals only the password, so the proposal is best described as multi-factor authentication.

Answer

Federated identity

Answer

Single sign-on

Answer

Single-factor authentication