ISC2 CC Security Principles Practice Test 2 — 15 Questions

Question 1

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Restricted data includes trade secrets, classified government info, and biometric data.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 2

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication relies on biometric characteristics.

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 3

A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?

Accepted Answer

Integrity. File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 4

A company is deploying a multi-factor authentication (MFA) solution. Which combination represents two different authentication factors?

Accepted Answer

Smart card and PIN. MFA requires two or more different types: something you know (password), something you have (OTP token), and something you are (fingerprint).

Answer

Password and security question

Answer

OTP token and mobile authenticator app

Answer

Fingerprint and retina scan

Question 5

An organization decides to accept the risk of using a legacy system that cannot be patched due to critical business operations. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate, transfer, or avoid it.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 6

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Type 2 factors are something you have, such as a physical token.

Answer

Answer

Password

Answer

Fingerprint

Question 7

According to the (ISC)² Code of Ethics, which principle has the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.

Answer

Act honorably

Answer

Advance the profession

Answer

Provide diligent service

Question 8

A data breach exposed customers' names, addresses, and Social Security numbers. Which type of data was compromised?

Accepted Answer

Sensitive PII. Social Security numbers combined with names and addresses are considered sensitive PII that can cause significant harm if disclosed.

Answer

Public data

Answer

Confidential business data

Answer

Internal data

Question 9

An organization is evaluating a new vendor that will process customer data. The security team performs a thorough assessment of the vendor's security controls and background checks. This process best demonstrates:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before making a decision, such as vendor risk assessments and background checks.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Due care

Question 10

Which of the following controls is primarily designed to ensure availability?

Accepted Answer

Redundant servers. Redundancy (e.g., backup servers, failover) ensures systems remain available even if one component fails.

Answer

Encryption

Answer

Digital signatures

Answer

Access control lists

Question 11

A security analyst is implementing controls to prevent unauthorized disclosure of sensitive information. Which element of the CIA triad is being addressed?

Accepted Answer

Confidentiality. Preventing unauthorized disclosure directly relates to confidentiality.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 12

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited by a threat. A vulnerability is a weakness that can be exploited by a threat to cause harm.

Answer

The likelihood that a threat will exploit a weakness

Answer

A measure that reduces risk

Answer

A potential cause of an unwanted incident

Question 13

An organization labels data as 'Confidential' and requires encryption both at rest and in transit. This classification is an example of:

Accepted Answer

Data classification. Data classification labels (e.g., Confidential) define handling requirements, such as encryption, to protect the data.

Answer

Risk transfer

Answer

Due care

Answer

Data retention

Question 14

What is the primary purpose of a digital signature?

Accepted Answer

Provide data integrity and non-repudiation. Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

Answer

Ensure data confidentiality

Answer

Control access to resources

Answer

Encrypt data at rest

Question 15

A security administrator is selecting controls to protect the confidentiality of a database containing customer PII. Which TWO controls are most appropriate?

Accepted Answer

Access control lists. Encryption protects data confidentiality; access controls restrict who can view data.

Answer

Hashing

Answer

Load balancing

Answer

Redundant power supplies