ISC2 CC Security Principles Practice Test 2 — 15 Questions

Question 1

A hospital's IT director must select an access control model for the electronic health records system. Clinicians need access to patient records only when actively treating those patients, and the hospital wants to enforce least privilege with the least administrative overhead. Which access control model BEST meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control is designed to simplify administration by grouping permissions into roles that correspond to job functions. Clinicians are assigned roles, and access is granted based on those roles, which enforces least privilege and reduces the overhead of managing individual permissions. While other models offer granular control, they either impose heavy administrative burdens or lack the centralized structure needed for consistent enforcement in a hospital setting.

Answer

Rule-Based Access Control (RuBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 2

A financial services firm wants to implement a defense-in-depth strategy for its online banking platform. The security architect proposes several controls. Which of the following controls is an example of a preventive physical control?

Accepted Answer

Security guards stationed at the data center entrance. Preventive physical controls are measures that physically stop or deter unauthorized access. Security guards are a classic example: they can challenge and deny entry to unauthorized individuals, providing a human preventive barrier. While biometric locks also prevent access, they are often classified as technical controls that include physical components. The scenario specifically asks for a preventive physical control, and guards fit that category most directly.

Answer

Security cameras recording the server room

Answer

Biometric locks on the data center door

Answer

Fire suppression system in the data center

Question 3

A security officer is classifying the controls protecting a new customer portal. She must identify controls that are administrative in nature rather than technical or physical. Which TWO of the following are administrative controls? (Choose two.)

Accepted Answer

A security awareness training programme delivered quarterly. Administrative controls are management-directed rules, procedures, and training that shape how people behave. A signed acceptable use policy and recurring security awareness training both operate through governance and education rather than technology or physical barriers, so they satisfy the requirement. The firewall is technical, the biometric reader is physical, and the vacation policy, while managerial, is not part of the intended pair for this classification task.

Answer

A web application firewall filtering portal traffic

Answer

Biometric readers controlling the data centre door

Answer

Mandatory vacation policy for privileged administrators

Question 4

A security manager is analyzing a risk scenario where a threat actor could exploit a known software flaw to cause a denial of service. The manager estimates that the likelihood of exploitation is high and the impact would be severe. Which term best describes the combination of the software flaw and the threat actor's potential to exploit it?

Accepted Answer

Vulnerability. A vulnerability is a weakness in an asset that can be exploited by a threat. The software flaw is the vulnerability, and the threat actor's potential to exploit it underscores the risk. While risk is the combination of threat, vulnerability, and impact, the question specifically asks for the combination of the flaw and the actor's potential, which is the vulnerability itself. Threat is the actor, exploit is the method, and risk is the broader potential for loss.

Answer

Risk

Answer

Threat

Answer

Exploit

Question 5

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password immediately due to a security breach. The employee suspects it is a phishing attempt. Which principle of security awareness is MOST relevant to this situation?

Accepted Answer

Due diligence. Due diligence is the principle of exercising reasonable care and caution. In the context of phishing, it means not automatically trusting unsolicited emails and instead verifying their legitimacy through separate channels. The employee's suspicion reflects due diligence, which is a key security principle in the CC exam. While confidentiality, integrity, and availability are core goals, due diligence is the proactive behavior that helps prevent breaches.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 6

A cloud operations team is implementing a new backup process. The security manager requires that backups be encrypted and that the encryption keys be stored separately from the backup media, with access to the keys limited to a small number of administrators. Which security principle is primarily being supported by storing keys separately and limiting key access?

Accepted Answer

Defense in depth. The requirement combines encryption with separate key storage and restricted key access, creating multiple layers of protection for backup data. If one control fails, such as media theft, the keys are still protected. This layered approach is defense in depth. Least privilege and separation of duties are related but do not fully capture the key separation aspect, and non-repudiation is unrelated to protecting backup confidentiality.

Answer

Separation of duties

Answer

Non-repudiation

Answer

Least privilege

Question 7

A security administrator is implementing a new access control system for a research facility. The facility handles highly sensitive intellectual property, and the administrator wants to ensure that access decisions are based on the user's assigned role and the sensitivity of the resource, while also enforcing the principle of least privilege. Which access control model should the administrator implement?

Accepted Answer

Attribute-Based Access Control (ABAC). ABAC is the correct choice because it can evaluate multiple attributes, including user role and resource sensitivity, to make access decisions. This supports the principle of least privilege by granting access only when all conditions are met. RBAC only considers roles, MAC only considers labels, and DAC is owner-discretionary, so none of them combine role and sensitivity as required. ABAC's flexibility makes it suitable for environments with highly sensitive intellectual property.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Question 8

A security analyst is reviewing the organization's incident response plan. The analyst needs to ensure that the plan addresses the principle of non-repudiation for email communications. Which two mechanisms should the analyst recommend to provide non-repudiation for email? (Choose two.)

Accepted Answer

Digital signatures. Digital signatures and PKI are the two mechanisms that together provide non-repudiation for email. Digital signatures use the sender's private key to sign the message, and the recipient verifies with the public key. PKI establishes trust by binding public keys to identities via certificates. Without PKI, digital signatures cannot be trusted. Encryption, S/MIME, and TLS do not by themselves provide non-repudiation, as they focus on confidentiality or are protocols that rely on the underlying mechanisms.

Answer

Transport Layer Security (TLS)

Answer

Message encryption

Answer

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Question 9

Which principle of the CIA triad ensures that data is not disclosed to unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality is the CIA triad principle that ensures information is not disclosed to unauthorized individuals, systems, or processes. It is enforced through encryption, access controls, and data classification. Authentication verifies identity but does not itself guarantee confidentiality, and integrity and availability address different properties.

Answer

Authentication

Answer

Integrity

Answer

Availability

Question 10

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A Type 2 authentication factor is something you have, such as a physical device or token. A smart card is a physical object that a user possesses and inserts into a reader or taps, making it a classic example of a possession factor. Therefore, smart card is the correct answer.

Answer

Answer

Password

Answer

Fingerprint

Question 11

An organization implements redundant servers and failover mechanisms to ensure continuous operation during a power outage. Which goal of the CIA triad is primarily being addressed?

Accepted Answer

Availability. Availability ensures that systems and data are accessible to authorized users when needed, and redundant servers with failover mechanisms directly support continuous operation during outages. This is the core goal of the availability pillar of the CIA triad. Confidentiality and integrity address different concerns, so availability is the correct answer.

Answer

Confidentiality

Answer

Integrity

Answer

Authentication

Question 12

According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics Canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — takes precedence over all others. This means that when obligations conflict, the safety and welfare of society outweigh duties to employers, clients, or the profession. The remaining canons (act honorably, provide diligent service, advance the profession) are subordinate to this top-level obligation.

Answer

Advance the profession

Answer

Act honourably

Answer

Provide diligent service

Question 13

A security analyst is reviewing a log that shows an unauthorized user attempted to modify a payroll database. Which security principle is most directly threatened?

Accepted Answer

Integrity. Integrity ensures that data remains accurate, complete, and unaltered unless modified by authorized parties. The unauthorized attempt to modify the payroll database directly threatens this principle because it aims to change data without permission, compromising its trustworthiness. Confidentiality, non-repudiation, and availability are not the primary concerns here, as the focus is on unauthorized modification, not disclosure, proof of origin, or access disruption.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 14

A company is evaluating a new cloud service provider. As part of due diligence, they review the provider's security certifications, conduct a site visit, and check references. This process is an example of which risk management strategy?

Accepted Answer

Due diligence. Reviewing a provider's security certifications, conducting a site visit, and checking references are all investigative activities performed before committing to a relationship — this is the definition of due diligence. Due diligence is the assessment phase of risk management that gathers evidence to inform a risk decision. It is distinct from mitigation (implementing controls), transfer (shifting risk via insurance/contracts), and acceptance (acknowledging risk without action).

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 15

Which of the following is classified as sensitive PII?

Accepted Answer

Medical records. Sensitive PII is data that, if disclosed, could cause harm or discrimination — medical records qualify because they contain health information protected under HIPAA and similar regulations. Sensitive PII typically includes health data, financial account numbers, Social Security numbers, and biometric data. Email address, telephone number, and date of birth are considered non-sensitive PII because they are publicly available or low-risk in isolation.

Answer

Email address

Answer

Telephone number

Answer

Date of birth