ISC2 Certified in Cybersecurity (CC)

Which of the following is the correct definition of confidentiality in the CIA triad?

• APreventing unauthorized access to information
• BEnsuring data is accessible when needed
• CVerifying the accuracy and completeness of data
• DTracking user actions for accountability

A company implements a system to verify that financial records have not been tampered with. Which security principle is being enforced?

• AConfidentiality
• BIntegrity
• CAvailability
• DNon-repudiation

Which security principle is primarily concerned with ensuring systems and data are accessible to authorized users when needed?

• AConfidentiality
• BIntegrity
• CAvailability
• DAuthentication

What type of security control is a firewall that blocks unauthorized network traffic?

• AAdministrative control
• BPhysical control
• COperational control
• DTechnical control

Which of the following is an example of a technical control?

• AAn antivirus program that blocks malware
• BA written acceptable-use policy that employees sign
• CA locked door to the server room
• DA required security awareness training session

A security guard monitoring building entrances represents which type of security control?

• ATechnical control
• BPhysical control
• CAdministrative control
• DLogical control

Which of the following is an example of an administrative security control?

• AEncryption of sensitive data
• BBiometric access control system
• CSecurity awareness training program
• DFire suppression system for the server room with sensors that release the agent automatic…

In risk management, what term describes the process of identifying and evaluating potential threats to an organization?

• ARisk mitigation
• BRisk transfer, which shifts the financial loss from one party to another by contract
• CRisk acceptance
• DRisk assessment

A company decides to purchase cyber insurance to offset potential financial losses from a data breach. Which risk treatment strategy is being used?

• ARisk transfer
• BRisk avoidance
• CRisk mitigation
• DRisk acceptance

According to the ISC2 Code of Ethics, which of the following is listed first among the four canons?

• AMaximize profits for their employer and shareholders each quarter
• BProtect society, the common good, and the infrastructure
• CPrioritize client requests above all else
• DMaintain technical certifications through any means

What is the primary purpose of governance processes in information security?

• ATo run day-to-day firewall and antivirus configuration work
• BTo test systems for weaknesses through penetration testing
• CTo establish policies, standards, and procedures for managing security
• DTo watch network traffic and alert on possible intrusions across every segment of the cor…

Which risk treatment strategy involves implementing safeguards to reduce the likelihood or impact of a risk?

• ARisk avoidance
• BRisk transfer, which shifts the financial consequence to an insurer or another party
• CRisk acceptance
• DRisk mitigation

Which of the following is an example of an administrative control?

• AA written security awareness policy that staff must acknowledge
• BA firewall rule that blocks unapproved ports on the perimeter device
• CA locked door to the server room that requires a badge scan at entry
• DA hardware token that generates one-time login codes for each user account

What is the primary goal of a Business Continuity Plan (BCP)?

• ATo stop every possible security incident before it can start
• BTo maintain essential business functions during and after a disruption
• CTo restore IT systems and data after a disaster is declared by the executive team on site
• DTo train employees to spot phishing and report suspicious activity