ISC2 CC Security Principles Practice Test 12 — 15 Questions

Question 1

A security administrator is reviewing the organization's authentication controls and wants to strengthen them by adding factors from different categories. Which TWO of the following represent distinct authentication factor categories that can be combined to achieve multi-factor authentication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Something you possess, such as a smart card or hardware token. Multi-factor authentication requires two or more factors drawn from different categories: something you know, something you have, and something you are. A password or PIN represents knowledge, while a smart card or hardware token represents possession, so combining them satisfies the requirement. Usernames are identifiers rather than factors, two passwords remain knowledge-based, and a one-time passcode sent to the requesting device does not introduce a distinct factor category.

Answer

Two different passwords for the same account

Answer

A one-time passcode sent to the same device that is requesting access

Answer

A username and a password entered together

Question 2

A hospital's compliance officer is mapping controls for a new patient portal. The legal team wants documented assurance that a clinician cannot later deny having approved a medication order submitted through the portal. Which security principle is the legal team most directly requesting?

Accepted Answer

Non-repudiation. The legal team needs proof of who performed an action so it cannot be denied later. That is non-repudiation, usually achieved with digital signatures, strong authentication, and tamper-evident audit logging tied to individual identities. Integrity protects against unauthorized changes, confidentiality protects against disclosure, and availability protects against loss of access; none of these establishes undeniable authorship of the medication order.

Answer

Integrity

Answer

Availability

Answer

Confidentiality

Question 3

An organization's data center experiences a power outage. The uninterruptible power supply (UPS) maintains power long enough for the backup generator to start, but the generator fails to start due to a fuel line blockage. The servers shut down, and critical data is lost. Which security principle was MOST directly compromised?

Accepted Answer

Availability. The power outage and subsequent generator failure led to servers shutting down and data becoming inaccessible. Availability ensures that systems and data are accessible to authorized users when needed. The failure of backup power directly compromised availability, as the organization could not access its critical data. Confidentiality and integrity are not primarily affected because there is no unauthorized disclosure or modification, and non-repudiation is irrelevant to this physical infrastructure failure.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 4

A financial services firm is classifying a risk by estimating how often a particular attack is likely to succeed in a given year. Which risk concept is the firm measuring?

Accepted Answer

Risk likelihood. Risk combines the likelihood that a threat exploits a vulnerability with the impact if it does. The firm is estimating how often an attack succeeds per year, which is precisely the likelihood dimension. Annualized loss expectancy and impact deal with cost or severity, while residual risk refers to what remains after controls are applied, so likelihood is the concept being quantified.

Answer

Residual risk

Answer

Annualized loss expectancy (ALE)

Answer

Risk impact

Question 5

A security analyst is reviewing the organization's risk management process. The analyst must identify which items are examples of risk treatment options. (Choose two.)

Accepted Answer

Accepting the risk and documenting the decision. Risk treatment options include avoiding, mitigating, transferring, and accepting risk. Purchasing cyber insurance transfers financial risk to an insurer, while accepting and documenting risk is a conscious decision to tolerate it. Identifying vulnerabilities and calculating loss expectancy are assessment activities, and monitoring traffic is a control, so they are not treatment options themselves.

Answer

Calculating the annualized loss expectancy

Answer

Identifying a vulnerability in a web application

Answer

Monitoring network traffic for anomalies

Question 6

A junior analyst reports that an attacker exploited an unpatched web server to steal customer data. The analyst labels the missing patch the 'risk'. According to standard risk terminology, how should the missing patch be classified?

Accepted Answer

As the vulnerability, because it is a weakness an attacker can exploit. In standard risk terminology, a vulnerability is a weakness that a threat can exploit, and the unpatched web server fits that definition precisely. Risk is the combination of the likelihood that a threat exploits a vulnerability and the resulting impact, while the threat is the actor or circumstance capable of causing harm. Naming the missing patch the vulnerability keeps cause, actor, and consequence distinct for remediation.

Answer

As the impact, because data was stolen from the server

Answer

As the risk, because it is the condition that led to the loss

Answer

As the threat, because it enabled the compromise

Question 7

A hospital's IT department is designing a new electronic health record system. The security architect proposes that all patient records be encrypted both at rest and in transit, and that access be restricted based on job roles. Which security principle is the architect primarily addressing?

Accepted Answer

Confidentiality. The architect's measures—encrypting patient records at rest and in transit and restricting access by job roles—are classic controls for protecting confidentiality. Confidentiality focuses on preventing unauthorized disclosure of information. While integrity and availability are also part of the CIA triad, the scenario's emphasis on encryption and access restrictions points specifically to confidentiality.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 8

A mid-sized accounting firm is drafting its first information security policy. The partners want the policy to address governance responsibilities clearly so that security decisions are made consistently at the right levels. Which TWO of the following are governance responsibilities that the policy should assign? (Choose two.)

Accepted Answer

Defining the organization's risk appetite and approving the overall security strategy. Governance is about direction, accountability, and oversight rather than hands-on control operation. Senior leadership defines risk appetite and approves strategy, while specific roles are made accountable for security outcomes and monitored through reporting. Firewall tuning, vulnerability scanning, and password resets are operational activities that implement governance decisions but do not themselves constitute governance.

Answer

Performing vulnerability scans against internal servers each week

Answer

Resetting user passwords when employees call the service desk

Answer

Configuring firewall rules and tuning intrusion detection signatures daily

Question 9

An organization is reviewing its security governance framework. Which TWO of the following are primary objectives of security governance? (Choose two.)

Accepted Answer

Aligning security strategy with business objectives. Security governance is the set of responsibilities and practices exercised by the board and executive management to provide strategic direction, ensure objectives are achieved, manage risks appropriately, and verify that resources are used responsibly. Aligning security strategy with business objectives and ensuring accountability for security decisions are core governance objectives. Technical controls, penetration testing, and awareness training are operational activities that support governance but are not primary objectives of governance itself.

Answer

Developing security awareness training

Answer

Implementing technical security controls

Answer

Conducting penetration testing

Question 10

Maya is a security administrator at a healthcare company. She discovers that nurses can view patient billing records even though their job duties only require access to clinical treatment notes. She wants to apply the security principle that restricts users to only the data they need to perform their assigned tasks. Which principle should she implement?

Accepted Answer

Least privilege. Least privilege is the security principle that requires giving users only the access needed for their specific job tasks. Because the nurses only need clinical notes, removing their billing access aligns directly with that principle. Separation of duties, defense in depth, and non-repudiation address different concerns and would not correct the excessive permissions described.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Separation of duties

Question 11

A software development company wants to prevent a dismissed contractor from using credentials that were issued during the contract period to access internal code repositories. Which administrative control should the company apply?

Accepted Answer

Revoke the contractor's access rights during offboarding. The scenario's core problem is that a former contractor retains valid credentials after the contract ends. Administrative controls govern people and processes, and timely revocation of access rights during offboarding removes the account's authority entirely. Monitoring detects but does not prevent, password complexity does not invalidate a known password, and MFA still lets the former contractor log in, so revocation is the correct control.

Answer

Deploy file integrity monitoring on the repositories

Answer

Enforce a password complexity policy for all accounts

Answer

Require multi-factor authentication for repository access

Question 12

A software vendor wants customers to verify that a downloadable patch truly came from the vendor and was not modified in transit. The vendor signs the patch with its private key. Which security property does this provide to customers who verify the signature with the vendor's public key?

Accepted Answer

Non-repudiation and integrity. A digital signature created with a private key and verified with the corresponding public key provides authenticity, integrity, and non-repudiation. Customers can confirm the patch came from the vendor and was not modified, and the vendor cannot later deny signing it. Confidentiality, availability, and authorization are separate properties not delivered by this signing and verification process.

Answer

Confidentiality of the patch contents

Answer

Authorization of the customer

Answer

Availability of the download server

Question 13

A company's security policy states that only staff in the finance department may access the general ledger, and that access must be reviewed every quarter. An auditor finds that two former finance employees still hold active accounts with ledger permissions. Which concept has the organization FAILED to apply?

Accepted Answer

Need to know. Need to know restricts access to information strictly to individuals whose duties require it. Former finance employees have no current business justification for ledger permissions, so their active accounts violate this principle regardless of whether they have logged in. The quarterly review requirement exists precisely to catch and remove such stale entitlements before they become an insider threat.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 14

A security manager is reviewing the organization's risk management approach. She wants to ensure that the team correctly distinguishes between threats, vulnerabilities, and risks. Which two of the following statements correctly describe these concepts? (Choose two.)

Accepted Answer

A threat is any potential cause of an unwanted incident that could harm assets.. The two correct statements accurately define a vulnerability as a weakness that can be exploited and a threat as a potential cause of an unwanted incident. These definitions are foundational in risk management: risk arises when a threat exploits a vulnerability, leading to potential impact. The other statements incorrectly equate risk with impact alone, confuse vulnerability with probability, or claim threats always create risk without considering vulnerabilities.

Answer

A vulnerability is the probability that a threat will occur.

Answer

A threat always results in a risk, regardless of whether a vulnerability exists.

Answer

Risk is the same as the impact of a threat event, regardless of likelihood.

Question 15

A retail chain wants to reduce the chance that a former employee can still access the point-of-sale system weeks after leaving the company. The security manager proposes a control that automatically disables accounts on the employee's last working day. Which type of control is this?

Accepted Answer

Preventive. Automated account deactivation on the last working day stops unauthorized access before it can happen, which defines a preventive control. Detective controls would only reveal misuse after the fact, corrective controls would remediate damage already done, and compensating controls are alternate measures when a primary control is not feasible. Since the control blocks the event itself, preventive is the correct classification.

Answer

Detective

Answer

Compensating

Answer

Corrective