ISC2 CC Security Principles Practice Test 7 — 15 Questions

Question 1

A company decides to accept the risk of using a legacy system because the cost of replacing it exceeds potential losses. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and not taking further action.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation

Question 2

Which data classification level typically requires the highest level of protection?

Accepted Answer

Top secret. Top secret is the highest classification and requires strict controls.

Answer

Internal

Answer

Confidential

Answer

Public

Question 3

A system administrator implements version control for all configuration files. Which principle is being strengthened?

Accepted Answer

Integrity. Version control helps ensure data accuracy and prevents unauthorized changes, supporting integrity.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 4

During a vendor risk assessment, a company discovers that a potential vendor has poor security practices. The company decides not to hire the vendor. This is an example of:

Accepted Answer

Risk avoidance. Risk avoidance is the correct answer because the company eliminates the risk entirely by deciding not to engage with the vendor. By not hiring the vendor, the company removes the possibility of any security incidents or data breaches that could arise from the vendor's poor security practices. This is a classic example of risk avoidance, where the risk is sidestepped rather than managed or shared.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 5

A security analyst is implementing controls to protect the integrity of a database. Which TWO of the following controls would best achieve this goal?

Accepted Answer

Digital signatures. Digital signatures (C) are correct because they provide integrity and authenticity by allowing the recipient to verify that the data has not been altered and that it originated from a trusted source, using asymmetric cryptography to sign and verify a hash of the data. Hashing (D) is correct because it produces a fixed-length digest of the database contents, so any modification to the data changes the hash value, enabling detection of unauthorized or accidental changes and thereby protecting integrity. Encryption (B) primarily provides confidentiality, not integrity, since ciphertext can still be modified without detection unless combined with a MAC or signature. Load balancing (A) and redundant servers (E) improve availability and performance through distribution and failover, but they do not detect or prevent unauthorized data modification, so they do not directly protect integrity.

Answer

Load balancing

Answer

Encryption

Answer

Redundant servers

Question 6

An organization implements encryption for data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 7

A security administrator is configuring a system to detect unauthorized changes to critical files by calculating and storing a hash value for each file. Which security goal is primarily supported?

Accepted Answer

Integrity. Hashing critical files and storing their hash values allows the administrator to later recompute the hash and compare it to the stored value. If the file contents change, the hash will differ, revealing unauthorized modification. This directly supports the security goal of integrity, which ensures data has not been altered in an unauthorized manner. Authentication, confidentiality, and availability are not the primary goals addressed by this mechanism.

Answer

Authentication

Answer

Confidentiality

Answer

Availability

Question 8

After a major DDoS attack, a company deploys redundant internet connections and load balancers to ensure continued access to its web services. Which principle of the CIA triad is being strengthened?

Accepted Answer

Availability. Redundancy and load balancing help maintain access for authorized users, supporting availability.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Integrity

Question 9

Which of the following is an example of Type 2 authentication?

Accepted Answer

Smart card. Type 2 authentication, also called 'something you have,' relies on a physical object the user possesses — a smart card is the classic example. Type 1 is 'something you know' (password, PIN), Type 2 is 'something you have' (smart card, token, phone), and Type 3 is 'something you are' (biometrics). The smart card fits Type 2 precisely.

Answer

Fingerprint scan

Answer

Password

Answer

Question 10

A security consultant is evaluating a vendor's security practices before signing a contract. The consultant reviews the vendor's security policies, incident response plans, and conducts background checks on key personnel. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying security practices before making a decision, such as vendor risk assessment.

Answer

Risk avoidance

Answer

Due care

Answer

Risk mitigation

Question 11

Which of the following is considered Sensitive PII?

Accepted Answer

Social Security Number. Sensitive PII is defined as personally identifiable information that, if disclosed, could cause harm or enable identity theft, and it typically includes data elements like Social Security Numbers, financial account numbers, and medical records. A Social Security Number is the canonical example because it is a unique government-issued identifier that can be used to open credit lines, file fraudulent tax returns, or impersonate the individual. Email addresses, phone numbers, and names are generally classified as non-sensitive PII because they are often publicly available and cannot alone be used to commit identity theft.

Answer

Email address

Answer

Phone number

Answer

Name

Question 12

A company classifies its data into four categories: Public, Internal, Confidential, and Restricted. Which classification requires the highest level of protection?

Accepted Answer

Restricted. In a four-tier classification scheme (Public, Internal, Confidential, Restricted), Restricted represents the most sensitive data — typically trade secrets, PII under regulation, or data whose breach causes severe legal/financial harm. It therefore requires the highest level of protection, including strict access controls, encryption, and audit logging.

Answer

Internal

Answer

Public

Answer

Confidential

Question 13

An organization decides to accept the risk of using an older software version known to have vulnerabilities because the cost of upgrading outweighs the potential impact. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance is the deliberate decision to acknowledge a risk and take no action to reduce it, typically because the cost of mitigation outweighs the potential impact. In this scenario, the organization has evaluated the risk and consciously chosen to retain it, which is the definition of risk acceptance. This is a valid risk response when the risk falls within the organization's risk appetite or when mitigation is not cost-effective.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation

Question 14

A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:

Accepted Answer

Risk mitigation. Risk mitigation reduces the likelihood or impact of a threat by implementing controls; a firewall and IDS are detective and preventive controls that lower the probability and severity of a network breach without eliminating the risk entirely. This is the textbook definition of mitigation — the risk still exists but is reduced to an acceptable level.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 15

A security analyst is designing a multi-factor authentication system for remote access. Which TWO of the following combinations represent true multi-factor authentication? (Select TWO)

Accepted Answer

Fingerprint and password. Option B (fingerprint and password) is correct because it combines a biometric inherence factor (the fingerprint) with a knowledge factor (the password), satisfying true MFA by mixing two different factor categories. Option C (password and smart card) is correct because it pairs a knowledge factor (the password) with a possession factor (the smart card, something you have), which are distinct factor types. Option A (smart card and OTP token) is not true MFA because both are possession factors (something you have), even though they are different technologies. Option D (fingerprint and retina scan) is not true MFA because both are biometric inherence factors (something you are). Option E (password and PIN) is not true MFA because both are knowledge factors (something you know).

Answer

Smart card and OTP token

Answer

Fingerprint and retina scan

Answer

Password and PIN