ISC2 CC Security Principles Practice Test 6 — 15 Questions

Question 1

Which data classification level typically requires the highest level of protection?

Accepted Answer

Top secret. Top secret is the highest classification and requires strict controls.

Answer

Internal

Answer

Confidential

Answer

Public

Question 2

A system administrator implements version control for all configuration files. Which principle is being strengthened?

Accepted Answer

Integrity. Version control helps ensure data accuracy and prevents unauthorized changes, supporting integrity.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 3

During a vendor risk assessment, a company discovers that a potential vendor has poor security practices. The company decides not to hire the vendor. This is an example of:

Accepted Answer

Risk avoidance. Risk avoidance involves eliminating the risk by not engaging in the activity.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 4

A security analyst is implementing controls to protect the integrity of a database. Which TWO of the following controls would best achieve this goal?

Accepted Answer

Digital signatures. Hashing and digital signatures both ensure data has not been altered.

Answer

Load balancing

Answer

Encryption

Answer

Redundant servers

Question 5

An organization is developing a data classification policy. Which THREE of the following are common classification levels?

Accepted Answer

Confidential. Public, confidential, and restricted are typical classification levels.

Answer

Critical

Answer

Sensitive

Question 6

An organization implements encryption for data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 7

A security administrator is configuring a system to detect unauthorized changes to critical files by calculating and storing a hash value for each file. Which security goal is primarily supported?

Accepted Answer

Integrity. Hashing ensures that any modification to the file can be detected, supporting integrity.

Answer

Authentication

Answer

Confidentiality

Answer

Availability

Question 8

After a major DDoS attack, a company deploys redundant internet connections and load balancers to ensure continued access to its web services. Which principle of the CIA triad is being strengthened?

Accepted Answer

Availability. Redundancy and load balancing help maintain access for authorized users, supporting availability.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Integrity

Question 9

Which of the following is an example of Type 2 authentication?

Accepted Answer

Smart card. Type 2 authentication relies on something the user possesses, such as a smart card or token.

Answer

Fingerprint scan

Answer

Password

Answer

Question 10

An organization requires employees to enter a password and then approve a push notification on their mobile device to access the corporate network. What type of authentication is this?

Accepted Answer

Two-factor authentication. Combining a password (Type 1) and a mobile device approval (Type 2) constitutes multi-factor authentication.

Answer

Biometric authentication

Answer

Multi-layer authentication

Answer

Single-factor authentication

Question 11

A security consultant is evaluating a vendor's security practices before signing a contract. The consultant reviews the vendor's security policies, incident response plans, and conducts background checks on key personnel. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying security practices before making a decision, such as vendor risk assessment.

Answer

Risk avoidance

Answer

Due care

Answer

Risk mitigation

Question 12

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The Code of Ethics prioritizes protecting society first, then acting honorably, providing diligent service, and advancing the profession.

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 13

Which of the following is considered Sensitive PII?

Accepted Answer

Social Security Number. Sensitive PII includes information that could cause harm if disclosed, such as medical records, financial account numbers, and biometric data.

Answer

Email address

Answer

Phone number

Answer

Name

Question 14

A company classifies its data into four categories: Public, Internal, Confidential, and Restricted. Which classification requires the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification, often equated with top secret, requiring stringent controls.

Answer

Internal

Answer

Public

Answer

Confidential

Question 15

An organization decides to accept the risk of using an older software version known to have vulnerabilities because the cost of upgrading outweighs the potential impact. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation