ISC2 CC Security Principles Practice Test 8 — 15 Questions

Question 1

What is the primary purpose of a digital signature?

Accepted Answer

Provide non-repudiation and integrity. Digital signatures provide integrity by ensuring data has not been altered, and non-repudiation by proving the signer's identity and intent.

Answer

Ensure confidentiality

Answer

Authenticate users via password

Answer

Encrypt the data

Question 2

A company conducts a background check on a new vendor before signing a contract. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying a vendor's security posture and trustworthiness before engagement.

Answer

Risk avoidance

Answer

Due care

Answer

Risk transfer

Question 3

An organization wants to implement multi-factor authentication for remote access. Which TWO of the following would provide multi-factor authentication? (Select TWO)

Accepted Answer

Password and SMS one-time code. Multi-factor authentication requires combining at least two different factors: something you know (knowledge), something you have (possession), or something you are (inherence). Option C (Password + SMS one-time code) combines knowledge (password) and possession (SMS code sent to a device). Option D (Smart card + PIN) combines possession (smart card) and knowledge (PIN). Option A (Fingerprint + iris scan) is two inherence factors, not multi-factor. Option B (Password + security questions) is two knowledge factors. Option E (Two different passwords) is also two knowledge factors.

Answer

Fingerprint and iris scan

Answer

Password and security questions

Answer

Two different passwords

Question 4

Which THREE of the following are examples of risk mitigation? (Select THREE)

Accepted Answer

Implementing access controls to limit user permissions. Risk mitigation involves implementing controls to reduce risk. Installing antivirus, implementing access controls, and using encryption all reduce risk. Transferring risk to insurer is risk transfer, and accepting risk is risk acceptance.

Answer

Deciding not to fix a low-risk vulnerability due to cost

Answer

Purchasing cyber insurance

Question 5

An organization is developing a data classification policy. Which THREE of the following should be classified as Confidential or higher? (Select THREE)

Accepted Answer

Customer personally identifiable information (PII). Confidential data typically includes trade secrets, customer PII, and financial records. Public information and marketing brochures are public data.

Answer

Public company press releases

Answer

Marketing brochures

Question 6

Which of the following best describes the principle of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized disclosure of information. Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encryption and access controls are primary mechanisms to enforce confidentiality.

Answer

Ensuring data is accurate and complete

Answer

Verifying the identity of users

Answer

Ensuring systems and data are accessible when needed

Question 7

Which type of authentication factor involves something the user knows?

Accepted Answer

Type 1 (knowledge). Type 1 (knowledge) factors include passwords, PINs, and passphrases.

Answer

Type 2 (possession)

Answer

Type 4 (location)

Answer

Type 3 (inherence)

Question 8

A security analyst recommends implementing digital signatures to ensure that a software update has not been altered during distribution. Which aspect of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Digital signatures provide integrity by allowing verification that data has not been modified and confirming the source.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 9

An organization implements a redundant server infrastructure to ensure that services remain operational even if one server fails. This is an example of protecting which principle?

Accepted Answer

Availability. Redundancy ensures that systems remain available despite failures, directly supporting availability.

Answer

Integrity

Answer

Accountability

Answer

Confidentiality

Question 10

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

One-time passcode from a hardware token. Type 2 (possession) factors include something the user has, such as a smart card, OTP token, or mobile authenticator app.

Answer

Fingerprint scan

Answer

Password

Answer

Question 11

According to the (ISC)² Code of Ethics, which of the following has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics has four canons in order of priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; Advance and protect the profession.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 12

A company is evaluating a new cloud service provider and performs a thorough investigation of the provider's security practices and compliance with industry standards. This activity is best described as:

Accepted Answer

Due diligence. Due diligence involves investigating and assessing risks before making decisions, such as vendor selection.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Due care

Question 13

Which of the following are examples of sensitive PII? (Select all that apply.)

Accepted Answer

Medical records. Sensitive PII includes information that, if disclosed, could cause significant harm. Medical records and Social Security numbers are both considered sensitive PII because their exposure can lead to identity theft, discrimination, or other serious consequences. Phone numbers and name/email combinations are typically not classified as sensitive PII on their own.

Answer

Phone number

Answer

Name and email address

Question 14

In risk management, which term describes the probability that a threat will exploit a vulnerability and cause harm to an asset?

Accepted Answer

Risk. Risk is defined as the likelihood of a threat exploiting a vulnerability, resulting in harm to an asset.

Answer

Vulnerability

Answer

Control

Answer

Threat

Question 15

Which data classification level typically requires the highest level of protection and is reserved for information that could cause catastrophic harm if disclosed?

Accepted Answer

Restricted. Restricted or top secret classification is used for information that could cause exceptionally grave damage to the organization or nation if disclosed.

Answer

Confidential

Answer

Public

Answer

Internal