ISC2 CC Security Principles Practice Test 3 — 15 Questions

Question 1

An organization is implementing a risk management strategy for a new system. Which THREE actions are examples of risk mitigation?

Accepted Answer

Patching known vulnerabilities. Risk mitigation involves implementing controls to reduce risk. Installing firewalls, patching vulnerabilities, and training users all reduce risk.

Answer

Purchasing cyber insurance

Answer

Discontinuing a business process

Question 2

Which TWO of the following are examples of Type 3 (inherence) authentication factors?

Accepted Answer

Retina scan. Type 3 factors are biometric characteristics unique to an individual.

Answer

OTP token

Answer

Smart card

Answer

Password

Question 3

An organization implements full-disk encryption on all laptops. Which element of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption protects data from unauthorized disclosure, which is the goal of confidentiality.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 4

A security professional is asked to choose an authentication method for a high-security facility. The requirement is to use something the user 'is'. Which authentication type should be selected?

Accepted Answer

Type 3 – Inherence factor. Biometrics (fingerprint, retina, iris) fall under Type 3 (inherence) authentication, which checks 'something you are'.

Answer

Multi-factor authentication

Answer

Type 2 – Possession factor

Answer

Type 1 – Knowledge factor

Question 5

After a data breach, an organization discovers that an attacker exploited a known vulnerability in an outdated web server. The organization had previously identified the vulnerability but decided not to patch it due to potential downtime. Which risk management strategy did the organization employ?

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and its potential impact without taking action to reduce it.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 6

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

A security token generating a one-time passcode. Type 2 (possession) factors are items a user has, such as a smart card or OTP token.

Answer

A fingerprint

Answer

A password

Answer

A PIN

Question 7

An organization classifies data as 'confidential' and requires encryption at rest and in transit. Which data classification level is likely being used?

Accepted Answer

Confidential. Confidential data is sensitive and requires protection; it is a common classification level.

Answer

Public

Answer

Internal/Private

Answer

Restricted/Top Secret

Question 8

A security analyst is evaluating a new vendor for cloud services. The analyst reviews the vendor's security certifications, conducts background checks, and visits the data center. This process is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before making a decision, such as vendor risk assessment.

Answer

Due care

Answer

Governance

Answer

Risk acceptance

Question 9

According to the (ISC)² Code of Ethics, if a conflict arises between protecting society and providing diligent service to your employer, which should take precedence?

Accepted Answer

Protect society. The (ISC)² Code of Ethics has a priority order: protect society first, then act honorably, provide diligent service, and advance the profession.

Answer

Advance the profession

Answer

Act honorably

Answer

Provide diligent service

Question 10

A company uses redundant servers and automated failover to ensure that its website remains accessible during a server outage. Which principle of the CIA triad is being addressed?

Accepted Answer

Availability. Redundancy and failover ensure that authorized users can access systems when needed, which is availability.

Answer

Non-repudiation

Answer

Integrity

Answer

Confidentiality

Question 11

What is the primary purpose of hashing in information security?

Accepted Answer

To ensure data integrity. Hashing is used to verify data integrity by detecting changes to the data.

Answer

To provide availability

Answer

To encrypt data for confidentiality

Answer

To authenticate users

Question 12

Which of the following is an example of a vulnerability?

Accepted Answer

An unlocked server room door. A vulnerability is a weakness that can be exploited. An unpatched software flaw is a classic example.

Answer

A malicious hacker attempting to gain access

Answer

A firewall blocking unauthorized traffic

Answer

The risk of data loss

Question 13

A company stores customer PII including social security numbers and medical records. Under privacy principles, these data elements are best described as:

Accepted Answer

Sensitive PII. Medical records and SSNs are examples of sensitive PII that require additional protection.

Answer

Confidential data

Answer

Internal data

Answer

Public data

Question 14

Which of the following is a control that can reduce the risk of a DDoS attack?

Accepted Answer

Load balancing. Load balancers can distribute traffic and absorb some DDoS attacks; DDoS protection services are also common controls.

Answer

Access control lists

Answer

Encryption

Answer

Digital signatures

Question 15

When implementing multi-factor authentication, which combination of factors is considered strongest?

Accepted Answer

Smart card and biometric. Multi-factor authentication (MFA) requires combining two or more different types of factors. The three categories are: something you know (Type 1), something you have (Type 2), and something you are (Type 3). A smart card falls under Type 2 (possession), while a biometric falls under Type 3 (inherence). Combining two different categories is stronger than using two factors from the same category, such as password and PIN (both Type 1) or biometric and fingerprint (both Type 3).

Answer

Password and PIN

Answer

Password and security question

Answer

Biometric and fingerprint