ISC2 CC Security Principles — Timed 50 Questions

Question 1

A security analyst discovers that an employee's workstation has been infected with ransomware. Which security principle has been directly violated?

Accepted Answer

Least privilege. Ransomware directly violates the availability security principle because it encrypts files and systems, rendering them inaccessible to authorized users. While the infection may also impact confidentiality or integrity, the immediate and primary effect is denial of access to data and services, which is a breach of availability.

Answer

Availability

Answer

Separation of duties

Answer

Defense in depth

Question 2

A company is designing a new authentication system for remote employees. They want to ensure that if one authentication factor is compromised, the system remains secure. Which security principle should they apply?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.

Answer

Fail-safe

Answer

Least privilege

Answer

Need to know

Question 3

During a security audit, it is found that a database administrator can access payroll data. The company policy states that administrators should not have access to sensitive HR data. Which security principle is being violated?

Accepted Answer

Separation of duties. The scenario describes a single database administrator having both the ability to access and modify payroll data, which combines operational and oversight roles. Separation of duties (SoD) is the principle that requires splitting critical tasks and privileges among multiple individuals to prevent fraud or error. Here, the administrator's access violates SoD because they can both manage the database and view sensitive HR data, which should require separate authorization.

Answer

Accountability

Answer

Least privilege

Answer

Privacy

Question 4

A company has implemented a policy where all employees must use a smart card and PIN to access the data center. Which security principle does this practice support?

Accepted Answer

Defense in depth. The use of both a smart card (something you have) and a PIN (something you know) creates a multi-factor authentication mechanism. This layered approach ensures that even if one factor is compromised, the other still provides protection, which is the core of the defense-in-depth principle. Defense in depth is about implementing multiple, overlapping security controls rather than relying on a single point of defense.

Answer

Keep it simple

Answer

Least privilege

Answer

Fail-safe

Question 5

A security engineer is configuring a firewall to allow web traffic but block all other inbound connections. The firewall is set to deny all traffic by default and only allow specific ports. Which security principle is being applied?

Accepted Answer

Default deny. The correct answer is A, Default deny. The scenario describes a firewall configured to deny all traffic by default and then explicitly allow only specific ports (e.g., TCP 80/443 for web traffic). This directly implements the default deny security principle, where any traffic not explicitly permitted is blocked. This contrasts with a default allow posture, which would permit all traffic unless explicitly denied.

Answer

Defense in depth

Answer

Fail-safe

Answer

Least privilege

Question 6

An organization is implementing a new system that processes financial transactions. To reduce the risk of fraud, they ensure that no single individual can both initiate and approve a transaction. Which security principle is this?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both initiating and approving a financial transaction. By splitting these tasks across different roles, the organization reduces the risk of fraud or error because collusion would be required to bypass controls. This is a core internal control mechanism in financial systems and aligns with the principle of dual control.

Answer

Need to know

Answer

Accountability

Answer

Least privilege

Question 7

A company's security policy states that employees should only have access to the data necessary to perform their job functions. This is an example of which principle?

Accepted Answer

Least privilege. The principle of least privilege dictates that users and systems should be granted only the minimum permissions necessary to perform their tasks. By restricting data access to job-required information, the company directly implements this security control, reducing the attack surface and limiting potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe

Question 8

After a security breach, it was discovered that an attacker used a stolen certificate to sign malicious code. Which security principle was compromised?

Accepted Answer

Non-repudiation. Non-repudiation ensures that an entity cannot deny having performed an action, such as signing code. When an attacker uses a stolen certificate to sign malicious code, the legitimate owner of the certificate cannot deny the signature, because the cryptographic proof (the digital signature) is bound to the certificate. This compromises the principle of non-repudiation, as the signature can no longer be reliably attributed to the intended signer.

Answer

Integrity

Answer

Confidentiality

Answer

Availability

Question 9

A security analyst is reviewing logs and finds that a user accessed files outside of their department. The user claims it was necessary for a project. Which principle should the analyst use to assess whether this was appropriate?

Accepted Answer

Need to know. The 'need to know' principle restricts access to information based on the specific requirements of a user's role or project. In this scenario, the analyst must verify if the user's project actually required access to those specific files, not just if the user had the technical ability to access them. This principle is a subset of least privilege, focusing on data access rather than system permissions.

Answer

Accountability

Answer

Separation of duties

Answer

Least privilege

Question 10

A company wants to ensure that if a server fails, it does not cause a security breach. Which principle should guide the design?

Accepted Answer

Fail-safe. Fail-safe ensures that when a server fails, it defaults to a secure state (e.g., closed ports, denied access) rather than an insecure one. This prevents a security breach by guaranteeing that failure does not inadvertently expose data or allow unauthorized access. In the CC exam, this principle is directly tied to designing systems that remain secure even under fault conditions.

Answer

Defense in depth

Answer

Default deny

Answer

Least privilege

Question 11

A security team implements a policy that requires all access to sensitive data to be logged and audited. Which principle is being enforced?

Accepted Answer

Accountability. Accountability is enforced because logging and auditing create a traceable record of who accessed sensitive data and what actions they performed. This allows security teams to hold individuals responsible for their actions by correlating log entries with specific user identities, typically via authentication systems like LDAP or SAML. The policy directly supports the principle that users must be answerable for their access to protected resources.

Answer

Non-repudiation

Answer

Integrity

Answer

Least privilege

Question 12

Which TWO of the following are fundamental security principles? (Select TWO.)

Accepted Answer

Defense in depth. Defense in depth is a fundamental security principle that implements multiple layers of security controls (e.g., firewalls, IDS/IPS, encryption, access controls) so that if one layer fails, others still provide protection. This layered approach ensures no single point of failure can compromise the entire system, aligning with the CC exam's emphasis on holistic security strategies.

Answer

Fail-open

Answer

Need to share

Answer

Complexity

Question 13

Which THREE of the following are examples of implementing defense in depth? (Select THREE.)

Accepted Answer

Using a firewall to filter traffic. Option B is correct because a firewall is a fundamental component of defense in depth, providing network-level traffic filtering based on rules. It acts as a first line of defense by blocking unauthorized access and malicious traffic, thereby reducing the attack surface. This layered security approach ensures that even if other controls fail, the firewall can still prevent or mitigate threats.

Answer

Enabling single sign-on for all applications

Answer

Allowing all traffic by default

Question 14

Which TWO of the following are principles of the CIA triad? (Select TWO.)

Accepted Answer

Confidentiality. Confidentiality is a core principle of the CIA triad, ensuring that data is accessible only to authorized entities. This is typically enforced through encryption (e.g., AES-256) and access control mechanisms, preventing unauthorized disclosure.

Answer

Non-repudiation

Answer

Accountability

Answer

Authorization

Question 15

Which THREE of the following are examples of the principle of least privilege? (Select THREE.)

Accepted Answer

Granting a user only the permissions needed to perform their job. Option A is correct because the principle of least privilege dictates that a user should be granted only the permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. In practice, this means assigning specific roles or access control lists (ACLs) rather than broad permissions.

Answer

Giving all employees full access to the file server

Answer

Assigning administrator rights to all employees by default

Question 16

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Accepted Answer

Least privilege. Allowing root login via SSH violates the principle of least privilege because it grants unrestricted administrative access to the system, bypassing any need for privilege escalation. In a properly secured SSH configuration, root login should be disabled (e.g., `PermitRootLogin no` in `/etc/ssh/sshd_config`), forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures that actions are auditable and tied to a specific user account.

Answer

Fail-safe

Answer

Defense in depth

Answer

Separation of duties

Question 17

An analyst reviews the exhibit. What security principle is best demonstrated by this policy?

Accepted Answer

Least privilege. The policy grants users only the permissions necessary to perform their job functions, which is the core definition of least privilege. By restricting access to only required resources, the policy minimizes the attack surface and limits potential damage from compromised accounts.

Answer

Separation of duties

Answer

Defense in depth

Answer

Non-repudiation

Question 18

An administrator reviews the exhibit. Which security principle is being violated?

Accepted Answer

Least privilege. The user has write access to HR documents, which may not be necessary for their role, violating least privilege.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Accountability

Question 19

A mid-sized company has a network with 200 employees. The security team has implemented a policy that requires all employees to use complex passwords and change them every 60 days. However, the company has experienced multiple phishing attacks where employees have willingly provided their credentials to fake websites. The CEO wants to implement a more robust authentication method. The company uses Microsoft Active Directory and has a budget for new security tools. They also have a remote workforce. Which of the following is the BEST course of action to address the phishing risk?

Accepted Answer

Deploy multi-factor authentication (MFA) for all remote access and critical systems. Multi-factor authentication (MFA) significantly reduces the risk of credential theft because even if a password is phished, the attacker cannot authenticate without the second factor. The other options either do not address phishing directly or are less effective.

Answer

Increase password complexity requirements and change frequency to every 30 days

Answer

Conduct annual phishing awareness training

Answer

Implement a password manager for all employees

Question 20

A financial services firm has a data center that houses customer financial records. They have implemented a defense-in-depth strategy including firewalls, IDS/IPS, and encryption. Recently, an internal audit revealed that a junior administrator has been logging into the database server with a shared admin account and has made unauthorized changes to customer records. The company wants to prevent such incidents in the future while maintaining operational efficiency. The current environment uses Linux servers with PostgreSQL databases. There is no centralized authentication system. What is the BEST action to take?

Accepted Answer

Disable all shared accounts and implement individual accounts with role-based access control and audit logging. The core issue is the lack of accountability due to a shared admin account. Disabling shared accounts and implementing individual accounts with role-based access control (RBAC) and audit logging directly addresses this by ensuring each action is tied to a specific user, enabling non-repudiation and precise forensic analysis. This aligns with the principle of least privilege and is the most effective way to prevent unauthorized changes while maintaining operational efficiency through granular permission management.

Answer

Increase the frequency of password changes for the shared admin account

Answer

Use database encryption to prevent unauthorized changes

Answer

Implement a network access control (NAC) solution to restrict database access to specific IP addresses