ISC2 CC Security Principles Practice Test 5 — 15 Questions

Question 1

A company stores customer PII including social security numbers and medical records. Under privacy principles, these data elements are best described as:

Accepted Answer

Sensitive PII. Sensitive PII is the correct classification because it includes data elements like Social Security numbers and medical records that, if disclosed, could cause significant harm, discrimination, or identity theft. Under privacy frameworks such as NIST SP 800-122 and GDPR, these are explicitly categorized as sensitive PII requiring stricter protection. Unlike general confidential data, sensitive PII has specific regulatory and compliance implications, including breach notification laws and mandatory safeguards.

Answer

Confidential data

Answer

Internal data

Answer

Public data

Question 2

Which of the following is a control that can reduce the risk of a DDoS attack?

Accepted Answer

Load balancing. Load balancing helps mitigate DDoS attacks by distributing incoming traffic across multiple servers, preventing any single server from being overwhelmed by a flood of requests. This increases the capacity and resilience of the infrastructure, making it harder for an attacker to exhaust resources. While not a complete DDoS solution, load balancing is a foundational control that reduces the impact of volumetric and application-layer attacks.

Answer

Access control lists

Answer

Encryption

Answer

Digital signatures

Question 3

When implementing multi-factor authentication, which combination of factors is considered strongest?

Accepted Answer

Smart card and biometric. Multi-factor authentication (MFA) requires combining factors from different categories: something you know (password, PIN), something you have (smart card, token), and something you are (biometric). The strongest combination uses factors from separate categories, such as a smart card (something you have) and a biometric (something you are). This provides defense in depth because compromising one factor does not compromise the other.

Answer

Password and PIN

Answer

Password and security question

Answer

Biometric and fingerprint

Question 4

A security manager is advised to implement 'due care' in their organization. Which action best exemplifies due care?

Accepted Answer

Regularly updating antivirus software. Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

Answer

Purchasing cyber insurance

Answer

Performing a background check on a new vendor

Answer

Accepting the risk of a legacy system

Question 5

An organization wants to ensure that an email message has not been altered during transmission. Which security control should be used?

Accepted Answer

Digital signature. A digital signature uses the sender's private key to cryptographically sign the message hash, allowing the recipient to verify both the origin and that the message was not altered in transit. Any modification to the message invalidates the signature because the recomputed hash will not match. This provides integrity and non-repudiation, which is exactly what the organization needs.

Answer

Access control

Answer

Encryption

Answer

Load balancing

Question 6

A security professional is reviewing authentication methods. Which TWO are examples of Type 2 (possession) factors? (Select TWO)

Accepted Answer

A hardware OTP token. A hardware OTP token (B) is correct because it is a physical device the user must possess, and it generates one-time passcodes, making it a classic Type 2 possession factor. A smart card (E) is also correct because it is a physical object the user holds and inserts or taps to authenticate, fitting the possession category. In contrast, a PIN (A) and a password (D) are knowledge factors (Type 1) because they rely on something the user knows, and a fingerprint (C) is an inherence factor (Type 3) because it relies on a biometric characteristic of the user.

Answer

A PIN

Answer

A fingerprint

Answer

A password

Question 7

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk acceptance (A) is a valid risk management strategy because the organization consciously decides to tolerate the identified risk without taking action, often when the cost of mitigation exceeds the potential impact. Risk transfer (D) is a strategy that shifts the financial impact of a risk to a third party, typically through insurance or outsourcing contracts. Risk mitigation (E) is a strategy that reduces the probability or impact of a risk by implementing controls, making it a core risk-handling approach. Risk assessment (B) and risk analysis (C) are not strategies themselves; they are earlier processes used to identify, evaluate, and prioritize risks before a response strategy is selected.

Answer

Risk assessment

Answer

Risk analysis

Question 8

Which TWO of the following are examples of integrity controls? (Select TWO)

Accepted Answer

Digital signatures. Digital signatures (B) are an integrity control because they use asymmetric cryptography to create a verifiable value over a message, allowing the recipient to detect any modification to the data and confirm the signer's identity. Hashing (E) is also an integrity control because a cryptographic hash function such as SHA-256 produces a fixed-length digest that changes if even one bit of the input changes, enabling detection of unauthorized alteration. Redundancy (A) primarily supports availability by duplicating components or data, not by detecting modification. Firewalls (C) are network access controls that enforce confidentiality and availability boundaries rather than data integrity. Encryption (D) is chiefly a confidentiality control, since it protects data from disclosure, although it may incidentally hinder tampering.

Answer

Redundancy

Answer

Firewalls

Answer

Encryption

Question 9

Which of the following is an example of a physical control that supports the availability principle of the CIA triad?

Accepted Answer

Redundant servers. Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.

Answer

Data encryption

Answer

Biometric authentication

Answer

Digital signatures

Question 10

An organization implements a policy requiring employees to use a smart card and a PIN to access the data center. This is an example of which type of authentication?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more different authentication factors: something you have (smart card), something you know (PIN), and optionally something you are (biometric). Here, the smart card is a possession factor and the PIN is a knowledge factor, so combining them satisfies MFA. This is the correct classification because the two factors are of different types, not just two instances of the same type.

Answer

Type 3 authentication

Answer

Single-factor authentication

Answer

Type 2 authentication only

Question 11

A security analyst discovers that a vendor's software contains a known vulnerability that could lead to data exposure. The analyst reports this to management. According to risk management principles, which action represents risk transfer?

Accepted Answer

Purchasing cyber insurance to cover potential losses. Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance or contractual agreements. Purchasing cyber insurance explicitly transfers the potential financial losses from data exposure to the insurer, which is the definition of risk transfer. The other options represent risk avoidance (discontinuing use), risk mitigation (patching), or risk acceptance (accepting and documenting).

Answer

Discontinuing use of the vendor's software

Answer

Installing a patch to fix the vulnerability

Answer

Accepting the risk and documenting the decision

Question 12

Which of the following best describes the purpose of due care in information security?

Accepted Answer

Implementing reasonable security measures to protect data. Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

Answer

Prioritizing security incidents based on impact

Answer

Transferring risk to a third party

Answer

Investigating a vendor's background before contracting

Question 13

A company stores customer records that include names, addresses, and Social Security numbers. According to ISC2 Code of Ethics, which canon has the highest priority when handling this sensitive data?

Accepted Answer

Protect society, the common good, and the public trust. The ISC2 Code of Ethics explicitly orders its canons by priority, with the protection of society, the common good, and the public trust as the highest. When handling sensitive data like SSNs, the potential harm to individuals and society from a breach outweighs obligations to clients or the profession. This canon ensures that security professionals prioritize the safety and well-being of the public above all else.

Answer

Act honorably, honestly, justly, and responsibly

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Question 14

An organization labels its financial reports as "Confidential" and requires encryption at rest and in transit. This is an example of:

Accepted Answer

Data classification. Labeling data as 'Confidential' and applying handling requirements like encryption at rest and in transit is data classification — the process of categorizing data by sensitivity to determine appropriate protection. The label drives the controls, which is the essence of classification.

Answer

Data retention

Answer

Data obfuscation

Answer

Data masking

Question 15

Which of the following ensures that data has not been tampered with during transmission?

Accepted Answer

Hashing. Hashing ensures data integrity by producing a fixed-length digest from the original data; if even one bit changes during transmission, the resulting hash will differ, allowing the receiver to detect tampering. Common algorithms include SHA-256 and MD5 (though MD5 is deprecated for security). Hashing is specifically designed to verify that data has not been altered, which is the definition of integrity.

Answer

Redundancy

Answer

Encryption

Answer

Authentication