ISC2 CC Security Principles Practice Test 7 — 15 Questions

Question 1

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited. A vulnerability is a weakness that can be exploited by a threat to cause harm.

Answer

A potential cause of an unwanted incident

Answer

The likelihood of a threat exploiting a weakness

Answer

A measure that reduces risk

Question 2

A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:

Accepted Answer

Risk mitigation. Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 3

A security analyst is designing a multi-factor authentication system for remote access. Which TWO of the following combinations represent true multi-factor authentication? (Select TWO)

Accepted Answer

Fingerprint and password. Multi-factor requires at least two different types. A password (Type 1) and smart card (Type 2) are different factors. A fingerprint (Type 3) and password (Type 1) are also different factors.

Answer

Smart card and OTP token

Answer

Fingerprint and retina scan

Answer

Password and PIN

Question 4

An organization is conducting a risk assessment. Which THREE of the following are considered assets? (Select THREE)

Accepted Answer

Customer database. Assets are items of value to the organization, including data, hardware, and personnel.

Answer

Probability of a data breach

Answer

Vulnerability in software

Question 5

A security policy requires that data classified as 'Confidential' must be encrypted both at rest and in transit. Which TWO of the following are likely data handling requirements for 'Confidential' data? (Select TWO)

Accepted Answer

Access to data must be restricted to authorized personnel only. Confidential data typically requires encryption and strict access controls. Public posting would be inappropriate.

Answer

Data may be posted on the public website

Answer

Data can be shared with any vendor without a contract

Answer

Data must be deleted after 30 days regardless of business need

Question 6

Which security principle ensures that data cannot be accessed by unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals, systems, or processes.

Answer

Integrity

Answer

Non-repudiation

Answer

Availability

Question 7

An organization uses hashing to ensure that data has not been altered during transmission. Which security principle is being implemented?

Accepted Answer

Integrity. Hashing verifies data integrity by detecting changes to the original data.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 8

Which authentication type is a smart card an example of?

Accepted Answer

Type 2 (possession). Smart cards are physical devices that a user possesses, making them Type 2 (possession) authentication.

Answer

Type 1 (knowledge)

Answer

Type 3 (inherence)

Answer

Multi-factor

Question 9

A company implements redundant servers to ensure that if one server fails, another can take over immediately. Which security principle is primarily being addressed?

Accepted Answer

Availability. Redundancy supports availability by minimizing downtime.

Answer

Authentication

Answer

Integrity

Answer

Confidentiality

Question 10

An organization requires both a password and a fingerprint scan to access a secure system. This is an example of:

Accepted Answer

Multi-factor authentication. Combining a knowledge factor (password) and an inherence factor (fingerprint) constitutes multi-factor authentication.

Answer

Biometric authentication

Answer

Single-factor authentication

Answer

Two-step authentication

Question 11

According to the (ISC)² Code of Ethics, which obligation has the highest priority?

Accepted Answer

Protect society, the common good, and the public trust. The Code of Ethics states the highest priority is to protect society, the common good, and the public trust.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 12

What is the difference between due care and due diligence in security governance?

Accepted Answer

Due care refers to implementing security controls; due diligence refers to investigating risks and verifying controls. Due care is the minimum standard of care (implementing basic security), while due diligence is investigating before acting (e.g., vendor assessments).

Answer

Due care is proactive; due diligence is reactive

Answer

They are synonymous

Answer

Due diligence is required by law; due care is voluntary

Question 13

Which of the following is considered sensitive personally identifiable information (PII)?

Accepted Answer

Medical records. Sensitive PII includes medical records, financial information, and biometrics, which require extra protection.

Answer

Date of birth

Answer

Telephone number

Answer

Email address

Question 14

A security team identifies a vulnerability in a web application that could allow attackers to steal customer data. The team decides to accept the risk because the cost to fix exceeds the potential loss. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 15

An organization classifies data as 'Confidential' and requires encryption both at rest and in transit. Which data classification level best fits this requirement?

Accepted Answer

Confidential. Confidential data typically requires strong protection like encryption; restricted/top secret may require even higher controls.

Answer

Restricted/Top Secret

Answer

Internal/Private

Answer

Public