CCP CIA Triad & Security Controls 3 — Questions and Answers
Question 1: A company implements redundant power supplies and backup generators for its servers. This configuration primarily addresses which CIA property?
- Confidentiality
- Integrity
- Availability (Correct answer)
- Authentication
Correct answer: Availability
Redundant power systems ensure servers remain operational during outages, directly supporting availability.
Question 2: Which security control category includes policies, procedures, and security awareness training?
- Technical controls
- Physical controls
- Administrative controls (Correct answer)
- Logical controls
Correct answer: Administrative controls
Administrative controls include management-level safeguards such as policies, procedures, and training programs.
Question 3: A bank teller can view customer balances but cannot transfer funds over $10,000 without manager approval. This is an example of which security principle?
- Separation of duties
- Least privilege (Correct answer)
- Defense in depth
- Need to know
Correct answer: Least privilege
Least privilege grants users only the minimum access rights necessary to perform their job functions.
Question 4: An intrusion detection system (IDS) generates an alert when unusual network traffic is observed. This is best classified as which type of control?
- Preventive
- Detective (Correct answer)
- Corrective
- Deterrent
Correct answer: Detective
An IDS is a detective control because it identifies and alerts on suspicious activity without blocking it.
Question 5: Which of the following attacks most directly threatens data integrity?
- Eavesdropping on encrypted traffic
- SQL injection modifying database records (Correct answer)
- Phishing to steal login credentials
- Denial-of-service flooding a server
Correct answer: SQL injection modifying database records
SQL injection that modifies database records directly violates integrity by altering stored data without authorization.
Question 6: A security fence around a data center is classified as which type of control?
- Technical
- Administrative
- Physical (Correct answer)
- Logical
Correct answer: Physical
A security fence is a physical control that restricts unauthorized physical access to a facility.
Question 7: Which term describes a situation where two or more people are required to complete a sensitive task to prevent fraud?
- Least privilege
- Need to know
- Separation of duties (Correct answer)
- Role-based access control
Correct answer: Separation of duties
Separation of duties requires that critical tasks be divided among multiple individuals to reduce the risk of fraud or error.
CCP CIA Triad & Security Controls 3
A company implements redundant power supplies and backup generators for its servers.
This configuration primarily addresses which CIA property?