ISC2 CC Security Operations 1 — Questions and Answers
Question 1: What is the purpose of a security audit?
- To train employees on security policies
- To evaluate the effectiveness of security controls and compliance (Correct answer)
- To implement new security technologies
- To respond to active security incidents
Correct answer: To evaluate the effectiveness of security controls and compliance
A security audit systematically evaluates security controls, policies, and procedures to determine their effectiveness and compliance.
Question 2: What is data classification?
- Organizing data by file size for storage optimization
- Categorizing data based on its sensitivity and required protection level (Correct answer)
- Encrypting data based on its file type
- Backing up data organized by creation date
Correct answer: Categorizing data based on its sensitivity and required protection level
Data classification categorizes data according to its sensitivity and required level of protection, helping organizations apply appropriate controls.
Question 3: What is the purpose of a patch management program?
- To monitor network traffic for security threats
- To keep systems up to date with security and software fixes (Correct answer)
- To manage user access permissions across systems
- To back up all system configurations regularly
Correct answer: To keep systems up to date with security and software fixes
Patch management ensures that systems are regularly updated with security patches to fix known vulnerabilities before they can be exploited.
Question 4: Which of the following is an example of a technical security control?
- Security policy document
- Employee security awareness training
- Encryption of sensitive data (Correct answer)
- Employee background checks
Correct answer: Encryption of sensitive data
Encryption is a technical security control implemented through technology to protect data from unauthorized access.
Question 5: What does configuration management in security help prevent?
- Network outages caused by unexpected traffic spikes
- Unauthorized or unplanned changes that could introduce vulnerabilities (Correct answer)
- User errors in data entry and processing
- Application performance degradation over time
Correct answer: Unauthorized or unplanned changes that could introduce vulnerabilities
Configuration management tracks and controls changes to system configurations, preventing unauthorized or unplanned changes that could introduce security weaknesses.
Question 6: What type of security control is a security guard?
- Technical control
- Administrative control
- Physical control (Correct answer)
- Corrective control
Correct answer: Physical control
A security guard is a physical control that protects against unauthorized physical access to facilities or resources.
ISC2 CC Security Operations 1
What is the purpose of a security audit?