ISC2 CC Security Principles Practice Test 10 — 15 Questions

Question 1

A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?

Accepted Answer

Defense in depth. Defense in depth would have added additional controls such as network segmentation and access controls to prevent a single misconfiguration from compromising data. Option A (Fail securely) ensures secure state on failure. Option B (Complete mediation) checks every access. Option D (Least privilege) is about permissions.

Answer

Least privilege

Answer

Fail securely

Answer

Complete mediation

Question 2

A security engineer is designing a system that must ensure that any changes to a configuration file are logged with the identity of the person who made the change. Which principle is being implemented?

Accepted Answer

Non-repudiation. Non-repudiation provides proof of the identity of the person who performed an action, preventing denial. Option B (Accountability) is about tracking but not necessarily proof. Option C (Integrity) ensures data unchanged. Option D (Confidentiality) protects from unauthorized access.

Answer

Accountability

Answer

Confidentiality

Answer

Integrity

Question 3

An organization decides to implement multiple security controls, including firewalls, intrusion detection systems, and antivirus software. Which security principle does this represent?

Accepted Answer

Defense in depth. Defense in depth uses multiple layers of security controls to protect assets. Option A (Least privilege) is about access permissions. Option B (Separation of duties) divides tasks. Option D (Risk avoidance) eliminates risk.

Answer

Least privilege

Answer

Risk avoidance

Answer

Separation of duties

Question 4

A company implements role-based access control (RBAC) to ensure users have only the permissions necessary for their job roles. This is an example of:

Accepted Answer

Least privilege. RBAC enforces least privilege by granting permissions based on roles. Option A (Separation of duties) divides tasks. Option B (Need-to-know) restricts data access. Option C (Defense in depth) is layering controls.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 5

A system administrator accidentally grants a user full administrative rights instead of read-only. Which control would best detect this error?

Accepted Answer

Detective control. Detective controls, such as audit logs and monitoring, identify misconfigurations after they occur. Option B (Preventive) blocks errors. Option C (Corrective) fixes issues. Option D (Deterrent) discourages.

Answer

Preventive control

Answer

Deterrent control

Answer

Corrective control

Question 6

Which TWO of the following are examples of preventive security controls?

Accepted Answer

Antivirus software. Firewalls and antivirus software are preventive controls that block or stop attacks. IDS is detective, encryption is protective but not primarily preventive, and backup is corrective.

Answer

Encryption

Answer

Backup

Answer

Intrusion detection system

Question 7

A security policy requires that all changes to production systems be approved by a change management board. Which THREE of the following principles best support this requirement?

Accepted Answer

Non-repudiation. Separation of duties ensures approval and implementation are done by different people. Accountability ensures actions are traceable. Non-repudiation provides proof of approval. Least privilege and defense in depth are less directly related.

Answer

Defense in depth

Answer

Least privilege

Question 8

When designing a secure network, which TWO of the following are fundamental security principles that should be applied?

Accepted Answer

Fail secure. Fail secure ensures the system remains secure on failure. Least privilege restricts access to the minimum. The other options are important but less fundamental in network design.

Answer

Complete mediation

Answer

Open design

Answer

Economy of mechanism

Question 9

A small financial firm has a single server that hosts a critical database and also runs a web application. The server is located in a closet with a simple lock. An intern accidentally left the closet door open, and an unauthorized person gained physical access, connected a laptop to the server, and copied the database. The company wants to prevent such incidents in the future. Which of the following is the most effective course of action?

Accepted Answer

Move the database to a separate server and apply encryption.. Moving the database to a separate server and encrypting it reduces the risk of data theft from physical access. CCTV is detective, 2FA protects remote access, and strong ACLs can be bypassed with physical control of the server.

Answer

Require two-factor authentication for database access.

Answer

Implement strong access controls on the database files.

Answer

Install a CCTV camera in the server closet.

Question 10

A healthcare organization uses a legacy application that stores patient records in plain text. The IT team is planning to upgrade the system but needs to ensure compliance with HIPAA. The new system will be hosted on-premises and accessed by doctors and nurses via a web portal. The security team proposes implementing a VPN for remote access, but the CEO wants to allow access from any device without VPN for convenience. Which principle should guide the decision?

Accepted Answer

Defense in depth. Defense in depth emphasizes multiple layers of security; a VPN alone is insufficient to protect sensitive health records. The CEO's request sacrifices security for convenience, and risk acceptance is not the best approach when stronger controls are feasible.

Answer

Least privilege

Answer

Security is an enabler

Answer

Risk acceptance

Question 11

A multinational corporation has a policy that all sensitive emails must be digitally signed and encrypted. However, during a recent internal audit, it was discovered that many employees were not using digital signatures because the process was cumbersome. As a result, the company could not prove that certain emails were actually sent by the claimed sender. The security team needs to improve compliance without sacrificing security. Which of the following is the best approach?

Accepted Answer

Integrate the signing process seamlessly into the email client to reduce friction.. Integrating the signing process seamlessly into the email client reduces friction and increases compliance while maintaining security. Training alone does not address the cumbersome process, reducing encryption strength weakens security, and allowing personal certificates complicates management.

Answer

Implement a mandatory training program emphasizing the importance of digital signatures.

Answer

Reduce the encryption strength to speed up the signing process.

Answer

Allow employees to use personal signing certificates.

Question 12

A company is designing a secure network architecture for its new headquarters. The security team proposes implementing multiple layers of security controls, including firewalls, intrusion detection systems, and access control lists. Which security principle is being primarily applied?

Accepted Answer

Defense in depth. Correct: Defense in depth uses multiple layers of security to protect assets. Option A is wrong because least privilege limits access rights; Option B is wrong because separation of duties divides tasks among multiple people; Option D is wrong because need-to-know restricts access to information necessary for job functions.

Answer

Separation of duties

Answer

Least privilege

Answer

Need-to-know

Question 13

Which TWO of the following are fundamental principles of information security that form the CIA triad?

Accepted Answer

Confidentiality. Correct: Confidentiality and Integrity are part of the CIA triad. Option B (Non-repudiation) is not part of CIA; Option D (Accountability) is not; Option E (Privacy) is related but not a core CIA principle.

Answer

Privacy

Answer

Non-repudiation

Answer

Accountability

Question 14

Which TWO of the following are examples of implementing the principle of least privilege?

Accepted Answer

Assigning a database administrator only the permissions required for their specific tasks. Correct: Granting a user only read access to a file (A) and assigning a database administrator only the necessary permissions for their job (B) both restrict privileges to the minimum required. Option C is an example of defense in depth; Option D is a backup procedure; Option E is a physical control.

Answer

Installing a security camera at the data center entrance

Answer

Requiring two-factor authentication for system administrators

Answer

Implementing a firewall to block all incoming traffic except on port 443

Question 15

Which THREE of the following are key objectives of a security risk management program?

Accepted Answer

Assess risks. Correct: Identify risks (A), assess risks (B), and mitigate risks (C) are core steps. Option D and E are specific controls, not overarching objectives.

Answer

Implement intrusion detection systems

Answer

Encrypt all data at rest