ISC2 CC Security Principles Practice Test 7 — 15 Questions

Question 1

A security architect is designing access controls for a new application. The requirement is that only managers can approve expense reports above $10,000. Which control model best fits this requirement?

Accepted Answer

Rule-based access control (RuBAC). Rule-based access control (RuBAC) uses a set of rules or conditions to determine access decisions, such as the expense report amount exceeding $10,000. In this scenario, the access control decision depends on a dynamic attribute (the expense amount) rather than a static role or identity, making RuBAC the best fit. RuBAC is often implemented using access control lists (ACLs) or policy-based engines that evaluate conditions like 'if amount > 10000 then require manager approval'.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 2

A network administrator needs to ensure that sensitive financial data remains confidential while in transit over the internet. Which technology should they implement?

Accepted Answer

TLS 1.3. TLS encrypts data in transit. AES is encrypting at rest. SHA-256 is hashing. VPN can also encrypt but TLS is more specific for web traffic.

Answer

Digital signatures

Answer

SHA-256

Answer

AES-256

Question 3

A financial institution requires that no single employee can both initiate and approve a wire transfer. This policy enforces which security principle?

Accepted Answer

Separation of duties. Separation of duties prevents fraud by dividing critical tasks. Least privilege limits access, but here it's about task division.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 4

An organization is designing a security architecture for a cloud-based application. They implement firewalls, intrusion detection systems, and encryption, and also conduct regular security awareness training. This approach demonstrates which security principle?

Accepted Answer

Defense in depth. Defense in depth uses multiple layered controls. The combination of technical and administrative controls is key.

Answer

Security through obscurity

Answer

Least privilege

Answer

Separation of duties

Question 5

A software developer is designing a web application that will store user credentials. What is the most secure method for storing passwords?

Accepted Answer

Hash passwords using a strong algorithm like bcrypt with a unique salt. Hashing with salt protects passwords even if database is compromised. Encryption is reversible, so less secure for passwords.

Answer

Use a tokenization service to replace passwords with tokens

Answer

Encrypt passwords using AES-256 and store the key separately

Answer

Store passwords in a secure database with access controls

Question 6

Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. Confidentiality, Integrity, and Availability are the three core principles. Authentication and Non-repudiation are additional security goals.

Answer

Authentication

Answer

Non-repudiation

Answer

Authorization

Question 7

Which THREE of the following are recognized security principles according to NIST and ISC2?

Accepted Answer

Separation of duties. Least privilege, separation of duties, and defense in depth are fundamental. Security through obscurity is not a recognized principle.

Answer

Security through obscurity

Answer

Single point of failure

Question 8

Which THREE of the following are acceptable risk treatment options according to NIST risk management framework?

Accepted Answer

Risk mitigation. Risk avoidance, mitigation, transfer, and acceptance are standard. Risk identification is a step, not treatment. Risk duplication is not a term.

Answer

Risk duplication

Answer

Risk identification

Question 9

An AWS administrator attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

The user cannot delete the bucket critical-data.. The policy explicitly denies the s3:DeleteBucket action on the critical-data bucket, overriding any allow.

Answer

The user can delete the bucket if allowed by another policy.

Answer

The user can still delete objects inside the bucket.

Answer

The user can delete any bucket except critical-data.

Question 10

A system administrator runs `iptables -L INPUT` and sees this rule. What is the immediate effect on the system?

Accepted Answer

New SSH connections are blocked, but current SSH sessions remain active.. The rule drops all new TCP connections to port 22 (SSH) from any source, preventing new SSH connections.

Answer

All SSH traffic is blocked, including established sessions.

Answer

The rule has no effect because the policy is ACCEPT.

Answer

All outbound SSH connections are blocked.

Question 11

A security analyst reviews this firewall log entry. What type of activity is most likely being attempted?

Accepted Answer

A potential SMB exploitation attempt from an external host.. The log shows a TCP SYN packet from a high source port to destination port 445 (SMB), commonly used in ransomware attacks like EternalBlue.

Answer

A legitimate SMB file sharing connection from an internal client.

Answer

A port scan attempt on port 445.

Answer

An outbound connection to an SMB server.

Question 12

A security administrator needs to ensure that only authorized personnel can access the server room. Which physical control is most appropriate?

Accepted Answer

Biometric access control system. A biometric access control system uses unique biological traits for authentication, providing strong physical security. Keypad locks (A) are less secure because codes can be shared. Video surveillance (C) is detective, not preventive. Mantraps (D) are used for high-security areas but are more complex and expensive. Biometric access is the best fit for this requirement.

Answer

Mantrap with card reader

Answer

Keypad lock with a shared code

Answer

Video surveillance cameras

Question 13

An organization's security policy mandates that data must be encrypted both at rest and in transit. Which combination of controls meets this requirement?

Accepted Answer

Full-disk encryption and TLS for network communications. Option C is correct because full-disk encryption protects data at rest, and TLS encrypts data in transit. AES is an encryption algorithm, but not a protocol; IPsec encrypts in transit but not at rest. S/MIME is for email in transit, but doesn't cover other data. RBAC manages access, not encryption.

Answer

AES encryption for files and IPsec for network traffic

Answer

BitLocker and EFS

Answer

S/MIME for email and RBAC for file access

Question 14

During a security audit, you discover that a financial application stores passwords using MD5 hashing without salt. What is the primary security concern with this practice?

Accepted Answer

Without salting, the hashes are vulnerable to precomputed rainbow table attacks. Option B is correct because MD5 is vulnerable to rainbow table attacks, and lack of salting makes it easy for attackers to precompute hashes. Reversibility is not the primary concern (hashing is one-way). Speed is actually a vulnerability, not a strength. Compliance violation is a secondary issue.

Answer

MD5 is reversible, allowing attackers to recover plaintext passwords

Answer

MD5 is too slow, causing performance issues during authentication

Answer

Storing hashes violates PCI DSS compliance, but does not affect security

Question 15

You are designing a backup strategy for a critical database. The business requires that in the event of a failure, data loss must not exceed 15 minutes. Which metric primarily addresses this requirement?

Accepted Answer

Recovery Point Objective (RPO). Option A is correct because Recovery Point Objective (RPO) defines the maximum acceptable data loss in terms of time. Recovery Time Objective (RTO) is about downtime duration. MTBF relates to reliability, and SLA is a service agreement. RPO directly addresses data loss tolerance.

Answer

Service Level Agreement (SLA)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Time Objective (RTO)