I85PREP
⌘ K
ASIS APP study materials
ASIS APP study resources

ASIS APP practice questions

One question at a time. Build your ASIS APP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals

Which security principle holds that a person should be granted only the minimum access needed to perform their job?

  1. Due diligence
  2. Separation of duties
  3. Least privilege Correct answer.
  4. Defense in depth

Explanation

Least privilege limits each subject's access rights to only what is required for the assigned tasks, reducing the blast radius of misuse or compromise. Separation of duties divides a sensitive task among multiple people, and defense in depth layers controls.

Question 2Security Fundamentals

In the CIA triad, which property is directly violated when an unauthorized person alters a financial record?

  1. Confidentiality
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity concerns the accuracy and completeness of data and systems; unauthorized modification directly compromises it. Confidentiality concerns disclosure, and availability concerns timely access.

Question 3Security Fundamentals

A control that uses a fingerprint scanner to verify identity before entry is best classified as which type of control?

  1. Technical Correct answer.
  2. Physical
  3. Administrative
  4. Directive

Explanation

A fingerprint scanner is a technical (logical) control because it relies on technology to enforce access. Physical controls act on the built environment, and administrative controls are policy and procedure.

Question 4Security Fundamentals

Which term describes the likelihood that a threat will exploit a vulnerability, combined with the resulting impact?

  1. Risk Correct answer.
  2. Exposure
  3. Vulnerability
  4. Threat

Explanation

Risk expresses the potential for loss and is commonly framed as the product of likelihood and impact. A threat is an actor or event, and a vulnerability is a weakness that can be exploited.

Question 5Security Fundamentals

Which document establishes management's intent and direction for security across an organization?

  1. Standard
  2. Security policy Correct answer.
  3. Procedure
  4. Baseline configuration

Explanation

A security policy is a high-level statement of management intent that governs the security program. Standards, baselines, and procedures implement that intent at increasing levels of detail.

Question 6Security Fundamentals

Which of the following best describes an asset in an information security context?

  1. The measure of harm from a realized event
  2. Any weakness that an attacker could exploit
  3. A potential source of harm to the organization
  4. Anything of value to the organization that requires protection Correct answer.

Explanation

Assets are the resources of value to an organization, including data, systems, people, and facilities. Vulnerabilities, threats, and impact describe other parts of the risk relationship.

Question 7Security Fundamentals

What is the primary purpose of a security awareness and training program?

  1. To certify technical staff on security tools
  2. To replace administrative controls with technical ones
  3. To build user knowledge so personnel recognize and report threats Correct answer.
  4. To satisfy audit requirements without changing behavior

Explanation

Awareness and training programs aim to equip personnel to recognize threats and respond appropriately, which reduces human-factor risk. They complement rather than replace technical or administrative controls.

Question 8Security Fundamentals

Which element of the CIA triad is most directly supported by maintaining tested backups of critical data?

  1. Integrity
  2. Availability Correct answer.
  3. Authenticity
  4. Confidentiality

Explanation

Tested backups allow restoration of services and data after disruption, directly supporting availability. Confidentiality and integrity are supported secondarily through encryption or hashing, not by the existence of backups alone.

Question 9Security Fundamentals

An organization requires two employees to approve any wire transfer above a set amount. Which principle does this control implement?

  1. Job rotation
  2. Separation of duties Correct answer.
  3. Need to know
  4. Least privilege

Explanation

Separation of duties requires more than one person to complete a sensitive transaction, preventing unilateral fraud or error. Least privilege limits the scope of access, and job rotation moves people among roles.

Question 10Security Fundamentals

A company installs perimeter firewalls, host-based antivirus, and network monitoring. Which concept does this combination illustrate?

  1. Security through obscurity
  2. Least privilege
  3. Single point of failure
  4. Defense in depth Correct answer.

Explanation

Defense in depth layers independent controls so that failure of one does not leave the environment unprotected. The combination of network, host, and monitoring controls reflects that layered approach.

Question 11Security Fundamentals

Which type of control is a warning banner on a login screen that states authorized-use conditions?

  1. Directive Correct answer.
  2. Preventive
  3. Corrective
  4. Detective

Explanation

Directive controls guide or inform behavior, and a login warning banner tells users what is expected and permitted. Preventive controls block actions, detective controls identify them, and corrective controls restore conditions.

Question 12Security Fundamentals

An attacker exploits a known software flaw for which a patch exists but has not been applied. Which term best describes the flaw itself?

  1. Threat
  2. Vulnerability Correct answer.
  3. Exploit
  4. Risk

Explanation

The unpatched flaw is a vulnerability, a weakness that can be exploited. The attacker or attack method is the threat, and the exploit is the code or technique that takes advantage of the flaw.

Question 13Security Fundamentals

Which statement best distinguishes a standard from a procedure?

  1. A standard applies only to technology, while a procedure applies only to people
  2. A standard is optional guidance, while a procedure is mandatory
  3. A standard defines mandatory requirements, while a procedure gives step-by-step instructions Correct answer.
  4. A standard is created by auditors, while a procedure is created by management

Explanation

Standards set mandatory requirements that must be met, while procedures describe the specific steps to accomplish a task. Both sit beneath policy and are not limited to technology or people alone.

Question 14Security Fundamentals

Which practice best supports the principle of need to know?

  1. Sharing credentials among team members
  2. Publishing data classification labels externally
  3. Granting broad access to speed up collaboration
  4. Reviewing and removing access when it is no longer required Correct answer.

Explanation

Need to know requires that access be limited to those with a legitimate requirement, and periodic review removes access that is no longer justified. Broad access and credential sharing conflict with this principle.

Question 15Security Fundamentals

An organization classifies data and applies handling rules based on sensitivity. What is the primary benefit of this practice?

  1. It guarantees data cannot be breached
  2. It eliminates the need for access controls
  3. It ensures controls are proportionate to the value and sensitivity of the data Correct answer.
  4. It removes the requirement for employee training

Explanation

Classification lets an organization apply controls proportionate to sensitivity and value, focusing effort where it matters most. It informs but does not replace access controls or training.

Question 16Security Fundamentals

Which statement about the relationship between threats, vulnerabilities, and risk is accurate?

  1. A vulnerability alone always constitutes high risk
  2. Threats are irrelevant if a vulnerability has never been exploited
  3. Eliminating all vulnerabilities eliminates all risk
  4. Risk exists only when a threat can exploit a vulnerability with meaningful impact Correct answer.

Explanation

Risk arises from the combination of a threat, a vulnerability, and potential impact; without a credible threat or impact, risk is minimal. Vulnerabilities and threats must be considered together.

Question 17Security Fundamentals

Which control type is a log review that identifies unauthorized access attempts after they occur?

  1. Preventive
  2. Compensating
  3. Deterrent
  4. Detective Correct answer.

Explanation

Detective controls identify and record events such as unauthorized access attempts, often after the fact. Preventive controls stop events, deterrent controls discourage them, and compensating controls substitute for other controls.

Question 18Security Fundamentals

A security manager documents acceptable use rules for company laptops and mobile devices. Which category of control does this represent?

  1. Administrative Correct answer.
  2. Technical
  3. Environmental
  4. Physical

Explanation

Acceptable use rules are administrative controls because they are policy-based direction for behavior. Technical controls are enforced by systems, and physical controls act on the physical environment.

Question 19Security Fundamentals

An organization discovers that departing employees retain active accounts for weeks after leaving. Which principle is most directly undermined?

  1. Separation of duties
  2. Least privilege Correct answer.
  3. Due care
  4. Defense in depth

Explanation

Accounts that outlive the job requirement grant access beyond what is needed, violating least privilege. Timely deprovisioning is a core least-privilege practice.

Question 20Security Fundamentals

Which statement best explains why security must be integrated into each phase of the system development life cycle?

  1. It removes the need for post-deployment monitoring
  2. It guarantees the absence of design defects
  3. It reduces the cost and effort of remediating flaws found late in development Correct answer.
  4. It shifts all security responsibility to developers

Explanation

Addressing security early, such as during requirements and design, is generally far cheaper than fixing flaws after deployment. Integration complements rather than replaces monitoring and shared responsibility.

Question 21Security Fundamentals

A control is described as compensating when it does which of the following?

  1. Detects an incident after it has occurred
  2. Prevents an incident from occurring at all
  3. Restores systems to normal operation after an incident
  4. Provides an alternative safeguard when the primary control is impractical Correct answer.

Explanation

A compensating control is an alternative measure that provides reasonable protection when the preferred control cannot be applied. Preventive, detective, and corrective describe the control's function rather than its role as a substitute.

Question 22Security Fundamentals

An organization accepts a documented risk because the cost of the control exceeds the potential loss. Which risk treatment option has been applied?

  1. Risk avoidance
  2. Risk mitigation
  3. Risk acceptance Correct answer.
  4. Risk transfer

Explanation

Risk acceptance is a deliberate decision to retain a risk, often because treatment cost outweighs the benefit. Avoidance eliminates the activity, transfer shifts financial impact, and mitigation reduces likelihood or impact.

Question 23Security Fundamentals

Why does the principle of least privilege reduce the potential impact of a compromised account?

  1. It logs every action the account performs
  2. It limits the resources and actions available to the compromised identity Correct answer.
  3. It encrypts all data the account can access
  4. It forces periodic password changes for the account

Explanation

Least privilege constrains what an identity is authorized to do, so a compromise exposes fewer resources and actions. Encryption, password rotation, and logging are separate controls that may complement but do not define least privilege.

Question 24Security Fundamentals

Which scenario best illustrates a residual risk that remains after controls are implemented?

  1. A threat that has been fully eliminated by a new firewall
  2. A risk that has been transferred entirely to an insurer
  3. The portion of risk remaining after mitigation that management chooses to tolerate Correct answer.
  4. The total risk present before any controls are applied

Explanation

Residual risk is what remains after controls are applied and is consciously accepted or further treated by management. Inherent risk is the risk before controls, and transfer shifts financial consequence without eliminating the underlying exposure.

Question 25Security Fundamentals

An organization applies a control that both prevents and detects an activity, such as an access control system that blocks entry and logs attempts. How should this control be characterized?

  1. It is an administrative control because it logs activity
  2. It is a compensating control because it performs two roles
  3. It can serve multiple control functions simultaneously Correct answer.
  4. It must be classified as purely preventive because it blocks entry

Explanation

A single control can serve more than one function, such as preventing access while also detecting and recording attempts. Classification describes functions, and controls are not restricted to a single category.

Question 26Security Fundamentals

Which concept describes the assurance that data has not been altered by an unauthorized party?

  1. Availability
  2. Confidentiality
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity concerns the accuracy and completeness of data and the assurance that it has not been changed improperly. Confidentiality protects against disclosure, while availability ensures timely access. Non-repudiation prevents a party from denying an action.

Question 27Security Fundamentals

Which term describes a weakness in a system that a threat could exploit?

  1. Vulnerability Correct answer.
  2. Risk
  3. Impact
  4. Exposure

Explanation

A vulnerability is a weakness or flaw in a system, process, or control that a threat source could exploit. Risk combines threat, vulnerability, and impact, while exposure refers to being open to loss.

Question 28Security Fundamentals

What is the primary purpose of a security policy?

  1. To describe the step-by-step process for handling incidents
  2. To state management's intent and mandatory requirements for protecting assets Correct answer.
  3. To specify the exact commands used to configure a firewall
  4. To list the technical specifications of approved hardware

Explanation

A policy communicates management's direction and mandatory high-level requirements. Standards, procedures, and guidelines translate policy into specifics. Policies deliberately avoid technical detail so they remain stable.

Question 29Security Fundamentals

Which security control category is a locked door intended to stop unauthorized entry?

  1. Preventive Correct answer.
  2. Compensating
  3. Detective
  4. Corrective

Explanation

Preventive controls are designed to stop an event before it occurs. A locked door physically blocks access. Detective controls identify events, corrective controls restore conditions after an event, and compensating controls substitute for a primary control.

Question 30Security Fundamentals

Which practice best supports the principle of separation of duties?

  1. Requiring two different people to complete a sensitive transaction Correct answer.
  2. Rotating security guards through the same post each shift
  3. Granting each employee the broadest access needed for peak workload
  4. Assigning the same person to both request and approve payments

Explanation

Separation of duties splits a sensitive task so that no single person controls all parts of it. Requiring two different people to request and approve a payment enforces that split. This reduces the opportunity for fraud or undetected error.

Question 31Security Fundamentals

Which statement best describes defense in depth?

  1. Layering multiple independent controls so a failure of one does not expose the asset Correct answer.
  2. Relying on a single strong control to protect all assets
  3. Removing redundant controls to reduce cost and complexity
  4. Applying the same control uniformly to every system

Explanation

Defense in depth uses multiple overlapping controls across people, process, and technology so that a single failure does not lead directly to compromise. Independence among layers is what provides the resilience. A single control, however strong, is a single point of failure.

Question 32Security Fundamentals

Which activity is the first step in a formal risk assessment?

  1. Selecting controls to mitigate each risk
  2. Testing the incident response plan
  3. Purchasing cyber insurance
  4. Identifying and valuing the assets in scope Correct answer.

Explanation

A risk assessment begins by identifying the assets in scope and understanding their value, because risk is meaningful only relative to what is being protected. Control selection and insurance decisions follow the assessment. Incident response testing is unrelated to the assessment sequence.

Question 33Security Fundamentals

Which term describes the process of verifying that a user is who they claim to be?

  1. Authentication Correct answer.
  2. Accounting
  3. Auditing
  4. Authorization

Explanation

Authentication establishes and verifies a claimed identity, typically through something the user knows, has, or is. Authorization determines what an authenticated identity may do. Accounting and auditing record and review activity.

Question 34Security Fundamentals

An employee receives an email that appears to come from the IT help desk and asks them to confirm their password on a linked page. Which threat does this best illustrate?

  1. Shoulder surfing
  2. Tailgating
  3. Phishing Correct answer.
  4. Denial of service

Explanation

Phishing uses a fraudulent message that impersonates a trusted party to trick the recipient into revealing credentials or clicking a malicious link. Shoulder surfing and tailgating are physical observation or access threats. Denial of service targets availability rather than credentials.

Question 35Security Fundamentals

A security team wants to reduce the chance that a single compromised administrator account can delete the audit logs. Which approach best addresses this concern?

  1. Encrypting the audit logs with a key held by the same administrators
  2. Storing audit logs on a separate system that administrators cannot modify Correct answer.
  3. Increasing the log retention period on the local server
  4. Granting administrators full control so they can respond quickly

Explanation

Sending logs to a separate, access-restricted system preserves their integrity even if an administrator account is compromised. Administrators who can modify or decrypt the logs could still tamper with them. Retention settings alone do not prevent deletion.

Question 36Security Fundamentals

Which statement best distinguishes a threat from a vulnerability?

  1. A threat is a potential cause of harm, while a vulnerability is a weakness that could be exploited Correct answer.
  2. A threat and a vulnerability are the same thing viewed from different departments
  3. A threat is always intentional, while a vulnerability is always accidental
  4. A threat is a weakness in a control, while a vulnerability is an external actor

Explanation

A threat is any potential cause of an unwanted incident, such as an attacker or a natural event. A vulnerability is a weakness that the threat could exploit. The two combine with impact to produce risk.

Question 37Security Fundamentals

An organization wants to ensure that a terminated employee loses access immediately. Which control is most directly suited to this goal?

  1. A password complexity standard
  2. Annual security awareness training
  3. A quarterly access review of privileged accounts
  4. An automated deprovisioning process tied to HR termination records Correct answer.

Explanation

Automated deprovisioning triggered by the HR system removes access promptly and consistently when employment ends. Periodic reviews and training act on slower cycles and cannot guarantee immediate revocation. Password standards do not address account lifecycle.

Question 38Security Fundamentals

Which factor most directly influences the likelihood component of risk?

  1. The length of the audit log retention period
  2. The frequency and capability of the threat combined with the exposure of the vulnerability Correct answer.
  3. The replacement cost of the affected hardware
  4. The number of pages in the security policy

Explanation

Likelihood reflects how probable it is that a threat will exploit a vulnerability, which depends on threat capability and frequency and on how exposed the weakness is. Asset replacement cost relates to impact, not likelihood. Policy length and log retention do not drive likelihood.

Question 39Security Fundamentals

Which statement about guidelines is accurate?

  1. They are mandatory and enforceable like standards
  2. They define the sequence of steps for a specific task
  3. They are issued only by external regulators
  4. They are recommended practices that allow discretion in application Correct answer.

Explanation

Guidelines are recommended, non-mandatory advice that supports policy and allows judgment in how they are applied. Standards are mandatory and specific, while procedures define step sequences. Guidelines can be developed internally.

Question 40Security Fundamentals

A company stores customer records in a cloud service and wants to confirm that the provider secures the underlying infrastructure. Which action best provides this assurance?

  1. Disabling the company's own access controls on the data
  2. Assuming the provider handles all security responsibilities
  3. Relying on the provider's marketing materials
  4. Reviewing independent audit reports and certifications from the provider Correct answer.

Explanation

In a shared responsibility model, the customer must verify the provider's controls through independent audit reports and certifications. Marketing claims are not reliable evidence of control effectiveness. The customer retains responsibility for its own data and access controls.

Question 41Security Fundamentals

Which practice most directly limits the damage that can result from a compromised user account?

  1. Limiting the account's permissions to only what its role requires Correct answer.
  2. Setting the password to never expire
  3. Sharing the account among several team members
  4. Granting the account administrative rights so issues can be fixed quickly

Explanation

Least privilege limits an account to the permissions its role requires, which constrains what an attacker can do if the account is compromised. Administrative rights, shared accounts, and non-expiring passwords all increase exposure. Limiting permissions reduces blast radius.

Question 42Security Fundamentals

An organization reviews its risk register and decides to purchase insurance to cover potential losses from a data breach. Which risk treatment option does this represent?

  1. Risk transfer Correct answer.
  2. Risk mitigation
  3. Risk acceptance
  4. Risk avoidance

Explanation

Risk transfer shifts the financial consequence of a risk to another party, such as an insurer. Mitigation reduces the risk itself, avoidance eliminates the activity, and acceptance retains the risk. Insurance does not reduce the likelihood of the event.

Question 43Security Fundamentals

Which statement best explains why awareness training alone does not eliminate phishing risk?

  1. Training is only effective for technical staff
  2. Training is prohibited in regulated industries
  3. Phishing only targets executives
  4. Attackers continually change tactics, and some users will still act on convincing messages Correct answer.

Explanation

Awareness reduces but does not eliminate the chance a user will be deceived, because attackers adapt and some messages are highly convincing. Effective programs pair training with technical controls such as filtering and multi-factor authentication. Training applies to all staff and is permitted in regulated industries.

Question 44Security Fundamentals

A data owner must decide who may access a sensitive dataset. Which role is accountable for that decision?

  1. The data owner who is accountable for the data Correct answer.
  2. The end user who requests access
  3. The external auditor who reviews controls
  4. The data custodian who operates the backup system

Explanation

The data owner is accountable for classifying data and deciding who may access it. Custodians implement and operate the controls the owner specifies, and users consume data under those rules. Auditors provide independent assurance but do not set access decisions.

Question 45Security Fundamentals

Which control is best classified as administrative rather than technical or physical?

  1. A documented background screening process for new hires Correct answer.
  2. A firewall rule set that blocks inbound traffic
  3. A biometric reader on a data center door
  4. A locked cabinet for backup tapes

Explanation

Administrative controls are management policies and processes, such as background screening, that govern how people behave. Biometric readers, firewalls, and locked cabinets are technical or physical safeguards. The distinction is based on the nature of the safeguard.

Question 46Security Fundamentals

An organization runs a tabletop exercise in which staff walk through a simulated ransomware incident. Which objective does this activity primarily serve?

  1. Validating roles, decisions, and communications before a real event Correct answer.
  2. Satisfying the requirement for a vulnerability scan
  3. Confirming the accuracy of the asset inventory
  4. Proving that backups are encrypted

Explanation

A tabletop exercise tests plans, roles, and decision-making in a discussion-based setting so gaps can be found before a real incident. It does not validate technical controls such as encryption or scanning. Asset inventory accuracy is a separate activity.

Question 47Security Fundamentals

A team calculates that a control costs more each year than the expected annual loss it would prevent. Which conclusion is most defensible?

  1. The control should be implemented regardless of cost
  2. The risk no longer exists once the control is evaluated
  3. The expected annual loss must be recalculated until it exceeds the control cost
  4. The control may not be justified on cost-benefit grounds and other treatments should be considered Correct answer.

Explanation

Risk treatment decisions weigh the cost of a control against the reduction in expected loss it provides. When cost exceeds the benefit, alternatives such as acceptance, transfer, or a less costly control should be considered. Evaluating a control does not eliminate the underlying risk.

Question 48Security Fundamentals

An attacker gains entry using stolen credentials and then moves laterally to other systems. Which control would most directly limit lateral movement after the initial compromise?

  1. A more frequent data backup schedule
  2. Network segmentation that restricts host-to-host traffic to required paths Correct answer.
  3. A longer minimum password length
  4. A privacy notice on the login page

Explanation

Segmentation limits which systems can communicate, so a compromised host cannot freely reach others. Stronger passwords reduce credential theft but not movement once credentials are valid. Notices and backups do not constrain internal traffic flows.

Question 49Security Fundamentals

An organization implements a control and later determines that a portion of the risk remains because the control cannot address every scenario. Which term best describes that remaining risk?

  1. Risk appetite
  2. Risk transfer
  3. Residual risk Correct answer.
  4. Inherent risk

Explanation

Residual risk is what remains after controls have been applied. Inherent risk is the level before controls, risk appetite is the amount of risk an organization is willing to accept, and transfer shifts financial consequence to another party. Residual risk must be evaluated against the appetite.

Question 50Security Fundamentals

A security architect argues that a preventive control should be paired with a detective control for the same threat. Which rationale best supports this argument?

  1. A preventive control can fail or be bypassed, and detection provides evidence that the threat occurred Correct answer.
  2. Detective controls are always cheaper than preventive controls
  3. Detective controls reduce the need for authentication
  4. Preventive controls eliminate the need for logging

Explanation

Preventive controls can fail, be misconfigured, or be bypassed, so detective controls provide visibility when prevention does not hold. This pairing supports defense in depth and enables timely response. Detection does not replace authentication or make prevention unnecessary.