ISC2 CC Security Principles Practice Test 3 — 15 Questions

Question 1

A security team is designing a network for a hospital. They need to ensure that patient data is accessible to doctors only when needed, but also protected from unauthorized access. Which principle BEST balances these requirements?

Accepted Answer

Balancing the CIA triad. The question asks for the principle that best balances accessibility with protection. The CIA triad (Confidentiality, Integrity, Availability) is the foundational model for balancing these three competing priorities. In a hospital network, doctors need availability of patient data when needed, but confidentiality must protect against unauthorized access; balancing the triad means making trade-offs between these goals, such as using role-based access controls to ensure availability for authorized users while enforcing confidentiality. Option D directly addresses this balancing act, whereas the other options focus on a single aspect.

Answer

Defense in depth

Answer

Least privilege

Answer

Non-repudiation

Question 2

A company's security policy mandates that all changes to the firewall configuration must be approved by two different administrators before implementation. This is an example of which security principle?

Accepted Answer

Separation of duties. Option C is correct because the requirement for two different administrators to approve firewall configuration changes enforces separation of duties. This principle ensures that no single individual has the authority to make unilateral changes, reducing the risk of unauthorized or malicious modifications. In firewall management, this prevents a single admin from bypassing security controls or introducing backdoors without oversight.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 3

An organization is implementing a new identity management system. They want to ensure that users can only access resources necessary for their job roles. Which principle should guide the access control design?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions and nothing more. In an identity management system, this is implemented by assigning minimal access rights to resources, reducing the attack surface and limiting potential damage from compromised accounts. This directly aligns with the scenario of ensuring users can only access resources essential for their roles.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 4

Which TWO of the following are core components of the ISC2 Code of Ethics? (Choose two.)

Accepted Answer

Advance and protect the profession.. Option A is correct because the ISC2 Code of Ethics explicitly requires members to 'advance and protect the profession' as one of its four mandatory canons. This means acting honorably, maintaining competence, and not engaging in conduct that brings discredit upon the profession. It is a core ethical duty for all certified professionals.

Answer

Disclose all confidential information to law enforcement.

Answer

Ensure maximum profitability for the organization.

Answer

Always follow orders from management.

Question 5

Which THREE of the following are recognized security control types according to ISC2? (Choose three.)

Accepted Answer

Technical. Option B (Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.

Answer

Deterrent

Answer

Operational

Question 6

A mid-sized financial services company has recently experienced a security incident where an attacker gained access to the internal network through a compromised VPN account. The account belonged to a remote employee who had been granted full network access. The company's security team is now reviewing their security principles to prevent a recurrence. The company has 500 employees, with 50 remote workers. They use a traditional perimeter-based firewall and VPN for remote access. The incident revealed that the compromised account had access to the entire internal network, including sensitive financial databases. The security team is considering implementing a new access control model. They have identified the following requirements: (1) Remote workers should only access specific applications necessary for their roles, (2) Access should be granted based on identity and device posture, (3) Network segmentation should be enforced regardless of location. Which of the following approaches BEST addresses these requirements?

Accepted Answer

Adopt a Zero Trust Architecture (ZTA) that uses an identity-aware proxy and micro-segmentation.. Zero Trust Architecture (ZTA) aligns with all three requirements: it verifies identity and device posture, grants least privilege access to specific applications, and enforces micro-segmentation regardless of location. VPN with MFA (A) still grants broad network access. Network segmentation (B) alone does not incorporate identity or device posture. Least privilege (D) is a principle, not an architecture; implementing it without ZTA may not provide the granular control needed.

Answer

Implement multi-factor authentication on the existing VPN and enforce stricter password policies.

Answer

Create separate VLANs for each department and restrict inter-VLAN routing with ACLs.

Answer

Apply the principle of least privilege by reducing user permissions on the network and servers.

Question 7

A security analyst notices that a user's account has been used to access sensitive files outside of normal working hours from an unknown IP address. Which security principle is most directly violated?

Accepted Answer

Confidentiality. The scenario describes unauthorized access to sensitive files from an unknown IP address outside normal hours, which directly violates the principle of confidentiality. Confidentiality ensures that data is accessible only to authorized users and systems, and this breach indicates that sensitive information may have been exposed to an unauthorized party.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 8

Drag and drop the steps to perform a password reset on a Windows user account into the correct order.

Question 9

Drag and drop the steps to configure a wireless access point with WPA2-PSK security into the correct order.

Question 10

Match each type of malware to its primary behavior.

Question 11

Match each security policy type to its focus.

Question 12

A company requires employees to use biometric authentication to access the data center. This is an example of which security principle?

Accepted Answer

Authentication. Correct: D - Authentication. Authentication is the process of verifying the identity of a user, and biometrics is one method. Option A is wrong because non-repudiation ensures actions cannot be denied, not identity verification. Option B is wrong because availability ensures systems are accessible. Option C is wrong because integrity ensures data accuracy.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 13

An organization implements a rule that an employee cannot approve their own expenses. This is an example of which security principle?

Accepted Answer

Separation of duties. Correct: B - Separation of duties. Separation of duties prevents a single individual from having conflicting roles. Option A is wrong because least privilege limits access to only necessary resources. Option C is wrong because defense in depth uses multiple layers. Option D is wrong because accountability tracks actions to individuals.

Answer

Least privilege

Answer

Defense in depth

Answer

Accountability

Question 14

A security team configures a system to record all user activities for audit purposes. Which principle is being applied?

Accepted Answer

Accountability. Correct: A - Accountability. Accountability ensures actions can be traced to an individual through logging. Option B is wrong because authentication verifies identity. Option C is wrong because confidentiality prevents unauthorized disclosure. Option D is wrong because integrity ensures data accuracy.

Answer

Integrity

Answer

Authentication

Answer

Confidentiality

Question 15

After a ransomware attack, the company wants to ensure that critical data can be restored. Which principle is being addressed?

Accepted Answer

Availability. Correct: C - Availability. Availability ensures data is accessible when needed, and backups are a key control. Option A is wrong because confidentiality prevents unauthorized disclosure. Option B is wrong because integrity ensures data accuracy. Option D is wrong because non-repudiation ensures actions cannot be denied.

Answer

Integrity

Answer

Confidentiality

Answer

Non-repudiation