Chapter 1: Security Principles
Question 1 (1 point)
A chief information security officer (CISO) at a large organization
documented a policy that establishes the acceptable use of cloud
environments for all staff. This is an example of a: (D1, L1.3.1)
Question 1 options:
A) Management/Administrative control
B) Technical control
C) Physical control
D) Cloud control
Question 2 (1 point)
Is it possible to avoid risk? (D1, L1.2.1)
Question 2 options:
A) Yes
B) No
C) Sometimes
D) Never
Question 3 (1 point)
What is meant by non-repudiation? (D1, L1.1.1)
Question 3 options:
A) If a user does something, they can't later claim that they didn't do it.
B) Controls to protect the organization's reputation from harm due to inappropriate social media postings
by employees, even if on their private accounts and personal time.
C) It is part of the rules set by administrative controls.
D) It is a security feature that prevents session replay attacks.
Question 4 (1 point)
Which of the following is NOT one of the four typical ways of managing
risk? (D1, L1.2.1)
Question 4 options:
A) Avoid
B) Accept
C) Mitigate
D) Conflate
Question 5 (1 point)
Siobhan is deciding whether to make a purchase online; the vendor
wants Siobhan to create a new user account, and is requesting
Siobhan's full name, home address, credit card number, phone number,
email address, the ability to send marketing messages to Siobhan, and
permission to share this data with other vendors. Siobhan decides that
the item for sale is not worth the value of Siobhan's personal
information, and decides to not make the purchase.
What kind of risk management approach did Siobhan make? (D1,
L1.2.2)
Question 5 options:
A) Avoidance
B) Acceptance
C) Mitigation
D) Transfer
Question 6 (1 point)
Guillermo is the system administrator for a midsized retail organization.
Guillermo has been tasked with writing a document that describes,
step-by-step, how to securely install the operating system on a
new laptop. This document is an example of a ________. (D1, L1.4.1)
Question 6 options:
A) Policy
B) Standard
C) Procedure
D) Guideline
Question 7 (1 point)
Lankesh is the security administrator for a small food-distribution
company. A new law is published by the country in which Lankesh's
company operates; the law conflicts with the company's policies. Which
governance element should Lankesh's company follow? (D1, L1.4.2)
Question 7 options:
A) The law
B) The policy
C) Any procedures the company has created for the particular activities affected by the law
D) Lankesh should be allowed to use personal and professional judgment to make the determination of
how to proceed
Question 8 (1 point)
Kristal is the security administrator for a large online service provider.
Kristal learns that the company is harvesting personal data of its
customers and sharing the data with local governments where the
company operates, without the knowledge of the users, to allow the
governments to persecute users on the basis of their political and
philosophical beliefs. The published user agreement states that the
company will not share personal user data with any entities without the
users' explicit permission.
According to the ISC2 Code of Ethics, to whom does Kristal ultimately
owe a duty in this situation? (D1, L1.5.1)
Question 8 options:
A) The governments of the countries where the company operates
B) The company Kristal works for
C) The users
D) ISC2
Question 9 (1 point)
While taking the certification exam for this certification, you notice
another candidate for the certification cheating. What should you
do? (D1, L1.5.1)
Question 9 options:
A) Nothing—each person is responsible for their own actions.
B) Yell at the other candidate for violating test security.
C) Report the candidate to ISC2.
D) Call local law enforcement.
Question 10 (1 point)
The concept of "secrecy" is most related to which foundational aspect
of security? (D1, L1.1.1)
Question 10 options:
A) Confidentiality
B) Integrity
C) Availability
D) Plausibility