ISC2 CC Security Principles Practice Test 2 — 15 Questions

Question 1

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Accepted Answer

Least privilege. Allowing root login via SSH violates the principle of least privilege because it grants unrestricted administrative access to the system, bypassing any need for privilege escalation. In a properly secured SSH configuration, root login should be disabled (e.g., `PermitRootLogin no` in `/etc/ssh/sshd_config`), forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures that actions are auditable and tied to a specific user account.

Answer

Fail-safe

Answer

Defense in depth

Answer

Separation of duties

Question 2

An analyst reviews the exhibit. What security principle is best demonstrated by this policy?

Accepted Answer

Least privilege. The policy grants users only the permissions necessary to perform their job functions, which is the core definition of least privilege. By restricting access to only required resources, the policy minimizes the attack surface and limits potential damage from compromised accounts.

Answer

Separation of duties

Answer

Defense in depth

Answer

Non-repudiation

Question 3

An administrator reviews the exhibit. Which security principle is being violated?

Accepted Answer

Least privilege. The user has write access to HR documents, which may not be necessary for their role, violating least privilege.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Accountability

Question 4

A mid-sized company has a network with 200 employees. The security team has implemented a policy that requires all employees to use complex passwords and change them every 60 days. However, the company has experienced multiple phishing attacks where employees have willingly provided their credentials to fake websites. The CEO wants to implement a more robust authentication method. The company uses Microsoft Active Directory and has a budget for new security tools. They also have a remote workforce. Which of the following is the BEST course of action to address the phishing risk?

Accepted Answer

Deploy multi-factor authentication (MFA) for all remote access and critical systems. Multi-factor authentication (MFA) significantly reduces the risk of credential theft because even if a password is phished, the attacker cannot authenticate without the second factor. The other options either do not address phishing directly or are less effective.

Answer

Increase password complexity requirements and change frequency to every 30 days

Answer

Conduct annual phishing awareness training

Answer

Implement a password manager for all employees

Question 5

A financial services firm has a data center that houses customer financial records. They have implemented a defense-in-depth strategy including firewalls, IDS/IPS, and encryption. Recently, an internal audit revealed that a junior administrator has been logging into the database server with a shared admin account and has made unauthorized changes to customer records. The company wants to prevent such incidents in the future while maintaining operational efficiency. The current environment uses Linux servers with PostgreSQL databases. There is no centralized authentication system. What is the BEST action to take?

Accepted Answer

Disable all shared accounts and implement individual accounts with role-based access control and audit logging. The core issue is the lack of accountability due to a shared admin account. Disabling shared accounts and implementing individual accounts with role-based access control (RBAC) and audit logging directly addresses this by ensuring each action is tied to a specific user, enabling non-repudiation and precise forensic analysis. This aligns with the principle of least privilege and is the most effective way to prevent unauthorized changes while maintaining operational efficiency through granular permission management.

Answer

Increase the frequency of password changes for the shared admin account

Answer

Use database encryption to prevent unauthorized changes

Answer

Implement a network access control (NAC) solution to restrict database access to specific IP addresses

Question 6

A security administrator notices that a user with standard privileges was able to modify a system file. Which security principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege requires that users be granted only the permissions necessary to perform their job functions. A standard user modifying a system file indicates they have been assigned unnecessary administrative rights, violating this principle. This could occur if the user is a member of a group like Administrators or has been granted explicit write access to protected directories such as %SystemRoot%\System32.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 7

A company deploys a web application firewall (WAF), performs regular vulnerability scans, and implements strict access controls. Which security principle is being applied?

Accepted Answer

Defense in depth. Defense in depth is the security principle of layering multiple independent security controls so that if one fails, others still provide protection. The question describes three distinct layers: a WAF (application-layer filtering), vulnerability scanning (proactive detection), and strict access controls (preventive policy). This stacking of different types of controls across the network, host, and application layers is the textbook definition of defense in depth.

Answer

Accountability

Answer

Risk management

Answer

Least privilege

Question 8

An organization requires that two separate administrators approve and implement changes to firewall rules. This practice enforces which security principle?

Accepted Answer

Separation of duties. Requiring two separate administrators to approve and implement firewall rule changes enforces separation of duties. This principle ensures that no single individual has the authority to both authorize and execute a change, reducing the risk of unauthorized modifications or errors. In firewall management, this prevents a single admin from introducing malicious or misconfigured rules without oversight.

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 9

Which TWO of the following are core principles of information security?

Accepted Answer

Integrity. The core principles of information security are the CIA triad: Confidentiality, Integrity, and Availability. Integrity (B) ensures data has not been altered or tampered with, typically verified through hashing algorithms like SHA-256 or HMAC. Confidentiality (C) protects data from unauthorized access, often enforced via encryption (e.g., AES-256). These three form the foundational security model, while other options are supporting mechanisms.

Answer

Authentication

Answer

Non-repudiation

Answer

Availability

Question 10

Refer to the exhibit. What action did the firewall take on the traffic from 10.0.1.15 to 10.0.2.10?

Accepted Answer

Denied the traffic. The firewall denied the traffic from 10.0.1.15 to 10.0.2.10 because the access control list (ACL) or security policy explicitly denies the source IP 10.0.1.15, as shown in the exhibit. The firewall processes rules sequentially, and the first matching rule for this traffic is a deny entry, so the packet is dropped without further inspection or logging unless specified.

Answer

Logged and permitted

Answer

Permitted the traffic

Answer

Translated the source address

Question 11

A small e-commerce company hosts its web application on a single server with a public IP address. The server runs a Linux OS with Apache, MySQL, and PHP. The company recently experienced a data breach where an attacker gained access to the customer database. The investigation reveals that the attacker exploited a vulnerability in the PHP application to execute arbitrary commands. The server logs show that the attacker used an unauthenticated HTTP POST request to a legacy script that should have been removed. Additionally, the server had default firewall rules allowing all inbound traffic on ports 80 and 443. The company wants to prevent future breaches without redesigning the entire application. Which course of action is the most effective?

Accepted Answer

Implement a web application firewall (WAF) with virtual patching for the vulnerability.. Option D is the most effective because it provides immediate protection against the exploited vulnerability without requiring application redesign. A WAF with virtual patching can inspect HTTP POST requests to the legacy script and block malicious payloads, even if the underlying code remains vulnerable. This approach addresses the root cause (the unauthenticated exploit) while allowing the company to maintain operations and plan a permanent fix.

Answer

Move the database to a separate internal server and require VPN access for administration.

Answer

Upgrade the PHP version to the latest release and enable SELinux.

Answer

Remove the legacy script and update the firewall to block all traffic except necessary IPs.

Question 12

A company's security policy requires that all data at rest be encrypted. Which of the following is the BEST approach to ensure compliance while maintaining performance?

Accepted Answer

Deploy full disk encryption on all endpoints and servers.. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all data at rest, ensuring compliance with a policy requiring all data at rest to be encrypted. FDE operates at the block level, typically using AES-256, with minimal performance overhead because encryption and decryption are handled by the disk controller or CPU with hardware acceleration (e.g., AES-NI), making it the best approach for maintaining performance while meeting the broad requirement.

Answer

Use database encryption to protect sensitive data.

Answer

Apply network encryption using TLS for all data transfers.

Answer

Implement file-level encryption for sensitive files only.

Question 13

A security administrator notices that an employee is able to access files in a project folder they should not have access to. Which security principle is being violated?

Accepted Answer

Least privilege. The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Defense in depth

Question 14

A company is designing a new application that processes credit card payments. They want to ensure that no single administrator can bypass security controls to approve a fraudulent transaction. Which principle should be implemented?

Accepted Answer

Separation of duties. Separation of duties ensures that no single administrator has the authority to both initiate and approve a credit card transaction. By dividing critical functions among multiple individuals, the company prevents a single compromised account from authorizing fraudulent payments. This principle directly addresses the risk of insider threats or credential misuse in payment processing systems.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 15

An organization wants to ensure that data remains unaltered during transmission over the internet. Which security goal is being addressed?

Accepted Answer

Integrity. Integrity ensures that data is not altered during transmission, typically verified through cryptographic hash functions (e.g., SHA-256) or message authentication codes (MACs) such as HMAC. Protocols like TLS use integrity checks to detect any unauthorized modification of packets in transit, directly addressing the requirement that data remains unaltered.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

ISC2 CC Security Principles Practice Test 2 — 15 Questions

Exhibit

ISC2 CC Security Principles Practice Test 2 — 15 Questions

Exhibit