CC 試験練習問題

C

Correct answer: To ensure they can provide accurate security advice Maintaining competence is essential for cybersecurity professionals to provide accurate, reliable, and current advice and solutions that protect clients and society, which is a key component of the (ISC)² Code of Ethics. Compliance with employment laws is necessary but not the primary ethical reason for maintaining competence. Enhancing one's reputation is a potential outcome but not the primary ethical driver. Ethical behavior focuses on protecting society and providing the best possible advice, not outperforming competitors.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 52-53. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 38-40.

A

Correct answer: Firewalls blocking unauthorized traffic Preventive controls are designed to stop or prevent security incidents before they occur. A firewall blocks unauthorized traffic, preventing potential breaches or attacks from reaching internal systems. Security awareness training is a directive control that guides employee behavior but does not actively prevent incidents. Surveillance cameras are a deterrent control, discouraging malicious actions through their presence. An Intrusion Detection System (IDS) alert is a detective control that identifies and alerts on suspicious activities but does not prevent them.Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 36-38. Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 45-47.

B

Correct answer: Corrective Corrective controls are designed to mitigate the impact of a security violation and return a system to its original functional state. An antivirus application restoring a system from a backup or a previous state after an infection is an example of this. Detective controls are used to identify and alert to security violations rather than to fix them. Compensating controls are alternative measures put in place when a primary control is too difficult or expensive to implement. Directive controls consist of signs or instructions intended to advise people about the correct behavior.Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 37.

A

Correct answer: An e-commerce company determines that server downtime costs it $40,000 per hour. A quantitative risk assessment uses numerical data to measure likelihood, impact, or cost. Assigning a dollar value to downtime is a clear example of quantifying risk. Rating identified risks as low, medium, or high uses subjective categories rather than numbers. Color-coding identified vulnerabilities is assigning qualitative severity levels. Rating practices as satisfactory, needs improvement, or unsatisfactory relies on opinions instead of measurable data.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 38. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 19.

C

Correct answer: Mitigation Risk mitigation reduces the likelihood or impact of a risk without eliminating the activity entirely. Network segmentation limits lateral movement and minimizes damage if one segment is compromised. Avoidance would involve the university still operating the network rather than eliminating the activity. Transfer involves a third party assuming the risk. Acceptance involves tolerating the risk.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 40. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 21.