ISC2 CC Security Principles Practice Test 9 — 15 Questions

Question 1

A security engineer is designing a backup strategy for a critical database. The database must be recoverable within four hours in the event of a failure. Which security principle primarily drives this requirement?

Accepted Answer

Availability. Availability ensures that systems and data are accessible when needed. Recovery time objective (RTO) of four hours is an availability requirement. Option C is correct. Option A (confidentiality) protects data secrecy. Option B (integrity) ensures data accuracy. Option D (non-repudiation) prevents denial of actions.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality

Question 2

During an incident response, a forensics analyst captures a memory dump from a compromised server. The analyst needs to ensure the dump is not altered during analysis. Which practice best maintains integrity?

Accepted Answer

Generate a cryptographic hash of the dump before analysis. Creating a cryptographic hash (e.g., SHA-256) of the original dump and verifying it before and after analysis ensures integrity. Option D is correct. Option A (encryption) protects confidentiality, not integrity. Option B (log access) is about monitoring. Option C (chain of custody) documents handling but doesn't prevent alteration by itself.

Answer

Encrypt the memory dump file

Answer

Maintain a chain of custody log

Answer

Restrict access to the dump to authorized personnel only

Question 3

An organization requires that two different administrators approve changes to firewall rules. This is an example of which security principle?

Accepted Answer

Separation of duties. Separation of duties requires multiple people to complete a sensitive task to reduce fraud and errors. Option B is correct. Option A (least privilege) limits permissions. Option C (defense in depth) uses layers. Option D (need-to-know) restricts data access.

Answer

Least privilege

Answer

Defense in depth

Answer

Need-to-know

Question 4

A company's security policy states that all sensitive data must be encrypted both at rest and in transit. Which threat model does this control primarily address?

Accepted Answer

Unauthorized disclosure. Encryption at rest and in transit primarily protects confidentiality against unauthorized access. Option B is correct. Option A (availability) is about uptime. Option C (integrity) is about accuracy, though encryption can help, but primary is confidentiality. Option D (non-repudiation) is about proof of origin.

Answer

Data tampering

Answer

Denial of service

Answer

Repudiation

Question 5

A security architect is evaluating a biometric authentication system. The system's false positive rate is 0.1%, and the false negative rate is 2%. Which security principle is most compromised if the organization prioritizes user convenience over security?

Accepted Answer

Availability. A low false positive rate means few unauthorized users are authenticated, but a high false negative rate can lock out legitimate users, affecting availability. If convenience is prioritized, the false negative rate might be reduced by lowering thresholds, increasing false positives and compromising security (confidentiality/integrity). However, the immediate principle affected by a high false negative rate is availability because legitimate users cannot access systems. Option C is correct. Option A (confidentiality) is more related to false positives. Option B (integrity) is not direct. Option D (non-repudiation) is about accountability.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Integrity

Question 6

Which TWO of the following are core principles of the CIA triad?

Accepted Answer

Integrity. The CIA triad consists of Confidentiality, Integrity, and Availability. Options A and C are correct. Option B (Non-repudiation) is separate. Option D (Authentication) is separate. Option E (Authorization) is separate.

Answer

Non-repudiation

Answer

Authorization

Answer

Authentication

Question 7

Which TWO of the following controls are examples of defense in depth?

Accepted Answer

Network firewall. Defense in depth uses multiple layers. Firewalls and anti-malware are typical layers. Option A (firewall) is a network layer, Option C (anti-malware) is a host layer. Option B (single sign-on) is a convenience feature, not a security layer. Option D (strong password policy) is a procedural control but not a layered defense. Option E (encryption) is a control but defense in depth focuses on overlapping controls; encryption alone is not a layer in the same sense. However, encryption can be considered a layer, but typically defense in depth includes network, host, and application layers. For this question, firewall and anti-malware are clearest.

Answer

Single sign-on

Answer

Encryption at rest

Answer

Strong password policy

Question 8

Which THREE of the following are considered methods to ensure accountability in a system?

Accepted Answer

Audit logs. Accountability requires that actions can be traced to an individual. Audit logs (A) track events. User authentication (B) identifies users. Digital signatures (D) provide non-repudiation and link actions to a signer. Option C (encryption) protects data but does not directly provide accountability. Option E (firewall) controls access but does not trace actions.

Answer

Data encryption

Answer

Intrusion prevention system

Question 9

The exhibit shows the current iptables rules. Which security principle is most clearly enforced by the default policy?

Accepted Answer

Fail-safe defaults. The default policy is DROP on the INPUT chain, meaning any traffic not explicitly allowed is denied. This is a 'fail-safe defaults' or 'default deny' principle. Option B is correct. Option A (least privilege) is about minimal permissions, but the default policy is about default action. Option C (separation of duties) is not shown. Option D (defense in depth) is not directly demonstrated.

Answer

Defense in depth

Answer

Separation of duties

Answer

Least privilege

Question 10

The exhibit shows an AWS S3 bucket policy. What is the net effect for a user with IP 10.1.1.1 trying to read the object 'executive/salary.xlsx'?

Accepted Answer

Denied because the Deny statement explicitly blocks access to the executive prefix. The policy has an Allow for GetObject from IP range 10.0.0.0/8 (including 10.1.1.1) but also a Deny for all actions on the 'executive/' prefix. Deny overrides Allow (explicit deny). So the read is denied. Option B is correct. Option A is wrong because the Deny applies. Option C and D are wrong.

Answer

Allowed because the IP matches the Allow condition

Answer

Allowed only if the user is authenticated with MFA

Answer

Denied only if the request originates from outside 10.0.0.0/8

Question 11

The exhibit shows a snippet of /var/log/auth.log on a Linux server. Which security principle is most likely violated if the failed attempts continue without action?

Accepted Answer

Least privilege. The logs show repeated failed SSH attempts from the same IP, indicating a brute force attack. If no action is taken, availability could be compromised if the attacker locks out the root account, or confidentiality/integrity if they succeed. However, most directly, the principle of least privilege is violated because root login over SSH is allowed (root is a privileged account). Option A is correct. Option B (defense in depth) would be violated if no other controls, but the question asks the principle most likely violated. Option C (separation of duties) not relevant. Option D (non-repudiation) not directly.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Defense in depth

Question 12

A small business wants to protect its customer data by ensuring that only employees who need access to perform their jobs can view it. Which security principle is being applied?

Accepted Answer

Least privilege. Least privilege grants users only the permissions necessary to perform their job functions. Option A (Separation of duties) divides critical tasks among multiple people. Option C (Defense in depth) uses multiple layers of security. Option D (Need-to-know) restricts access to specific data required for a role, but least privilege is the overarching principle.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 13

A security administrator notices that a user's account has been used to access sensitive files at unusual hours. Which security principle would most effectively help detect this type of activity?

Accepted Answer

Accountability. Accountability enables tracking of user actions through logs and monitoring. Option A (Non-repudiation) prevents denial of actions but does not focus on detection. Option B (Integrity) ensures data accuracy. Option C (Availability) ensures data is accessible.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 14

A company implements two-factor authentication (2FA) for all remote access. Which primary security goal is this enhancing?

Accepted Answer

Confidentiality. 2FA strengthens authentication, ensuring only authorized users access data, thereby protecting confidentiality. Option B (Integrity) is about data accuracy. Option C (Availability) is about uptime. Option D (Non-repudiation) is about proof of actions.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 15

During a security audit, it is discovered that a single employee can approve purchase orders and also receive the goods. Which security principle is being violated?

Accepted Answer

Separation of duties. Separation of duties requires that conflicting tasks be divided among different individuals to prevent fraud. Option A (Least privilege) is about access levels. Option B (Need-to-know) restricts data access. Option C (Defense in depth) is about layered controls.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know