ISC2 CC Security Principles Practice Test 6 — 15 Questions

Question 1

A security team implements a load balancer to distribute traffic across multiple web servers. This control primarily supports which principle?

Accepted Answer

Availability. A load balancer distributes incoming traffic across multiple web servers so that no single server becomes a bottleneck or single point of failure, directly supporting the availability principle of the CIA triad. If one server fails, the load balancer routes traffic to healthy nodes, keeping the service reachable. This is a classic availability control, not a confidentiality or integrity mechanism.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 2

Which of the following is an example of a Type 1 authentication factor?

Accepted Answer

PIN code. A Type 1 authentication factor is something you know, such as a password, PIN, or passphrase. A PIN code is a memorized secret, so it is a classic example of a knowledge-based factor. The other options represent different factor types: OTP token and smart card are something you have (Type 2), and fingerprint scan is something you are (Type 3).

Answer

One-time password (OTP) token

Answer

Smart card

Answer

Fingerprint scan

Question 3

After a security breach, the organization conducts a background check on a new vendor before signing a contract. This practice is known as:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before acting.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Due care

Question 4

What is the primary goal of data classification?

Accepted Answer

To determine the appropriate level of security controls. Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements so that appropriate security controls (encryption, access control, retention, handling procedures) can be applied proportionally. Its primary purpose is to ensure that protection levels match the data's risk profile. This is the foundational step in any data governance or security program.

Answer

To improve data access speed

Answer

To comply with marketing requirements

Answer

To reduce storage costs

Question 5

An organization uses a digital signature to verify the authenticity of a software update. This supports which part of the CIA triad?

Accepted Answer

Integrity. A digital signature provides integrity by using a hash of the message encrypted with the sender's private key; the recipient decrypts the hash with the public key and compares it to a freshly computed hash. If the values match, the data has not been altered. While digital signatures also provide authentication and non-repudiation, the question asks which CIA triad element is supported — integrity is the correct CIA component.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 6

Which TWO of the following are examples of sensitive PII? (Select TWO.)

Accepted Answer

Medical records. Sensitive PII includes medical records and biometrics. Name and email are general PII; IP address is not PII alone.

Answer

Name

Answer

Email address

Answer

IP address

Question 7

A company is implementing risk management for a new project. Which THREE of the following are valid risk treatment options? (Select THREE.)

Accepted Answer

Risk acceptance. Risk acceptance (A) is a valid risk treatment option because the organization consciously decides to tolerate the risk without taking action, often when the cost of mitigation exceeds the potential impact. Risk transfer (B) is valid because the organization shifts the financial impact of a risk to a third party, typically through insurance, outsourcing, or contracts. Risk mitigation (D) is valid because it involves taking actions to reduce the probability or impact of a risk, such as implementing controls or safeguards. Risk communication (C) is not a treatment option; it is an ongoing activity for sharing risk information among stakeholders. Risk analysis (E) is not a treatment option either; it is part of risk assessment, used to identify and evaluate risks before treatment decisions are made.

Answer

Risk communication

Answer

Risk analysis

Question 8

Which TWO of the following are examples of multi-factor authentication? (Select TWO.)

Accepted Answer

Password and SMS one-time code. Option B (Password and SMS one-time code) is correct because it combines two different authentication factor categories: something you know (the password) and something you have (the SMS one-time code delivered to your phone), which is the definition of multi-factor authentication. Option C (Biometric and PIN) is correct because it pairs something you are (the biometric, such as a fingerprint) with something you know (the PIN), satisfying the requirement for multiple distinct factor types. Option A is not multi-factor because a smart card and an RSA token are both something you have, so they belong to the same factor category. Option D is not multi-factor because a fingerprint and a retina scan are both inherence factors (something you are). Option E is not multi-factor because a password and a security question are both knowledge factors (something you know).

Answer

Smart card and RSA token

Answer

Fingerprint and retina scan

Answer

Password and security question

Question 9

An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption of data at rest and in transit directly protects data from unauthorized disclosure, which is the definition of confidentiality in the CIA triad. Encryption ensures that even if data is intercepted or accessed without authorization, it remains unreadable without the proper decryption key. This is the textbook control for the confidentiality principle.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 10

A security analyst implements a hashing algorithm to verify that a downloaded file has not been altered. Which security goal is being achieved?

Accepted Answer

Integrity. Hashing ensures data integrity by detecting changes.

Answer

Authentication

Answer

Availability

Answer

Confidentiality

Question 11

A multinational corporation deploys redundant servers in geographically diverse data centers and uses a load balancer to distribute traffic. This setup primarily addresses which security concern?

Accepted Answer

Availability. Redundancy and load balancing ensure that systems remain accessible, supporting availability.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 12

A user logs into a system using a password and a one-time passcode from a mobile authenticator app. This is an example of:

Accepted Answer

Multi-factor authentication. Using a password (something you know) and a one-time passcode from a mobile authenticator app (something you have) combines two different authentication factors: knowledge and possession. This is the definition of multi-factor authentication (MFA).

Answer

Biometric authentication

Answer

Two-step verification using same factor

Answer

Single-factor authentication

Question 13

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics Canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — takes precedence over all others. This reflects the profession's obligation to place the safety and welfare of society above client interests and professional advancement. When canons conflict, the higher-priority canon must guide the decision.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 14

A company performs background checks on potential employees before hiring. This action demonstrates which concept?

Accepted Answer

Due diligence. Due diligence is the investigation and verification process an organization performs before entering a relationship or making a decision — background checks on potential employees are a textbook example. It is the assessment step that informs risk decisions. Due care, by contrast, is the ongoing implementation of controls once a risk is identified.

Answer

Risk avoidance

Answer

Due care

Answer

Risk transfer

Question 15

A security team identifies that a server has a known vulnerability. A threat actor could exploit it to gain unauthorized access. The combination of these factors represents:

Accepted Answer

Risk. Risk is the combination of a threat exploiting a vulnerability, potentially leading to harm. Here, a threat actor could exploit a known vulnerability to gain unauthorized access, which represents a risk.

Answer

Threat

Answer

Control

Answer

Vulnerability