ISC2 CC Security Principles Practice Test 9 — 15 Questions

Question 1

An organization is developing a data classification policy. Which THREE of the following should be classified as Confidential or higher? (Select THREE)

Accepted Answer

Customer personally identifiable information (PII). Option A (customer PII) is correct because personally identifiable information is regulated by laws such as GDPR and CCPA and its exposure can cause identity theft, so it must be classified Confidential or higher. Option C (financial records and projections) is correct because unaudited financials, forecasts, and internal accounting data are material non-public information whose disclosure can harm the organization or violate securities regulations. Option D (trade secrets and intellectual property) is correct because trade secrets derive their value from secrecy, and unauthorized disclosure destroys legal protection and competitive advantage. Option B (public company press releases) is not correct because press releases are intentionally published for public consumption and are therefore Public. Option E (marketing brochures) is not correct because marketing brochures are distributed externally to promote products and contain no sensitive data, making them Public as well.

Answer

Public company press releases

Answer

Marketing brochures

Question 2

Which of the following best describes the principle of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized disclosure of information. Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encryption and access controls are primary mechanisms to enforce confidentiality.

Answer

Ensuring data is accurate and complete

Answer

Verifying the identity of users

Answer

Ensuring systems and data are accessible when needed

Question 3

Which type of authentication factor involves something the user knows?

Accepted Answer

Type 1 (knowledge). Type 1 authentication is 'something you know' — knowledge factors such as passwords, PINs, or security questions. This is the classic knowledge-based factor and is correctly identified as Type 1 in the standard authentication factor taxonomy.

Answer

Type 2 (possession)

Answer

Type 4 (location)

Answer

Type 3 (inherence)

Question 4

A security analyst recommends implementing digital signatures to ensure that a software update has not been altered during distribution. Which aspect of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Digital signatures use cryptographic hashing and asymmetric encryption to verify that data has not been altered in transit or at rest, which directly addresses the Integrity pillar of the CIA triad. If even a single bit of the software update changes, the signature verification fails, proving tampering. While signatures also provide authentication and non-repudiation, the question specifically asks which CIA triad aspect is primarily addressed, and integrity is the correct mapping.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 5

An organization implements a redundant server infrastructure to ensure that services remain operational even if one server fails. This is an example of protecting which principle?

Accepted Answer

Availability. Redundant server infrastructure ensures that services remain operational even if one server fails, which directly supports the principle of availability. Availability ensures that systems and data are accessible to authorized users when needed.

Answer

Integrity

Answer

Accountability

Answer

Confidentiality

Question 6

According to the (ISC)² Code of Ethics, which of the following has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics canons are ordered by priority, and the first canon is to protect society, the common good, necessary public trust and confidence, and the infrastructure. This takes precedence over duties to principals, the profession, and self. The other canons follow in descending order.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 7

A company is evaluating a new cloud service provider and performs a thorough investigation of the provider's security practices and compliance with industry standards. This activity is best described as:

Accepted Answer

Due diligence. Due diligence involves investigating and assessing risks before making decisions, such as vendor selection.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Due care

Question 8

Which of the following are examples of sensitive PII? (Select all that apply.)

Accepted Answer

Medical records. Sensitive PII includes data that, if disclosed, could cause harm or be used for identity theft. Medical records and Social Security numbers are classic examples of sensitive PII because they contain highly confidential information. Phone numbers and name/email address are generally considered PII but not necessarily sensitive PII on their own.

Answer

Phone number

Answer

Name and email address

Question 9

In risk management, which term describes the probability that a threat will exploit a vulnerability and cause harm to an asset?

Accepted Answer

Risk. Risk is defined as the likelihood of a threat exploiting a vulnerability, resulting in harm to an asset.

Answer

Vulnerability

Answer

Control

Answer

Threat

Question 10

Which data classification level typically requires the highest level of protection and is reserved for information that could cause catastrophic harm if disclosed?

Accepted Answer

Restricted. 'Restricted' is the highest data classification level in most frameworks, reserved for information whose unauthorized disclosure could cause catastrophic harm to an organization, such as trade secrets, national security data, or highly sensitive personal information. It typically mandates the strictest controls, including encryption, need-to-know access, and often regulatory compliance requirements.

Answer

Confidential

Answer

Public

Answer

Internal

Question 11

A security team decides to implement multi-factor authentication for all remote access. Which combination of factors would constitute multi-factor authentication?

Accepted Answer

Smart card and fingerprint scan. Multi-factor authentication requires combining factors from at least two different categories: something you know (password, PIN), something you have (smart card, token), and something you are (biometrics). A smart card (something you have) plus a fingerprint scan (something you are) satisfies this requirement by combining two distinct factor types. This is the only option that crosses factor categories.

Answer

Fingerprint scan and retina scan

Answer

Two different passwords

Answer

Password and PIN

Question 12

An organization decides to purchase cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment strategy?

Accepted Answer

Risk transfer. Purchasing cyber insurance transfers the financial impact of a data breach to a third party (the insurer) in exchange for a premium. The organization still owns the risk event, but the monetary loss is shifted to the insurer, which is the textbook definition of risk transfer.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk avoidance

Question 13

An organization is implementing a new access control system. Which TWO of the following are examples of Type 3 authentication factors?

Accepted Answer

Fingerprint scan. Type 3 authentication factors are based on something you are — biometric characteristics — so option D (fingerprint scan) is correct because it verifies a unique physical trait of the user, and option E (retina scan) is correct because it measures the distinct vascular pattern of the eye's retina. Both are biometric methods that cannot easily be shared or forgotten, which is the defining property of Type 3 factors. Option A (password) is wrong because it is a Type 1 factor (something you know), and option C (PIN) is also a Type 1 factor (something you know). Option B (smart card) is wrong because it is a Type 2 factor (something you have).

Answer

Password

Answer

Smart card

Answer

Question 14

An organization is developing a security policy. Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. The CIA triad consists of Confidentiality, Integrity, and Availability. Authentication and Non-repudiation are related but not part of the core triad.

Answer

Authorization

Answer

Authentication

Answer

Non-repudiation

Question 15

A security analyst is implementing a solution to ensure that data transmitted between two servers cannot be read by unauthorized parties. Which security principle is the analyst primarily addressing?

Accepted Answer

Confidentiality. Confidentiality ensures that data is accessible only to authorized parties and is not disclosed to unauthorized individuals. Encrypting data in transit between two servers directly addresses confidentiality by rendering the data unreadable to eavesdroppers. This is the core goal of protocols like TLS, IPsec, and SSH, which the analyst would likely implement to satisfy this requirement.

Answer

Integrity

Answer

Availability

Answer

Authentication