ISC2 CC Security Principles 2 — Questions and Answers
Question 1: What is the difference between a threat and a risk?
- They are the same concept
- A threat is a potential danger; a risk combines threat likelihood and impact (Correct answer)
- A risk is more specific than a threat
- A threat is always intentional; a risk is never intentional
Correct answer: A threat is a potential danger; a risk combines threat likelihood and impact
A threat is a potential danger, while risk is the combination of that threat's likelihood and its potential impact.
Question 2: Which security principle involves verifying that a user is who they claim to be?
- Authorization
- Authentication (Correct answer)
- Accountability
- Availability
Correct answer: Authentication
Authentication is the process of verifying the identity of a user, system, or entity.
Question 3: What does the term 'least privilege' mean in security?
- Giving users maximum access for productivity
- Restricting user access to only what is necessary for their job (Correct answer)
- Granting temporary elevated permissions
- Removing all user permissions by default
Correct answer: Restricting user access to only what is necessary for their job
Least privilege means users are granted only the minimum permissions necessary to perform their job functions.
Question 4: Which of the following is an example of a physical security control?
- Firewall
- Encryption
- Security badge reader (Correct answer)
- Intrusion detection system
Correct answer: Security badge reader
A security badge reader is a physical control that restricts physical access to facilities or areas.
Question 5: What is the purpose of a security policy?
- To enforce technical controls on systems
- To document acceptable use and security requirements (Correct answer)
- To train employees on security awareness
- To detect security incidents
Correct answer: To document acceptable use and security requirements
A security policy documents an organization's rules, requirements, and acceptable use guidelines for information security.
Question 6: Which term describes the likelihood that a threat will exploit a vulnerability?
- Impact
- Risk
- Probability (Correct answer)
- Exposure
Correct answer: Probability
Probability (or likelihood) refers to the chance that a specific threat will successfully exploit a given vulnerability.
ISC2 CC Security Principles 2
What is the difference between a threat and a risk?