ISC2 CC Security Principles Practice Test 3 — 15 Questions

Question 1

Which risk management strategy involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Risk mitigation. Risk mitigation involves implementing security controls to reduce either the likelihood or the impact of a risk. This is the most common risk management strategy because it addresses the risk directly rather than shifting or avoiding it. Examples include patching vulnerabilities, deploying firewalls, or enforcing MFA to lower the probability of exploitation.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 2

A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?

Accepted Answer

Digital signature. A digital signature uses asymmetric cryptography to sign a document's hash with the signer's private key, allowing anyone with the public key to verify both the signer's identity and that the document has not been altered. This provides integrity and non-repudiation, directly satisfying the requirement.

Answer

Symmetric encryption

Answer

Access control list

Answer

Hashing

Question 3

A vulnerability assessment reveals that a legacy system has unpatched software. The organization decides to accept the risk because the system is isolated and has compensating controls. This decision is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means the organization acknowledges the risk and chooses to retain it without taking further action, often because the cost of mitigation outweighs the potential impact or because compensating controls reduce it to an acceptable level. Here, the legacy system is isolated with compensating controls, so the organization formally accepts the residual risk.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 4

Which of the following best describes the difference between due care and due diligence in security governance?

Accepted Answer

Due care is the minimum standard of care; due diligence is the investigation and assessment. Due care refers to the minimum standard of care that an organization must exercise to protect its assets, often defined by laws, regulations, or industry best practices. Due diligence is the ongoing process of investigation, assessment, and verification to ensure that due care is maintained. In security governance, due care is the baseline, while due diligence is the active effort to identify and mitigate risks.

Answer

Due care is proactive, due diligence is reactive

Answer

They are synonymous

Answer

Due care applies to vendors; due diligence applies to employees

Question 5

A security analyst is evaluating controls to protect the confidentiality of customer data. Which TWO of the following are effective controls? (Select TWO).

Accepted Answer

Encryption of data at rest. Encryption of data at rest (C) is correct because it renders stored customer data unreadable to unauthorized parties, protecting confidentiality even if the storage media or database is compromised. Role-based access controls (E) are correct because RBAC enforces least privilege, ensuring only authorized users with the appropriate role can access customer data, directly limiting exposure. Hashing of passwords (A) protects password integrity/verification but is not a general confidentiality control for customer data, and hashes are one-way rather than reversible protection of data. Redundant network links (B) address availability through fault tolerance, not confidentiality. Regular data backups (D) support availability and recovery, not confidentiality, since backups can themselves expose data if unprotected.

Answer

Hashing of passwords

Answer

Redundant network links

Answer

Regular data backups

Question 6

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Option B (classified government intelligence) is correctly marked restricted/top secret because it is information whose unauthorized disclosure would cause exceptional damage to national security and is legally protected at the highest classification levels. Option D (trade secrets) is correct because trade secrets are proprietary intellectual property whose disclosure would cause severe competitive and financial harm, so best-practice data classification places them in the highest sensitivity tier. Option E (biometric data of employees) is correct because biometric identifiers are sensitive personal data (often special-category data under regimes like GDPR) that cannot be changed if compromised, warranting restricted handling. The unmarked options do not belong: A (company cafeteria menu) and C (marketing brochures) are intended for public or internal distribution and carry negligible confidentiality impact, so they would be classified as public or internal, not restricted.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 7

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication is "something you are," i.e., biometrics based on a physical or behavioral characteristic of the user. Option B, retina scan, is correct because it authenticates by measuring the unique pattern of blood vessels in the eye's retina, a physiological biometric trait. Option C, fingerprint recognition, is correct because it verifies identity from the unique ridge patterns of a finger, another physiological biometric. The other options belong to different factors: A (one-time password token) and D (smart card) are Type 2, "something you have," while E (password) is Type 1, "something you know."

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 8

A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?

Accepted Answer

Integrity. File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 9

A company is deploying a multi-factor authentication (MFA) solution. Which combination represents two different authentication factors?

Accepted Answer

Smart card and PIN. MFA requires factors from different categories: something you know, something you have, and something you are. A smart card is something you have (a physical token), and a PIN is something you know — two distinct factor types, making this a valid MFA combination.

Answer

Password and security question

Answer

OTP token and mobile authenticator app

Answer

Fingerprint and retina scan

Question 10

An organization decides to accept the risk of using a legacy system that cannot be patched due to critical business operations. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance is the deliberate decision to acknowledge a risk and take no action to reduce it, typically because the cost of mitigation outweighs the benefit or because the risk is unavoidable. In this scenario, the organization recognizes the vulnerability in the legacy system but chooses to continue operating it due to critical business needs, which is a textbook example of risk acceptance. This is a formal risk response strategy where the organization documents the decision and may implement compensating controls, but does not eliminate or transfer the risk.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 11

According to the (ISC)² Code of Ethics, which principle has the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.

Answer

Act honorably

Answer

Advance the profession

Answer

Provide diligent service

Question 12

A data breach exposed customers' names, addresses, and Social Security numbers. Which type of data was compromised?

Accepted Answer

Sensitive PII. Names, addresses, and Social Security numbers are the textbook definition of Sensitive PII (Personally Identifiable Information) because they can uniquely identify an individual and, in the case of SSNs, enable identity theft. SSNs are considered highly sensitive regulated data under laws such as GLBA and various state breach notification statutes. Therefore the compromised data falls squarely into the Sensitive PII category rather than any business or public classification.

Answer

Public data

Answer

Confidential business data

Answer

Internal data

Question 13

An organization is evaluating a new vendor that will process customer data. The security team performs a thorough assessment of the vendor's security controls and background checks. This process best demonstrates:

Accepted Answer

Due diligence. Due diligence is the ongoing process of investigation, assessment, and verification — performing a thorough security assessment and background checks on a vendor before engaging them is the textbook definition of exercising due diligence. It demonstrates that the organization took reasonable steps to understand and evaluate the risks involved. Due care, by contrast, is the ongoing action of maintaining that standard once the relationship exists.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Due care

Question 14

Which of the following controls is primarily designed to ensure availability?

Accepted Answer

Redundant servers. Redundant servers ensure availability by eliminating single points of failure — if one server fails, another continues to provide the service. This directly supports the availability leg of the CIA triad.

Answer

Encryption

Answer

Digital signatures

Answer

Access control lists

Question 15

A security analyst is implementing controls to prevent unauthorized disclosure of sensitive information. Which element of the CIA triad is being addressed?

Accepted Answer

Confidentiality. Confidentiality is the element of the CIA triad that ensures information is not disclosed to unauthorized individuals, entities, or processes. The scenario explicitly states the goal is to prevent unauthorized disclosure of sensitive information, which is the definition of confidentiality. Controls such as encryption, access control lists, and data classification directly support confidentiality. Therefore, option D is correct.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability