ISC2 CC Security Principles — Timed 25 Questions

Question 1

Which principle of the CIA triad ensures that data is not disclosed to unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality is the principle that prevents unauthorized disclosure of information.

Answer

Authentication

Answer

Integrity

Answer

Availability

Question 2

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Type 2 authentication is based on possession, such as a smart card.

Answer

Answer

Password

Answer

Fingerprint

Question 3

An organization implements redundant servers and failover mechanisms to ensure continuous operation during a power outage. Which goal of the CIA triad is primarily being addressed?

Accepted Answer

Availability. Redundancy and failover ensure systems remain accessible, which supports availability.

Answer

Confidentiality

Answer

Integrity

Answer

Authentication

Question 4

According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?

Accepted Answer

Protect society. The Code of Ethics prioritizes protecting society, the common good, and the public trust.

Answer

Advance the profession

Answer

Act honourably

Answer

Provide diligent service

Question 5

A security analyst is reviewing a log that shows an unauthorized user attempted to modify a payroll database. Which security principle is most directly threatened?

Accepted Answer

Integrity. Unauthorized modification threatens integrity.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 6

A company is evaluating a new cloud service provider. As part of due diligence, they review the provider's security certifications, conduct a site visit, and check references. This process is an example of which risk management strategy?

Accepted Answer

Due diligence. Due diligence involves investigating before taking action to identify and assess risks.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 7

Which of the following is classified as sensitive PII?

Accepted Answer

Medical records. Sensitive PII includes medical records, financial data, and biometrics.

Answer

Email address

Answer

Telephone number

Answer

Date of birth

Question 8

Which risk management strategy involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Risk mitigation. Risk mitigation applies controls to reduce risk.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 9

A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?

Accepted Answer

Digital signature. Digital signatures provide integrity and non-repudiation.

Answer

Symmetric encryption

Answer

Access control list

Answer

Hashing

Question 10

An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?

Accepted Answer

Multi-factor. Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.

Answer

Possession-based

Answer

Biometric

Answer

Single-factor

Question 11

A vulnerability assessment reveals that a legacy system has unpatched software. The organization decides to accept the risk because the system is isolated and has compensating controls. This decision is an example of:

Accepted Answer

Risk acceptance. Risk acceptance is acknowledging the risk and deciding not to mitigate it.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 12

Which of the following best describes the difference between due care and due diligence in security governance?

Accepted Answer

Due care is the minimum standard of care; due diligence is the investigation and assessment. Due care is implementing basic security; due diligence is investigating and assessing risks.

Answer

Due care is proactive, due diligence is reactive

Answer

They are synonymous

Answer

Due care applies to vendors; due diligence applies to employees

Question 13

A security analyst is evaluating controls to protect the confidentiality of customer data. Which TWO of the following are effective controls? (Select TWO).

Accepted Answer

Encryption of data at rest. Encryption protects data at rest and in transit; access controls restrict unauthorized access.

Answer

Hashing of passwords

Answer

Redundant network links

Answer

Regular data backups

Question 14

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Restricted data includes trade secrets, classified government info, and biometric data.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 15

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication relies on biometric characteristics.

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 16

A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?

Accepted Answer

Integrity. File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 17

A company is deploying a multi-factor authentication (MFA) solution. Which combination represents two different authentication factors?

Accepted Answer

Smart card and PIN. MFA requires two or more different types: something you know (password), something you have (OTP token), and something you are (fingerprint).

Answer

Password and security question

Answer

OTP token and mobile authenticator app

Answer

Fingerprint and retina scan

Question 18

An organization decides to accept the risk of using a legacy system that cannot be patched due to critical business operations. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate, transfer, or avoid it.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 19

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. Type 2 factors are something you have, such as a physical token.

Answer

Answer

Password

Answer

Fingerprint

Question 20

According to the (ISC)² Code of Ethics, which principle has the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.

Answer

Act honorably

Answer

Advance the profession

Answer

Provide diligent service