CC 試験練習問題

B

Correct answer: Technical controls Firewalls and intrusion detection systems are examples of technical controls, which involve technology-based measures to protect information systems. Physical controls include barriers like locks, gates, and security guards, not technology-based measures. Administrative controls involve policies, procedures, and guidelines, not technical defenses. Operational controls generally refer to procedures and practices to manage security operations, but they are not specific to the technological measures described here.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 46-47. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 31-36.

D

Correct answer: Strong passwords While strong passwords are essential for securing access to data, they do little to protect the privacy of data once access is obtained. Data encryption is a direct method of protecting privacy by making data unreadable without proper keys. Logging access helps monitor who accesses data, contributing to privacy by providing an audit trail. Anonymizing data removes personally identifiable information, directly enhancing privacy.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 13-16. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 7-8.

D

Correct answer: The amount and type of risk an organization is willing to pursue or retain Risk appetite refers to the amount and type of risk that an organization is willing to accept or retain in pursuit of its objectives. The maximum amount of risk an organization can bear relates more to risk capacity, not appetite. The total number of risks identified in an assessment does not define risk appetite. The types of risks that are unacceptable refers to risk tolerance, which is different from risk appetite.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 40-41. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 17-21.

C

Correct answer: Confidentiality Confidentiality is one of the main objectives in the CIA triad. It was violated because sensitive patient information was exposed to unauthorized parties. Protecting data from unauthorized disclosure is the core purpose of confidentiality. The scenario did not involve data that was altered or tampered with, which would violate integrity. The data remained accessible rather than being disrupted, so availability was not violated. Encryption is a security control, not a primary security objective.Certified in Cybersecurity Study Guide, 1st Edition (ISBN: 978-1394213832). Pg 4-5. Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 4.

A

Correct answer: ISO/IEC 27002 ISO/IEC 27002 provides guidelines and best practices for information security controls. It supports information assurance by helping organizations protect confidentiality, integrity, and availability. The ISC2 Code of Ethics defines professional conduct, not security controls or assurance practices. An acceptable use policy (AUP) is an internal organizational policy, not a formal assurance framework. A disaster recovery policy focuses on recovery from incidents, not overall information assurance.Certified in Cybersecurity All-in-One Exam Guide, 1st Edition (ISBN: 978-1265203818). Pg 8.