isc2 sample questions

What is the primary goal of the risk management process?

• Ignore the probability or impact of unfortunate events
• Maximize the probability of unfortunate events
• Outsource the risk management process
• To identify the Assess and mitigate risks

Answer explanation

The risk management process involves identifying, assessing, and mitigating risks to an acceptable level, rather than attempting to eliminate all risks.

Which module of security principles focuses on establishing guidelines for security behavior within an organization?

• Module 1: Understand the Security Concepts of Information Assurance

• Module 2: Understand the Risk Management Process

• Module 3: Understand Security Controls

• Module 5: Understand ISC2 Code of Ethics

Answer explanation

ISC2 Code of Ethics provides guidelines for ethical behavior related to security practices within an organization.

What is the primary focus of the module that involves the identification, analysis, and prioritization of incidents in incident response?

• Module 1: Understand Incident Response

• Module 2: Understand Business Continuity

• Module 3: Understand Disaster Recovery

Answer explanation

Module 1 focuses on the incident response process, which includes the identification, analysis, and prioritization of incidents.

What is the primary purpose of physical access controls?

• To restrict access to computer systems and networks

• To secure physical locations and assets

• To encrypt data transmissions

• To prevent malware infections

Answer explanation

Physical access controls are designed to secure physical locations and assets, such as buildings, rooms, and equipment.

Which of the following is NOT one of the CIA triad principles of information security?

• Confidentiality

• Integrity

• Availability

• Reliability

Answer explanation

Reliability is not part of the CIA triad. It focuses on maintaining consistent performance, not security.

What is the first step in the risk management process?

• Implement risk mitigation strategies.

• Identify and assess risks

• Monitor and review risks.

• Develop risk acceptance criteria.

Answer explanation

Identifying and assessing risks is the initial step to understand potential threats.

Which type of control is most effective in preventing unauthorized physical access to a data center?

• Preventive control

• Detective control

• Corrective control

• Recovery control

Answer explanation

Preventive controls, like access control systems, actively stop unauthorized access.

What is the primary objective of an organization's security policy?

• To define network architecture.

• To outline ethical guidelines for employees.

• To establish clear expectations for security practices.

• To specify incident response procedures.

Answer explanation

Security policies define acceptable security practices for users

A security professional discovers a critical vulnerability in a client's system. According to the ISC2 code of ethics, what is the MOST appropriate action?

• Inform the public immediately.

• Ignore the vulnerability if it doesn't affect their own systems.

• Report the vulnerability to the client responsibly.

• Exploit the vulnerability for personal gain.

Answer explanation

Reporting responsibly aligns with the ethical obligation to protect client information.

Which of the following is NOT a typical component of a disaster recovery plan?

• Data backup and restoration procedures

• Communication protocols

• Employee training and testing

• Marketing strategies

Answer explanation

Disaster recovery plans focus on operational recovery, not marketing efforts.