55 of 130 questions · Page 2/2 · Cc Security Principles topic · Answers revealed
A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:
Correct. Controls are put in place to mitigate risk.
Why this answer
Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk.
A security analyst discovers that a vendor's software contains a known vulnerability that could lead to data exposure. The analyst reports this to management. According to risk management principles, which action represents risk transfer?
Correct. Transfers financial risk to insurer.
Why this answer
Risk transfer shifts the financial impact to another party, such as through cyber insurance.
In risk management, which term describes the probability that a threat will exploit a vulnerability and cause harm to an asset?
Correct. Risk is the combination of threat, vulnerability, and impact.
Why this answer
Risk is defined as the likelihood of a threat exploiting a vulnerability, resulting in harm to an asset.
An organization implements a policy requiring employees to use a smart card and a PIN to access the data center. This is an example of which type of authentication?
Correct. Combines Type 2 (possession) and Type 1 (knowledge).
Why this answer
Multi-factor authentication combines two or more types: smart card (possession) and PIN (knowledge).
According to the (ISC)² Code of Ethics, if a conflict arises between protecting society and providing diligent service to your employer, which should take precedence?
The first canon is to protect society, the common good, and the infrastructure.
Why this answer
The (ISC)² Code of Ethics has a priority order: protect society first, then act honorably, provide diligent service, and advance the profession.
According to the (ISC)² Code of Ethics, which obligation has the highest priority?
This is the first and highest priority.
Why this answer
The Code of Ethics states the highest priority is to protect society, the common good, and the public trust.
Which of the following is a control that can reduce the risk of a DDoS attack?
Load balancing helps distribute traffic and can mitigate the impact of DDoS attacks.
Why this answer
Load balancers can distribute traffic and absorb some DDoS attacks; DDoS protection services are also common controls.
A security analyst is evaluating controls to protect the confidentiality of customer data. Which TWO of the following are effective controls? (Select TWO).
Encryption prevents unauthorized disclosure.
Why this answer
Encryption protects data at rest and in transit; access controls restrict unauthorized access.
An organization is evaluating a new vendor that will process customer data. The security team performs a thorough assessment of the vendor's security controls and background checks. This process best demonstrates:
Due diligence is the investigation and assessment before engagement.
Why this answer
Due diligence involves investigating and verifying before making a decision, such as vendor risk assessments and background checks.
An organization uses hashing to ensure that data has not been altered during transmission. Which security principle is being implemented?
Hashing ensures data integrity by producing a unique hash that changes if data is modified.
Why this answer
Hashing verifies data integrity by detecting changes to the original data.
Which principle of the CIA triad ensures that data is not disclosed to unauthorized individuals?
Confidentiality protects data from unauthorized access and disclosure.
Why this answer
Confidentiality is the principle that prevents unauthorized disclosure of information.
Which of the following controls is primarily designed to ensure availability?
Redundant servers provide failover capability, maintaining availability.
Why this answer
Redundancy (e.g., backup servers, failover) ensures systems remain available even if one component fails.
An organization is conducting a risk assessment. Which THREE of the following are considered assets? (Select THREE)
Correct. Data is an asset.
Why this answer
Assets are items of value to the organization, including data, hardware, and personnel.
A security analyst is designing a multi-factor authentication system for remote access. Which TWO of the following combinations represent true multi-factor authentication? (Select TWO)
Correct. Fingerprint (Type 3) and password (Type 1) are different factors.
Why this answer
Multi-factor requires at least two different types. A password (Type 1) and smart card (Type 2) are different factors. A fingerprint (Type 3) and password (Type 1) are also different factors.
Which of the following is classified as sensitive PII?
Medical records are sensitive PII due to privacy laws.
Why this answer
Sensitive PII includes medical records, financial data, and biometrics.
Which of the following best describes the difference between due care and due diligence in security governance?
Due care involves implementing controls; due diligence involves verifying.
Why this answer
Due care is implementing basic security; due diligence is investigating and assessing risks.
Which of the following is an example of a Type 2 authentication factor?
Smart card is a possession factor (Type 2).
Why this answer
Type 2 authentication is based on possession, such as a smart card.
Which of the following is an example of a Type 1 authentication factor?
Correct. PIN is something you know.
Why this answer
Type 1 is knowledge-based, such as a password.
A security analyst implements a hashing algorithm to verify that a downloaded file has not been altered. Which security goal is being achieved?
Hashing verifies that data has not been modified.
Why this answer
Hashing ensures data integrity by detecting changes.
An organization requires both a password and a fingerprint scan to access a secure system. This is an example of:
Two different authentication types are used.
Why this answer
Combining a knowledge factor (password) and an inherence factor (fingerprint) constitutes multi-factor authentication.
An organization wants to implement multi-factor authentication for remote access. Which TWO of the following would provide multi-factor authentication? (Select TWO)
Password (knowledge) + SMS code (possession) provides multi-factor.
Why this answer
Multi-factor authentication requires combining two different types. Options A (password + SMS code) and C (smart card + PIN) combine different types. Option B is single type (knowledge).
Option D is single type (possession). Option E is single type (inherence).
A company stores customer records that include names, addresses, and Social Security numbers. According to ISC2 Code of Ethics, which canon has the highest priority when handling this sensitive data?
Correct. This is the first and highest priority canon.
Why this answer
The Code of Ethics prioritizes: Protect society, the common good, and the public trust first.
An organization implements encryption for data at rest and in transit. Which principle of the CIA triad is primarily being addressed?
Correct. Encryption protects data from unauthorized disclosure.
Why this answer
Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.
An organization labels data as 'Confidential' and requires encryption both at rest and in transit. This classification is an example of:
Data classification assigns labels and dictates protection requirements.
Why this answer
Data classification labels (e.g., Confidential) define handling requirements, such as encryption, to protect the data.
According to the (ISC)² Code of Ethics, which principle has the highest priority?
Protect society is the first and highest priority.
Why this answer
The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.
An organization wants to ensure that an email message has not been altered during transmission. Which security control should be used?
Digital signatures use hashing and asymmetric encryption to verify integrity and authenticity.
Why this answer
Digital signatures provide integrity and non-repudiation by detecting any changes to the message.
What is the primary purpose of hashing in information security?
Hashing produces a digest that changes if the data is modified, ensuring integrity.
Why this answer
Hashing is used to verify data integrity by detecting changes to the data.
A company decides to accept the risk of using a legacy system because the cost of replacing it exceeds potential losses. This is an example of:
The company accepts the risk as is.
Why this answer
Risk acceptance means acknowledging the risk and not taking further action.
A company is classifying data and wants to ensure that personally identifiable information (PII) receives appropriate protection. Which two of the following are considered PII? (Choose two.)
SSN is a classic example of PII.
Why this answer
PII includes any data that can identify an individual. Social Security Number (SSN) and email address are both considered PII because they can be used to identify a person.
Which of the following is an example of a Type 2 authentication factor?
Smart card is a possession factor (Type 2).
Why this answer
Type 2 factors are something you have, such as a physical token.
Which TWO of the following are examples of multi-factor authentication? (Select TWO.)
Correct. Combines knowledge and possession.
Why this answer
MFA requires two or more different factor types. Password (knowledge) + SMS code (possession) and smart card (possession) + fingerprint (inherence) qualify.
A company is implementing risk management for a new project. Which THREE of the following are valid risk treatment options? (Select THREE.)
Correct. Acknowledging and tolerating risk.
Why this answer
Risk treatment options include mitigation, transfer, avoidance, and acceptance. All four are correct, but only three are listed.
Which of the following is considered sensitive personally identifiable information (PII)?
Medical records are sensitive PII due to privacy laws and potential harm if disclosed.
Why this answer
Sensitive PII includes medical records, financial information, and biometrics, which require extra protection.
Which of the following best describes the purpose of due care in information security?
Correct. Due care is about taking prudent steps to protect assets.
Why this answer
Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.
A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?
Correct. Financial data is sensitive PII.
Why this answer
Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.
A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?
Digital signatures provide integrity and authentication.
Why this answer
Digital signatures provide integrity and non-repudiation.
An organization wants to implement multi-factor authentication (MFA) for remote access. Which two types of authentication factors would meet the definition of MFA? (Choose two.)
Smart card is Type 2 (possession) and when combined with a password (Type 1) creates MFA.
Why this answer
Multi-factor authentication requires at least two different types of factors. A password is Type 1 (knowledge) and a smart card is Type 2 (possession), so combining them qualifies as MFA.
A security professional is reviewing authentication methods. Which TWO are examples of Type 2 (possession) factors? (Select TWO)
A hardware token is a possession.
Why this answer
Type 2 factors are something you have; a smart card and a hardware token are physical devices.
According to the (ISC)² Code of Ethics, which of the following has the highest priority?
Correct. This is the first and highest priority canon.
Why this answer
The (ISC)² Code of Ethics has four canons in order of priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; Advance and protect the profession.
Which of the following is considered sensitive Personally Identifiable Information (PII)?
Medical records are sensitive PII.
Why this answer
Medical records are sensitive PII because they can cause significant harm if disclosed.
A vulnerability assessment reveals that a legacy system has unpatched software. The organization decides to accept the risk because the system is isolated and has compensating controls. This decision is an example of:
The organization accepts the residual risk.
Why this answer
Risk acceptance is acknowledging the risk and deciding not to mitigate it.
Which of the following best describes a vulnerability in the context of risk management?
Correct. A vulnerability is a weakness.
Why this answer
A vulnerability is a weakness that can be exploited by a threat to cause harm.
A company implements redundant servers to ensure that if one server fails, another can take over immediately. Which security principle is primarily being addressed?
Redundancy ensures systems remain accessible despite failures.
Why this answer
Redundancy supports availability by minimizing downtime.
A financial institution is implementing data classification to protect customer information. They have identified data that includes medical records and financial account numbers. Which three labels are most appropriate for this data? (Choose three.)
Restricted is often the highest classification, appropriate for extremely sensitive data like medical records.
Why this answer
Medical records and financial account numbers are considered sensitive PII and should be classified as confidential or restricted. Common classification labels include 'Confidential', 'Restricted', and 'Sensitive'. In many frameworks, 'Confidential' and 'Restricted' are used for highly sensitive data. 'Sensitive' is also a common label. 'Public' and 'Internal' are not appropriate for this level of sensitivity.
A security professional is advising a company on adherence to the (ISC)² Code of Ethics. Which two of the following actions align with the Code's canons? (Choose two.)
This protects society and the infrastructure by allowing fixes to be developed.
Why this answer
The (ISC)² Code of Ethics includes four canons: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Reporting vulnerabilities to the vendor protects society. Refusing to share confidential credentials demonstrates honorable behavior.
A security team identifies a vulnerability in a web application that could allow attackers to steal customer data. The team decides to accept the risk because the cost to fix exceeds the potential loss. This is an example of:
The team consciously accepted the risk after evaluating costs.
Why this answer
Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.
A company is evaluating a new cloud service provider and performs a thorough investigation of the provider's security practices and compliance with industry standards. This activity is best described as:
Correct. Due diligence is the investigation and assessment of risks.
Why this answer
Due diligence involves investigating and assessing risks before making decisions, such as vendor selection.
Which of the following is an example of Type 2 (possession) authentication?
Smart card is something you have.
Why this answer
A smart card is a physical item you possess, making it Type 2.
What is the primary goal of data classification?
Correct. Classification drives handling requirements.
Why this answer
Data classification assigns sensitivity labels to enable appropriate protection.
Which of the following is an example of sensitive PII?
Correct. Medical records are classified as sensitive PII.
Why this answer
Sensitive PII includes information that, if disclosed, could cause significant harm, such as medical records, financial information, and biometric data.
Which of the following is an example of a Type 2 authentication factor?
Correct. A hardware token is a possession factor.
Why this answer
Type 2 (possession) factors include something the user has, such as a smart card, OTP token, or mobile authenticator app.
Which of the following best describes the principle of confidentiality in the CIA triad?
Correct. Confidentiality is about preventing unauthorized access or disclosure.
Why this answer
Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encryption and access controls are primary mechanisms to enforce confidentiality.
An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?
Encryption prevents unauthorized access to data.
Why this answer
Encryption protects data from unauthorized disclosure, directly supporting confidentiality.
After a data breach, an organization discovers that an attacker exploited a known vulnerability in an outdated web server. The organization had previously identified the vulnerability but decided not to patch it due to potential downtime. Which risk management strategy did the organization employ?
By not patching despite knowing the vulnerability, the organization accepted the risk.
Why this answer
Risk acceptance means acknowledging the risk and its potential impact without taking action to reduce it.
An organization implements redundant servers and failover mechanisms to ensure continuous operation during a power outage. Which goal of the CIA triad is primarily being addressed?
Redundancy and failover enhance availability.
Why this answer
Redundancy and failover ensure systems remain accessible, which supports availability.
Ready to test yourself?
Try a timed practice session using only Cc Security Principles questions.