ISC2 CC Security Principles Practice Test 5 — 15 Questions

Question 1

What is the primary goal of data classification?

Accepted Answer

To determine the appropriate level of security controls. Data classification assigns sensitivity labels to enable appropriate protection.

Answer

To improve data access speed

Answer

To comply with marketing requirements

Answer

To reduce storage costs

Question 2

An organization uses a digital signature to verify the authenticity of a software update. This supports which part of the CIA triad?

Accepted Answer

Integrity. Digital signatures verify integrity and authenticity.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 3

Which TWO of the following are examples of sensitive PII? (Select TWO.)

Accepted Answer

Medical records. Sensitive PII includes medical records and biometrics. Name and email are general PII; IP address is not PII alone.

Answer

Name

Answer

Email address

Answer

IP address

Question 4

A company is implementing risk management for a new project. Which THREE of the following are valid risk treatment options? (Select THREE.)

Accepted Answer

Risk acceptance. Risk treatment options include mitigation, transfer, avoidance, and acceptance. All four are correct, but only three are listed.

Answer

Risk communication

Answer

Risk analysis

Question 5

Which TWO of the following are examples of multi-factor authentication? (Select TWO.)

Accepted Answer

Password and SMS one-time code. MFA requires two or more different factor types. Password (knowledge) + SMS code (possession) and smart card (possession) + fingerprint (inherence) qualify.

Answer

Smart card and RSA token

Answer

Fingerprint and retina scan

Answer

Password and security question

Question 6

An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption protects data from unauthorized disclosure, directly supporting confidentiality.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 7

A security analyst implements a hashing algorithm to verify that a downloaded file has not been altered. Which security goal is being achieved?

Accepted Answer

Integrity. Hashing ensures data integrity by detecting changes.

Answer

Authentication

Answer

Availability

Answer

Confidentiality

Question 8

A multinational corporation deploys redundant servers in geographically diverse data centers and uses a load balancer to distribute traffic. This setup primarily addresses which security concern?

Accepted Answer

Availability. Redundancy and load balancing ensure that systems remain accessible, supporting availability.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 9

Which of the following is an example of Type 2 (possession) authentication?

Accepted Answer

Smart card. A smart card is a physical item you possess, making it Type 2.

Answer

Answer

Password

Answer

Fingerprint scan

Question 10

A user logs into a system using a password and a one-time passcode from a mobile authenticator app. This is an example of:

Accepted Answer

Multi-factor authentication. Combining two different authentication types (knowledge and possession) is multi-factor authentication.

Answer

Biometric authentication

Answer

Two-step verification using same factor

Answer

Single-factor authentication

Question 11

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The first canon is to protect society, the common good, and the public trust.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 12

A company performs background checks on potential employees before hiring. This action demonstrates which concept?

Accepted Answer

Due diligence. Due diligence involves investigating before acting, such as background checks.

Answer

Risk avoidance

Answer

Due care

Answer

Risk transfer

Question 13

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 14

A security team identifies that a server has a known vulnerability. A threat actor could exploit it to gain unauthorized access. The combination of these factors represents:

Accepted Answer

Risk. Risk is the probability that a threat exploits a vulnerability, causing harm.

Answer

Threat

Answer

Control

Answer

Vulnerability

Question 15

A company decides to accept the risk of using a legacy system because the cost of replacing it exceeds potential losses. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and not taking further action.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation