ISC2 CC Security Principles 2

Question 1

What is the difference between a threat and a risk?

Accepted Answer

A threat is a potential danger; a risk combines threat likelihood and impact

Answer

They are the same concept

Answer

A risk is more specific than a threat

Answer

A threat is always intentional; a risk is never intentional

Question 2

Which security principle involves verifying that a user is who they claim to be?

Accepted Answer

Authentication

Answer

Authorization

Answer

Accountability

Answer

Availability

Question 3

What does the term 'least privilege' mean in security?

Accepted Answer

Restricting user access to only what is necessary for their job

Answer

Giving users maximum access for productivity

Answer

Granting temporary elevated permissions

Answer

Removing all user permissions by default

Question 4

Which of the following is an example of a physical security control?

Accepted Answer

Security badge reader

Answer

Firewall

Answer

Encryption

Answer

Intrusion detection system

Question 5

What is the purpose of a security policy?

Accepted Answer

To document acceptable use and security requirements

Answer

To enforce technical controls on systems

Answer

To train employees on security awareness

Answer

To detect security incidents

Question 6

Which term describes the likelihood that a threat will exploit a vulnerability?

Accepted Answer

Probability

Answer

Impact

Answer

Risk

Answer

Exposure