I85PREP
⌘ K
SC study materials
SC study resources

SC practice questions

One question at a time. Build your SC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security and Risk Management

Which principle of the CIA triad is primarily concerned with ensuring that data has not been altered by an unauthorized party?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Non-repudiation
  4. Availability

Explanation

Integrity ensures data is accurate and complete and has not been modified without authorization. Confidentiality concerns restricting access, availability concerns timely access, and non-repudiation is a separate concept about proving an action occurred.

Question 2Security and Risk Management

A security team classifies a document as 'Confidential' and requires encryption at rest and role-based access. This classification process is best described as part of which activity?

  1. Data classification and handling Correct answer.
  2. Incident response
  3. Business continuity planning
  4. Vulnerability management

Explanation

Data classification assigns sensitivity labels and defines handling requirements such as encryption and access controls for each label. The other activities address recovery, technical weakness remediation, and responding to incidents rather than labeling data.

Question 3Security and Risk Management

Which document typically states management's overall intent and direction for security and is the highest-level internal security document?

  1. Procedure
  2. Standard
  3. Security policy Correct answer.
  4. Guideline

Explanation

A security policy is a high-level management statement of intent and direction that authorizes and drives lower-level documents. Standards, procedures, and guidelines are more specific and derive their authority from policy.

Question 4Security and Risk Management

In risk analysis, what is the term for the potential monetary loss from a threat exploiting a vulnerability, expressed as a percentage of asset value?

  1. Total cost of ownership
  2. Single loss expectancy
  3. Annualized rate of occurrence
  4. Exposure factor Correct answer.

Explanation

Exposure factor is the proportion of an asset's value that would be lost in a single incident. It is multiplied by asset value to yield single loss expectancy and by annualized rate of occurrence to yield annualized loss expectancy.

Question 5Security and Risk Management

An organization transfers risk by purchasing cyber insurance. Which risk treatment strategy does this represent?

  1. Risk transfer Correct answer.
  2. Risk mitigation
  3. Risk acceptance
  4. Risk avoidance

Explanation

Risk transfer shifts the financial impact of a risk to a third party such as an insurer while the risk itself remains. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 6Security and Risk Management

Which risk assessment approach relies primarily on expert judgment and qualitative scales such as high/medium/low?

  1. Quantitative risk assessment
  2. Automated vulnerability scanning
  3. Penetration testing
  4. Qualitative risk assessment Correct answer.

Explanation

Qualitative assessment uses subjective ratings and expert judgment to rank risks without assigning precise monetary values. Quantitative assessment uses numeric and monetary data, while scanning and penetration testing are technical control activities.

Question 7Security and Risk Management

Which role is ultimately accountable for the organization's security program and for accepting residual risk?

  1. Senior management Correct answer.
  2. Help desk technician
  3. Security analyst
  4. Data custodian

Explanation

Senior management owns the security program and holds the authority to accept residual risk on behalf of the organization. Operational roles implement controls but do not own organizational risk acceptance.

Question 8Security and Risk Management

A company wants to reduce the likelihood that a phishing email leads to credential theft. Which control type directly addresses this?

  1. Facility badge readers
  2. Fire suppression system
  3. Disk redundancy
  4. Security awareness training Correct answer.

Explanation

Security awareness training is an administrative control that helps users recognize and resist phishing, reducing the likelihood of successful credential theft. The other options are physical or availability controls unrelated to phishing.

Question 9Security and Risk Management

Which law is a U.S. federal regulation that requires financial institutions to safeguard customer information and is enforced by agencies such as the SEC and FTC?

  1. HIPAA
  2. FERPA
  3. Gramm-Leach-Bliley Act Correct answer.
  4. SOX

Explanation

The Gramm-Leach-Bliley Act governs financial institutions and requires safeguards for customer nonpublic personal information. HIPAA covers health data, FERPA covers education records, and SOX addresses corporate financial reporting controls.

Question 10Security and Risk Management

Under the GDPR, which party determines the purposes and means of processing personal data?

  1. Supervisory authority
  2. Data controller Correct answer.
  3. Data subject
  4. Data processor

Explanation

The controller decides why and how personal data is processed and bears primary compliance responsibility. A processor acts on the controller's behalf, the subject is the individual, and the supervisory authority regulates.

Question 11Security and Risk Management

An organization discovers a breach involving personal data. Which action best reflects a sound incident response and legal obligation?

  1. Follow the documented incident response plan and evaluate notification obligations Correct answer.
  2. Post details publicly before internal containment
  3. Delete the affected logs to prevent further exposure
  4. Wait for the next scheduled audit to report the event

Explanation

Responders should follow the incident response plan for containment, eradication, and recovery while assessing legal notification duties such as breach reporting. Destroying evidence, delaying reporting, or premature disclosure undermines investigation and compliance.

Question 12Security and Risk Management

Which agreement is used when two organizations exchange confidential information and want to define obligations for protecting it?

  1. Memorandum of understanding
  2. Acceptable use policy
  3. Service level agreement
  4. Non-disclosure agreement Correct answer.

Explanation

A non-disclosure agreement defines how each party must protect confidential information shared between them. An SLA defines service performance, an MOU records general intent, and an AUP governs user behavior.

Question 13Security and Risk Management

A vendor hosts critical data and the organization wants to verify the vendor's security controls without conducting its own full audit. Which artifact is most appropriate to request?

  1. The vendor's marketing brochure
  2. The vendor's organizational chart
  3. Independent audit report such as SOC 2 Correct answer.
  4. The vendor's employee handbook

Explanation

An independent audit report such as SOC 2 provides third-party assurance about the vendor's controls. Marketing materials, handbooks, and org charts do not provide independent control assurance.

Question 14Security and Risk Management

Which of the following is an example of a detective control?

  1. Intrusion detection system alerts Correct answer.
  2. Fencing around a data center
  3. Security awareness training
  4. Encryption of data at rest

Explanation

Detective controls identify and record events as or after they occur, such as IDS alerts. Encryption and fencing are preventive, and training is an administrative preventive control.

Question 15Security and Risk Management

What is the primary purpose of a business impact analysis (BIA)?

  1. Identify critical business functions and the impact of their disruption Correct answer.
  2. Enumerate technical vulnerabilities on servers
  3. Test employee phishing susceptibility
  4. Define firewall rule sets

Explanation

A BIA identifies critical functions and quantifies the operational and financial impact of their disruption, informing recovery priorities and objectives. Vulnerability enumeration, firewall rules, and phishing tests are separate technical or awareness activities.

Question 16Security and Risk Management

Which metric defines the maximum acceptable time that a business process can be unavailable after a disruption?

  1. Mean time to repair
  2. Mean time between failures
  3. Recovery point objective
  4. Recovery time objective Correct answer.

Explanation

The recovery time objective sets the maximum tolerable downtime for restoring a process. The recovery point objective defines tolerable data loss, and the MTBF/MTTR metrics describe reliability and repair duration.

Question 17Security and Risk Management

An employee's access is reduced when they move from finance to marketing. Which principle does this best illustrate?

  1. Least privilege Correct answer.
  2. Defense in depth
  3. Separation of duties
  4. Mandatory vacation

Explanation

Least privilege gives users only the access needed for their current role, so access is adjusted when duties change. Separation of duties divides tasks among people, defense in depth layers controls, and mandatory vacation is a fraud detection measure.

Question 18Security and Risk Management

Which concept requires that a user cannot deny having performed a transaction, often supported by digital signatures?

  1. Non-repudiation Correct answer.
  2. Availability
  3. Privacy
  4. Least privilege

Explanation

Non-repudiation provides proof of the origin and integrity of an action so the actor cannot later deny it, commonly through digital signatures. Availability, least privilege, and privacy address different goals.

Question 19Security and Risk Management

A security manager needs to prioritize remediation. Which combination best represents risk?

  1. Likelihood of a threat exploiting a vulnerability and the resulting impact Correct answer.
  2. The count of security policies and their page length
  3. The number of open ports on a server and its CPU load
  4. The vendor's market share and contract length

Explanation

Risk is commonly expressed as the combination of the likelihood of a threat event and its impact on the organization. Port counts, vendor market share, and policy volume are not measures of risk.

Question 20Security and Risk Management

An organization adopts a control framework and then measures its performance against that framework over time. This activity is best described as:

  1. Compliance monitoring Correct answer.
  2. Capacity planning
  3. Threat hunting
  4. Risk avoidance

Explanation

Compliance monitoring continuously measures adherence to a chosen framework or regulation. Risk avoidance eliminates an activity, threat hunting proactively searches for adversaries, and capacity planning addresses resource sizing.

Question 21Security and Risk Management

Which statement best describes the difference between a standard and a guideline?

  1. A standard is mandatory and specific, while a guideline is recommended advice Correct answer.
  2. Both are mandatory and legally binding
  3. A standard is optional advice, while a guideline is mandatory
  4. A guideline supersedes policy, while a standard does not

Explanation

Standards are mandatory, specific requirements that support policy, whereas guidelines are recommended best practices that allow discretion. Neither guidelines nor standards supersede policy.

Question 22Security and Risk Management

An organization must choose between two controls. Control A costs 50,000 and reduces expected annual loss by 80,000; Control B costs 30,000 and reduces expected annual loss by 40,000. Which statement is most accurate?

  1. Both controls have positive net benefit, with Control A yielding the larger net benefit Correct answer.
  2. Neither control is justified because costs are incurred
  3. Only Control B has a positive net benefit
  4. Control B is preferable because it has the higher benefit-cost ratio only

Explanation

Net benefit is loss reduction minus cost: Control A yields 30,000 and Control B yields 10,000, so both are positive and A has the larger net benefit. Benefit-cost ratio alone does not override the greater absolute benefit when budgets allow.

Question 23Security and Risk Management

A multinational firm must comply with GDPR for EU residents, a state privacy law for local residents, and a sector regulation for its industry. What is the most appropriate approach?

  1. Apply only the sector regulation because it is most specific
  2. Choose the least stringent requirement to reduce cost
  3. Apply only the law of the headquarters country
  4. Map obligations and apply the most stringent requirement where they overlap Correct answer.

Explanation

When multiple regimes apply, organizations map each obligation and satisfy the strictest applicable requirement where they overlap to achieve compliance with all. Ignoring applicable laws or defaulting to the least stringent creates legal exposure.

Question 24Security and Risk Management

Which scenario best demonstrates a conflict of interest that separation of duties is designed to prevent?

  1. Two analysts review each other's firewall changes
  2. One administrator can both create vendors and approve their payments Correct answer.
  3. A developer documents code changes in a ticket
  4. A manager approves a subordinate's leave request

Explanation

Separation of duties prevents one person from controlling all parts of a sensitive transaction, such as vendor creation and payment approval, which enables fraud. Peer review, leave approval, and documentation do not concentrate conflicting authority.

Question 25Security and Risk Management

An organization accepts a risk because the cost of the control exceeds the expected loss. Which condition makes this acceptance most defensible?

  1. The decision is kept informal to allow quick reversal
  2. The decision is documented and approved by accountable management with periodic review Correct answer.
  3. The risk owner is the security analyst who found the issue
  4. The risk is accepted permanently with no further review

Explanation

Risk acceptance is defensible when accountable management formally approves it, the rationale is documented, and the decision is revisited as conditions change. Informal, permanent acceptance by a non-accountable party lacks governance.

Question 26Security and Risk Management

Which statement best describes the purpose of a security policy?

  1. It records the detailed results of the most recent vulnerability scan.
  2. It provides step-by-step technical instructions for configuring a specific firewall product.
  3. It recommends preferred practices that staff may follow at their discretion.
  4. It defines management's mandatory requirements and intent for protecting the organization's assets. Correct answer.

Explanation

A policy is a high-level statement of management intent that establishes mandatory requirements and assigns responsibility. Procedures, standards, and guidelines are derived from and must align with the policy.

Question 27Security and Risk Management

An organization wants a quantitative basis for deciding how much to invest in safeguards. Which analysis produces a dollar figure for expected loss before and after controls?

  1. A qualitative heat map of threat likelihood and impact
  2. A cost-benefit analysis comparing the annualized loss expectancy with the cost of the control Correct answer.
  3. A tabletop exercise that documents response roles
  4. A control self-assessment questionnaire scored by managers

Explanation

Quantitative risk analysis uses annualized loss expectancy (ALE) so that the reduction in expected loss can be compared directly against the cost of a safeguard. This supports a defensible investment decision in monetary terms.

Question 28Security and Risk Management

A security team is choosing a framework to structure its program. What distinguishes a control framework from a certification scheme?

  1. A framework applies only to cloud providers, while a certification scheme applies to all industries.
  2. A framework organizes controls into a reference structure, while a certification scheme provides independent attestation against defined criteria. Correct answer.
  3. A framework is legally binding, while a certification scheme is always voluntary.
  4. A framework certifies the organization, while a certification scheme only lists suggested controls.

Explanation

Frameworks such as ISO 27001 or NIST publications provide a structured catalog of controls and practices for building a program. Certification schemes add third-party assessment that attests conformance to specified criteria.

Question 29Security and Risk Management

Which activity is performed during the risk assessment step of the risk management lifecycle?

  1. Monitoring key risk indicators on a monthly dashboard
  2. Disposing of media that has reached the end of its retention period
  3. Identifying assets, threats, and vulnerabilities and estimating the resulting risk Correct answer.
  4. Purchasing cyber insurance to transfer financial exposure

Explanation

Risk assessment is the identification and evaluation of risk, typically by pairing threats and vulnerabilities against assets and estimating likelihood and impact. Treatment options such as insurance come afterward in the risk response step.

Question 30Security and Risk Management

A new regulation requires an organization to retain audit logs for one year, but the current retention standard specifies 90 days. What is the most appropriate action?

  1. Keep the 90-day standard because internal standards always take precedence over external requirements.
  2. Delete logs at 90 days and record the regulatory gap as an accepted risk.
  3. Update the standard to meet the regulatory minimum and document the change through the change management process. Correct answer.
  4. Retain logs for one year only for systems that the security team deems important.

Explanation

Legal and regulatory obligations set a floor that internal standards must meet or exceed. When a gap exists, the standard should be revised through change management so the requirement is consistently enforced.

Question 31Asset Security

Which data role is accountable for determining the classification level of a specific data set and approving its handling rules?

  1. The data owner Correct answer.
  2. The data custodian
  3. The security auditor
  4. The systems administrator

Explanation

The data owner is a business-level role accountable for classifying data and defining who may access it and under what conditions. Custodians carry out the owner's instructions technically but do not set classification.

Question 32Asset Security

Which term describes data that is being actively used or processed by a system, such as data in CPU registers or memory during computation?

  1. Data at rest
  2. Data in use Correct answer.
  3. Data in transit
  4. Data in archive

Explanation

Data exists in three primary states: at rest (stored), in transit (moving across a network), and in use (being processed). Data held in memory or registers during computation is the in-use state.

Question 33Asset Security

An organization must retain financial records for seven years to satisfy legal requirements. Which classification driver best describes this requirement?

  1. Business continuity
  2. Regulatory compliance Correct answer.
  3. Performance optimization
  4. Capacity planning

Explanation

Retention mandates imposed by law or regulation are compliance drivers, which dictate minimum retention periods and destruction rules. Business continuity and capacity concerns do not create legal retention obligations.

Question 34Asset Security

Which practice most directly reduces the impact of a lost or stolen backup tape?

  1. Storing the tape offsite
  2. Labeling the tape with its contents
  3. Encrypting the data on the tape Correct answer.
  4. Compressing the data on the tape

Explanation

Encryption renders the data unreadable without the key, so a lost tape does not expose the contents. Compression, labeling, and offsite storage affect handling and availability but not confidentiality if the media is lost.

Question 35Asset Security

Which technique replaces sensitive values with a token that maps back to the original value only through a protected reference table?

  1. Tokenization Correct answer.
  2. Hashing
  3. Data masking
  4. Steganography

Explanation

Tokenization substitutes a sensitive value with a non-sensitive token, and the mapping is held in a secured vault. Hashing is one-way and cannot be reversed via a mapping table, while masking alters displayed values without preserving a reversible reference.

Question 36Asset Security

Which scoping approach limits the assessment of a security control to the systems and data it actually protects?

  1. Expanding the audit budget
  2. Defining the control's scope boundary Correct answer.
  3. Extending the retention period
  4. Increasing the sampling rate

Explanation

Scoping defines the boundary of what a control covers so that assessment effort is directed at relevant systems and data. Sampling rate, budget, and retention do not define which assets fall within the control's coverage.

Question 37Asset Security

A company stores customer records in a cloud service and wants to ensure data is unreadable to the provider. Which control best achieves this?

  1. Database access logging
  2. Client-side encryption with customer-managed keys Correct answer.
  3. Provider-managed encryption at rest
  4. Transport Layer Security for data in transit

Explanation

Client-side encryption with customer-managed keys keeps the decryption key outside the provider's control, so the provider cannot read the plaintext. Provider-managed encryption and TLS protect data but leave the provider able to decrypt or terminate the channel.

Question 38Asset Security

An administrator must dispose of solid-state drives that held regulated data. Which method is most appropriate?

  1. A single-pass overwrite of the drive
  2. Deleting the files from the operating system
  3. Reformatting the file system
  4. Cryptographic erasure followed by verified destruction Correct answer.

Explanation

SSDs use wear leveling and may retain data in spare blocks, so overwriting is unreliable; cryptographic erase combined with physical destruction is the defensible approach. Formatting or deleting files leaves recoverable remnants.

Question 39Asset Security

Which classification scheme is most appropriate for a government agency handling information whose disclosure could cause grave damage to national security?

  1. A scheme based only on storage location
  2. A hierarchical scheme with levels such as Confidential, Secret, and Top Secret Correct answer.
  3. A flat scheme with a single label of Internal
  4. A scheme based only on data age

Explanation

Government classification uses a hierarchical scheme in which higher levels reflect greater potential damage from disclosure. Flat labels, age, or location do not capture the sensitivity gradations required.

Question 40Asset Security

A data owner wants to allow analysts to view aggregate statistics without exposing individual records. Which technique best fits?

  1. Tokenization of the primary key
  2. Full record-level access
  3. Field-level encryption of every column
  4. Aggregation with a minimum group size threshold Correct answer.

Explanation

Aggregation combined with a minimum group size prevents inference of individual values from small groups. Record-level access or tokenizing keys does not stop re-identification from small aggregate results.

Question 41Asset Security

Which statement best describes the relationship between data classification and access control?

  1. Access control is applied only to unclassified data
  2. Classification and access control are independent
  3. Classification labels drive the access rules applied to the data Correct answer.
  4. Access rules determine the classification level

Explanation

Classification establishes sensitivity, and access control enforces who may handle data at each level. The label informs the rule; the rule does not set the label.

Question 42Asset Security

An organization needs to destroy paper records containing sensitive data. Which method is most appropriate?

  1. Scanning them to a shared drive
  2. Placing them in a locked cabinet
  3. Storing them in an offsite warehouse
  4. Cross-cut shredding or incineration Correct answer.

Explanation

Physical destruction such as cross-cut shredding or incineration renders paper records unrecoverable. Locking, storing, or scanning does not destroy the information and may create new copies.

Question 43Asset Security

Which control best addresses the risk of sensitive data being copied to removable media by an insider?

  1. Increasing network bandwidth
  2. Encrypting backups stored offsite
  3. Rotating administrator passwords quarterly
  4. Endpoint controls that block or log writes to removable media Correct answer.

Explanation

Endpoint controls restricting removable-media writes directly limit exfiltration through USB devices. Backup encryption, password rotation, and bandwidth do not prevent copying to removable media.

Question 44Asset Security

A retention policy specifies that records must be kept for five years and then destroyed. Which element is most important to include so the policy can be enforced?

  1. A performance baseline
  2. A list of all employees
  3. A defined destruction method and verification step Correct answer.
  4. A marketing plan

Explanation

Enforceable retention requires a specified destruction method and verification that destruction occurred. Employee lists, marketing plans, and performance baselines do not support retention enforcement.

Question 45Asset Security

Which practice best supports data minimization in a new application?

  1. Retaining all fields for potential future use
  2. Collecting only the fields required for the stated purpose Correct answer.
  3. Storing data in multiple locations for redundancy
  4. Copying production data to test environments

Explanation

Data minimization limits collection to what is necessary for the defined purpose, reducing exposure and compliance burden. Retaining extra fields, copying production data to test, and duplicating storage all increase the data footprint.

Question 46Asset Security

A security team must determine whether a vendor's handling of data meets contractual security requirements. Which artifact is most relevant?

  1. The vendor's marketing brochure
  2. A service organization control report covering the relevant period Correct answer.
  3. The vendor's organizational chart
  4. The vendor's product roadmap

Explanation

An independent service organization control report covering the relevant period provides evidence about the vendor's controls. Marketing, org charts, and roadmaps do not attest to control effectiveness.

Question 47Asset Security

An analyst finds that combining two separately non-sensitive data sets reveals sensitive information. Which concept does this illustrate?

  1. Aggregation Correct answer.
  2. Tokenization
  3. Versioning
  4. Redaction

Explanation

Aggregation occurs when combining data elements produces sensitivity greater than any element alone. Tokenization, redaction, and versioning are handling techniques, not the inference phenomenon described.

Question 48Asset Security

A data owner delegates backup operations to a custodian. Which responsibility should remain with the owner?

  1. Performing the nightly backup job
  2. Replacing failed backup drives
  3. Approving who may access the backed-up data Correct answer.
  4. Monitoring backup job completion

Explanation

Access approval is an owner decision tied to classification, while operational tasks such as running jobs, replacing hardware, and monitoring completion belong to the custodian. Delegating operations does not transfer accountability for access decisions.

Question 49Asset Security

An organization uses format-preserving encryption for a payment field so that downstream systems need no schema changes. Which trade-off should the security team evaluate?

  1. Whether the application can log the field
  2. Whether the reduced ciphertext space weakens resistance to brute-force attacks Correct answer.
  3. Whether the database can be backed up
  4. Whether the field can still be indexed

Explanation

Format-preserving encryption constrains ciphertext to a small domain, which can reduce the effective key space and resistance to brute force. Indexing, backup, and logging are operational concerns, not the core cryptographic trade-off.

Question 50Asset Security

A regulator requires that personal data be irreversibly de-identified before secondary research use. Which approach best satisfies this requirement?

  1. Restricting access to the research team
  2. Removing direct identifiers and applying a validated de-identification method with re-identification risk testing Correct answer.
  3. Encrypting identifiers with a key held by the research team
  4. Replacing names with initials

Explanation

Irreversible de-identification requires removing direct identifiers and applying a validated method, then testing residual re-identification risk. Reversible encryption, trivial pseudonyms, or access restriction alone do not achieve irreversibility.