ISC2 CC · ISC2 · Security Principles · Bank updated 2026-11-03
ISC2 CC practice questions: Security Principles
5 free questions from 64 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Security Principles section of our ISC2 CC bank (64 questions on this area, which carries 24% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 64 Security Principles questions and the full ISC2 CC bank: $15 one-time.
1/5 · Security Principles
A city newspaper is cataloguing threat sources for the server room that runs its publishing systems, using the threat source taxonomy in NIST SP 800-30 Rev. 1. Each event below would take the server room offline. Which event should the risk assessment record as coming from an environmental threat source?
ACooling units kept well beyond their rated service life stop working
BA facilities technician switches off the cooling by mistake
CThe UPS batteries, overdue for replacement, fail under load
DThe regional power grid fails and cuts the building's utility feed
Answer: D. NIST SP 800-30 Rev. 1, Appendix D, Table D-2 (Taxonomy of Threat Sources), separates adversarial, accidental, structural and environmental threat sources. Environmental threat sources are natural disasters and failures of critical infrastructures on which the organization depends, but which are outside the control of the organization, with telecommunications and electrical power listed as infrastructure failures. Structural threat sources are failures of equipment, environmental controls or software due to aging, resource depletion or other circumstances that exceed expected operating parameters, and the table places temperature and humidity controls and the power supply in this type. Accidental threat sources are erroneous actions by individuals during their everyday responsibilities. Only the grid outage comes from infrastructure outside the newspaper's control.
Source: ISC2 CC Exam Outline
2/5 · Security Principles · hard
A law firm configures its document system so that confidential reports can be sent only to one printer in the records room. Testing confirms the restriction works, yet unauthorized staff still see the content of printed reports. What was left out of the implementation?
ASeparation of duties for the administrators of the print queue
BPhysical measures limiting who can reach the paper output
CIntrusion detection alerting on jobs sent to that printer
DLeast privilege applied to the accounts of report authors
Answer: B. Technology enforces policy but is not solely responsible for meeting security needs, so manual and physical methods must be considered. The printing example in section 5.4.3 shows that a technical restriction to one printer must be paired with physical measures limiting access to the printed output.
Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p42, p. 42
Source: ISC2 CC Exam Outline
3/5 · Security Principles · easy
A bank layers gates and guards, firewalls and intrusion detection, and written access procedures around its data center. A trainee asks what the combined layers deliver beyond making attacks harder. Which benefit does NIST attribute to such multi-layered measures?
Adependable detection of insider misuse before any damage occurs
Bprotection that keeps availability from ever being affected
Clower acquisition cost than relying on one strong control
Dnear-real time notification once an attack has been initiated
Answer: D. Defense-in-depth combines administrative, technical and physical defenses to minimize the probability of a successful attack. NIST adds that these measures help reduce the likelihood of a breach and also give the organization near-real time notification once an attack has been initiated.
Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p20, p. 20
Source: ISC2 CC Exam Outline
4/5 · Security Principles
A research firm's network team finds a back door and an external command channel that have quietly pulled design files for months. The intrusion detection system never alerted. Which threat description best fits?
Aself-spreading network worm
Btime-triggered logic bomb
Cadvanced persistent threat
Dtargeted phishing campaign
Answer: C. An advanced persistent threat is a long-term intrusion that attempts to gain access to specific data. Instead of causing damage it harvests information, may stay undetected by intrusion detection systems, then creates a back door and uses an external command and control system to extract information.
Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p31, p. 31
Source: ISC2 CC Exam Outline
5/5 · Security Principles
A multi-site company wants every office to use one badge format and one set of door-reader settings, so that staff can move between sites and entry systems can be automated. The requirement must be binding on every office but should not be a detailed walkthrough of tasks. Which type of document fits best?
Aa guideline that each office may implement in its own way
Ban organizational standard fixing technologies and parameters
Ca procedure setting out the detailed steps for each separate task
Dan issue-specific policy that is reviewed on a regular basis
Answer: B. Organizational standards specify uniform use of specific technologies, parameters or procedures when that uniformity benefits the organization, and are normally compulsory. Standardizing identification badges is the example given. Guidelines are flexible, procedures are detailed steps, and issue-specific policy gives usage direction for a technology.
Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p36, p. 36
Source: ISC2 CC Exam Outline
Other ISC2 CC areas
The same kind of free sample for every other section of the ISC2 CC bank:
Practise ISC2 CC with instant feedback
6 free questions in study mode · no card · full ISC2 CC bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start ISC2 CC free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by ISC2. ISC2 CC and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official ISC2 materials (as of October 2026); always confirm current details with the vendor before booking.