ISC2 CC Security Principles Practice Test 4 — 15 Questions

Question 1

A security manager is advised to implement 'due care' in their organization. Which action best exemplifies due care?

Accepted Answer

Regularly updating antivirus software. Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

Answer

Purchasing cyber insurance

Answer

Performing a background check on a new vendor

Answer

Accepting the risk of a legacy system

Question 2

An organization wants to ensure that an email message has not been altered during transmission. Which security control should be used?

Accepted Answer

Digital signature. Digital signatures provide integrity and non-repudiation by detecting any changes to the message.

Answer

Access control

Answer

Encryption

Answer

Load balancing

Question 3

A security professional is reviewing authentication methods. Which TWO are examples of Type 2 (possession) factors? (Select TWO)

Accepted Answer

A hardware OTP token. Type 2 factors are something you have; a smart card and a hardware token are physical devices.

Answer

A PIN

Answer

A fingerprint

Answer

A password

Question 4

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk management strategies include acceptance, mitigation, transfer, and avoidance. Acceptance, mitigation, and transfer are correct.

Answer

Risk assessment

Answer

Risk analysis

Question 5

Which TWO of the following are examples of integrity controls? (Select TWO)

Accepted Answer

Digital signatures. Hashing and digital signatures are integrity controls that verify data has not been altered.

Answer

Redundancy

Answer

Firewalls

Answer

Encryption

Question 6

Which of the following is an example of a physical control that supports the availability principle of the CIA triad?

Accepted Answer

Redundant servers. Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.

Answer

Data encryption

Answer

Biometric authentication

Answer

Digital signatures

Question 7

An organization implements a policy requiring employees to use a smart card and a PIN to access the data center. This is an example of which type of authentication?

Accepted Answer

Multi-factor authentication. Multi-factor authentication combines two or more types: smart card (possession) and PIN (knowledge).

Answer

Type 3 authentication

Answer

Single-factor authentication

Answer

Type 2 authentication only

Question 8

A security analyst discovers that a vendor's software contains a known vulnerability that could lead to data exposure. The analyst reports this to management. According to risk management principles, which action represents risk transfer?

Accepted Answer

Purchasing cyber insurance to cover potential losses. Risk transfer shifts the financial impact to another party, such as through cyber insurance.

Answer

Discontinuing use of the vendor's software

Answer

Installing a patch to fix the vulnerability

Answer

Accepting the risk and documenting the decision

Question 9

Which of the following best describes the purpose of due care in information security?

Accepted Answer

Implementing reasonable security measures to protect data. Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

Answer

Prioritizing security incidents based on impact

Answer

Transferring risk to a third party

Answer

Investigating a vendor's background before contracting

Question 10

A company stores customer records that include names, addresses, and Social Security numbers. According to ISC2 Code of Ethics, which canon has the highest priority when handling this sensitive data?

Accepted Answer

Protect society, the common good, and the public trust. The Code of Ethics prioritizes: Protect society, the common good, and the public trust first.

Answer

Act honorably, honestly, justly, and responsibly

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Question 11

An organization labels its financial reports as "Confidential" and requires encryption at rest and in transit. This is an example of:

Accepted Answer

Data classification. Data classification determines handling requirements (e.g., encryption for confidential data).

Answer

Data retention

Answer

Data obfuscation

Answer

Data masking

Question 12

Which of the following ensures that data has not been tampered with during transmission?

Accepted Answer

Hashing. Integrity ensures data accuracy and completeness; hashing detects changes.

Answer

Redundancy

Answer

Encryption

Answer

Authentication

Question 13

A security team implements a load balancer to distribute traffic across multiple web servers. This control primarily supports which principle?

Accepted Answer

Availability. Load balancing helps ensure availability by preventing server overload.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 14

Which of the following is an example of a Type 1 authentication factor?

Accepted Answer

PIN code. Type 1 is knowledge-based, such as a password.

Answer

One-time password (OTP) token

Answer

Smart card

Answer

Fingerprint scan

Question 15

After a security breach, the organization conducts a background check on a new vendor before signing a contract. This practice is known as:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before acting.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Due care