I85PREP
⌘ K
CSPI study materials
CSPI study resources

CSPI practice questions

One question at a time. Build your CSPI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Principles and Risk Management

An organization encrypts its customer database so that only authorized applications can read the stored records. Which element of the CIA triad is primarily being addressed?

  1. Confidentiality Correct answer.
  2. Availability
  3. Integrity
  4. Non-repudiation of transactions

Explanation

Confidentiality ensures information is disclosed only to authorized parties, and encryption enforces that by making data unreadable without the key. Integrity concerns unauthorized modification, availability concerns timely access, and non-repudiation concerns proving an action occurred.

Question 2Security Principles and Risk Management

A help desk analyst is given only the permissions required to reset passwords and unlock accounts, and nothing more. Which principle does this best illustrate?

  1. Least privilege Correct answer.
  2. Separation of duties
  3. Mandatory access control
  4. Defense in depth

Explanation

Least privilege means granting only the access necessary for a user's job tasks and no more, which limits the damage from error or compromise. Separation of duties splits a task among people, defense in depth layers controls, and mandatory access control governs access by labels rather than by job need.

Question 3Security Principles and Risk Management

A data center requires a badge scan and a biometric fingerprint before the door unlocks. This is best classified as which type of control?

  1. Detective
  2. Preventive Correct answer.
  3. Compensating
  4. Corrective

Explanation

Preventive controls stop an incident before it occurs, and requiring a badge plus a fingerprint before unlocking a door is designed to stop unauthorized entry. Detective controls record or notice events, corrective controls act after an event, and compensating controls substitute for a control that cannot be applied.

Question 4Security Principles and Risk Management

In risk management, risk is best described as which of the following?

  1. Likelihood and impact of a threat exploiting a weakness Correct answer.
  2. A weakness or gap in a control that an attacker could exploit
  3. The financial loss from a single realized incident
  4. Any circumstance that could cause harm to an asset

Explanation

Risk combines the likelihood that a threat will exploit a vulnerability with the impact if it does. A weakness is a vulnerability, a potential cause of harm is a threat, and the loss from a single incident is an impact figure.

Question 5Security Principles and Risk Management

A company buys a cyber liability insurance policy to cover potential breach costs. Which risk treatment option does this represent?

  1. Risk transfer Correct answer.
  2. Risk mitigation
  3. Risk avoidance
  4. Risk acceptance

Explanation

Risk transfer shifts the financial consequence of a risk to a third party, as with insurance. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the risk without further action.

Question 6Security Principles and Risk Management

A user logs in by inserting a smart card into a reader and entering a PIN. The smart card itself represents which authentication factor?

  1. Something you know
  2. Somewhere you are
  3. Something you are
  4. Something you have Correct answer.

Explanation

Authentication factors are categorized as something you know, something you have, and something you are. A smart card is a physical object the user possesses, so it is a possession factor.

Question 7Security Principles and Risk Management

Which document type establishes mandatory, high-level requirements and is approved by senior management?

  1. Policy Correct answer.
  2. Guideline
  3. Procedure
  4. Baseline

Explanation

Policies state management's mandatory high-level direction and are approved at the senior level. Standards specify mandatory details, procedures give step-by-step instructions, and guidelines are recommended, non-mandatory advice.

Question 8Security Principles and Risk Management

Comparing a file's SHA-256 digest before and after transfer primarily verifies which property?

  1. Availability
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Confidentiality

Explanation

A cryptographic hash is a fixed-length digest that changes if the data changes, so comparing digests detects modification and confirms integrity. Hashes do not keep data secret, ensure uptime, or by themselves bind a message to an identity.

Question 9Security Principles and Risk Management

An asset is valued at $200,000. A flood would destroy 25% of its value, and such a flood is expected once every four years. What is the annualized loss expectancy (ALE)?

  1. $50,000
  2. $12,500 Correct answer.
  3. $200,000
  4. $800,000

Explanation

Single loss expectancy equals asset value times exposure factor ($200,000 x 0.25 = $50,000), and ALE equals SLE times the annualized rate of occurrence ($50,000 x 0.25 = $12,500).

Question 10Security Principles and Risk Management

Which statement correctly describes the relationship between recovery time objective (RTO) and maximum tolerable downtime (MTD)?

  1. RTO applies only to data backups, while MTD applies to networks
  2. RTO must not exceed MTD if outage impact is to stay tolerable Correct answer.
  3. RTO must always equal MTD so that recovery is predictable
  4. RTO is the amount of data loss the business can accept

Explanation

The recovery time objective is the target time to restore a service, and it must fall within the maximum tolerable downtime or the outage exceeds what the business can survive. RPO concerns tolerable data loss, and both RTO and MTD apply to business processes and their supporting systems generally.

Question 11Security Principles and Risk Management

An organization combines firewalls, endpoint antivirus, network segmentation, and employee training to protect a critical service. Which concept does this best illustrate?

  1. Least privilege
  2. Separation of duties
  3. Single point of failure
  4. Defense in depth Correct answer.

Explanation

Defense in depth layers independent controls so that failure of one does not expose the asset; firewalls, endpoint protection, segmentation, and training are such layers. Least privilege and separation of duties are access-scoping principles, and a single point of failure is the opposite of layered protection.

Question 12Security Principles and Risk Management

In a payment system, the employee who creates a vendor record cannot also approve payments to that vendor. Which control principle is being applied?

  1. Mandatory vacation
  2. Least privilege
  3. Job rotation
  4. Separation of duties Correct answer.

Explanation

Separation of duties requires that no single person control all parts of a sensitive transaction, so creating a vendor and approving its payments are split. Job rotation and mandatory vacation are deterrents, and least privilege limits the scope of each person's access.

Question 13Security Principles and Risk Management

Which item is the primary purpose of a risk register?

  1. To document the organization's encryption algorithms
  2. To track identified risks, owners, and treatment status Correct answer.
  3. To log every security event detected by monitoring tools
  4. To list the technical configuration of each server

Explanation

A risk register is the record of identified risks with attributes such as owner, likelihood, impact, and treatment status. Event logs, asset configuration records, and cryptographic standards are separate artifacts.

Question 14Security Principles and Risk Management

During threat modeling, a team asks whether an attacker could alter order details while they travel between two services. Which STRIDE category covers this?

  1. Tampering Correct answer.
  2. Repudiation
  3. Spoofing
  4. Elevation of privilege

Explanation

STRIDE's tampering category covers unauthorized modification of data, including data in transit between services. Spoofing is impersonation, repudiation is denying an action, and elevation of privilege is gaining rights the attacker should not have.

Question 15Security Principles and Risk Management

An analyst has confirmed that a workstation is infected with malware. According to a standard incident response lifecycle, which phase should come next?

  1. Preparation
  2. Containment, eradication, and recovery Correct answer.
  3. Detection and analysis
  4. Lessons learned and post-incident activity

Explanation

The typical lifecycle runs from preparation to detection and analysis, then containment, eradication, and recovery, followed by post-incident activity. Once an incident is confirmed, the immediate next step is to contain it and remove the cause.

Question 16Security Principles and Risk Management

A hospital labels records as public, internal, confidential, or restricted, and defines handling rules for each label. What is this practice called?

  1. Data classification Correct answer.
  2. Data retention
  3. Data masking
  4. Data minimization

Explanation

Data classification assigns labels by sensitivity and ties each label to handling requirements for storage, transmission, and disposal. Retention, minimization, and masking are separate data protection practices.

Question 17Security Principles and Risk Management

Before signing a contract with a new cloud provider that will process customer data, a firm reviews the provider's audit reports and adds a right-to-audit clause. This activity belongs to which practice?

  1. Change management
  2. Third-party risk management Correct answer.
  3. Capacity management
  4. Vulnerability scanning

Explanation

Third-party risk management covers due diligence on vendors, contractual safeguards such as right-to-audit clauses, and ongoing monitoring. Vulnerability scanning, change management, and capacity management are internal operational processes.

Question 18Security Principles and Risk Management

After new controls are implemented, the risk that remains is known as which of the following, and who should formally accept it?

  1. Secondary risk, accepted by the vendor
  2. Residual risk, accepted by management Correct answer.
  3. Control risk, accepted by the auditor
  4. Inherent risk, accepted by the IT administrator

Explanation

Residual risk is what remains after controls are applied, and management, not administrators, vendors, or auditors, holds the authority to accept it. Inherent risk is the level before controls, secondary risk is created by a treatment, and control risk concerns whether a control operates as intended.

Question 19Security Principles and Risk Management

A message is signed with the sender's private key and verified with the sender's public key. Which security service does this provide?

  1. Non-repudiation Correct answer.
  2. Confidentiality
  3. Anonymity
  4. Availability

Explanation

Signing with a private key that only the sender controls, and verifying with the corresponding public key, binds the message to the sender and prevents later denial. Confidentiality requires encryption with the recipient's key, availability is unrelated, and signatures typically identify rather than anonymize the sender.

Question 20Security Principles and Risk Management

A scanner reports hundreds of findings. Which approach best prioritizes remediation?

  1. Remediate only findings that are reachable from the internet
  2. Remediate findings strictly in the order the scanner lists them
  3. Remediate the findings with the longest descriptions first
  4. Rank by severity, exploitability, and asset criticality Correct answer.

Explanation

Effective prioritization weighs technical severity against real exposure and business value, so a medium-severity flaw on a critical internet-facing system can outrank a high-severity flaw on an isolated test host. Scanner order and description length are arbitrary, and ignoring internally exploitable findings leaves real risk.

Question 21Security Principles and Risk Management

An executive states that the company will accept no more than $2 million of annual loss from any single risk category, while generally preferring low-risk ventures. The $2 million figure best represents which concept?

  1. Risk tolerance Correct answer.
  2. Risk avoidance
  3. Risk appetite
  4. Risk capacity

Explanation

Risk tolerance is the acceptable variation around the risk appetite, expressed here as a concrete limit on annual loss. Risk appetite is the broader amount of risk the organization is willing to pursue, risk capacity is the maximum it could bear, and avoidance means exiting the activity.

Question 22Security Principles and Risk Management

A control costs $30,000 per year and would reduce a risk's ALE from $80,000 to $20,000. What is the net annual benefit of implementing the control?

  1. $80,000
  2. $60,000
  3. $30,000 Correct answer.
  4. $50,000

Explanation

The control reduces expected annual loss by $80,000 minus $20,000, or $60,000, and after subtracting its $30,000 annual cost the net benefit is $30,000. A positive net benefit indicates the control is economically justified.

Question 23Security Principles and Risk Management

Which pair correctly distinguishes due care from due diligence?

  1. Due care is an insurance concept; due diligence is a technical control
  2. Due care is periodic assessment of controls; due diligence is the actions taken to protect assets
  3. Due care is implementing reasonable safeguards; due diligence is ongoing verification that they work Correct answer.
  4. Due care applies only to vendors; due diligence applies only to employees

Explanation

Due care is the practice of acting on identified risks by putting reasonable safeguards in place, while due diligence is the ongoing effort to verify those safeguards and the risk environment. The two are complementary halves of a documented risk management program.

Question 24Security Principles and Risk Management

Which statement best reflects a zero trust architecture?

  1. Access is granted based on the strength of the perimeter firewall
  2. All users are placed on the same flat network for ease of administration
  3. Devices inside the corporate network are trusted by default after authentication
  4. Every request is authenticated and authorized regardless of network location Correct answer.

Explanation

Zero trust removes implicit trust based on network location and requires every request to be authenticated and authorized using context such as identity and device posture. Implicit trust for internal devices, firewall strength as the basis of access, and flat networks are characteristics of traditional perimeter models.

Question 25Security Principles and Risk Management

A marketing team wants to collect a customer's birth date for a promotion. The privacy office approves collection only of the fields that are strictly necessary for that promotion. Which privacy principle is being applied?

  1. Purpose limitation
  2. Data minimization Correct answer.
  3. Right to erasure
  4. Data retention

Explanation

Data minimization requires collecting only the personal data that is necessary for the stated purpose. Purpose limitation restricts later use of collected data to that purpose, retention governs how long data is kept, and the right to erasure lets individuals request deletion.

Question 26Security Principles and Risk Management

A botnet floods an online retailer's web server with traffic, and legitimate customers can no longer reach the site. Which element of the CIA triad is most directly affected?

  1. Non-repudiation
  2. Confidentiality
  3. Integrity
  4. Availability Correct answer.

Explanation

Availability ensures that systems and data are accessible to authorized users when needed, and a traffic flood denies that access. Confidentiality concerns disclosure, and integrity concerns unauthorized modification.

Question 27Security Principles and Risk Management

In risk management terminology, which statement defines a vulnerability?

  1. A weakness in a system or process that a threat could exploit Correct answer.
  2. The monetary loss expected from a single incident
  3. Any circumstance or event that could cause harm to an organization
  4. The probability that a threat event occurs within a given year

Explanation

A vulnerability is an internal weakness or flaw that a threat source can act upon. Threats are external or potential causes of harm, while loss and probability are risk measurement terms.

Question 28Security Principles and Risk Management

Which of the following is a physical security control?

  1. A firewall rule that blocks inbound Telnet
  2. A password complexity rule in the directory service
  3. A quarterly access review performed by managers
  4. A locked turnstile at the building lobby Correct answer.

Explanation

Physical controls act on the physical environment to restrict or monitor human access to facilities and equipment. Firewall rules and password rules are technical controls, and access reviews are administrative.

Question 29Security Principles and Risk Management

Which process determines what an authenticated user is allowed to do within a system?

  1. Accounting
  2. Identification
  3. Authentication
  4. Authorization Correct answer.

Explanation

Authorization maps a verified identity to permitted actions or resources. Identification and authentication establish who the user is, and accounting records what was done.

Question 30Security Principles and Risk Management

What is the primary purpose of the least privilege principle?

  1. To grant users only the access required for their assigned duties Correct answer.
  2. To ensure users can complete any task assigned to them at any time
  3. To record every action performed by privileged accounts
  4. To require two approvers for every administrative change

Explanation

Least privilege limits each account to the minimum rights needed for its job, which shrinks the damage a compromised or misused account can cause. Broader rights, logging, and dual approval are separate controls.

Question 31Security Principles and Risk Management

A security analyst reviews firewall logs every morning to spot unusual outbound connections. This activity is best described as which type of control?

  1. Deterrent
  2. Preventive
  3. Corrective
  4. Detective Correct answer.

Explanation

Detective controls identify and report events after or while they occur, and log review fits that role. Preventive controls stop events, corrective controls restore systems, and deterrent controls discourage attackers.

Question 32Security Principles and Risk Management

An organization is retiring disk drives that stored confidential records. Which practice best preserves confidentiality of that data?

  1. Destroying or overwriting the drives per a sanitization standard Correct answer.
  2. Deleting the files and emptying the recycle bin
  3. Reformatting each drive with the operating system utility
  4. Moving the drives to a room that requires badge access

Explanation

Confidentiality of retired media is protected through sanitization such as overwriting, degaussing, or physical destruction, which removes or renders unreadable the residual data. Deletion and reformatting leave recoverable remnants.

Question 33Security Principles and Risk Management

Which backup method copies only the data that has changed since the most recent backup of any type?

  1. Incremental Correct answer.
  2. Mirror
  3. Differential
  4. Full

Explanation

An incremental backup captures changes since the last backup of any kind, keeping each run small but requiring the full chain to restore. A differential captures changes since the last full backup.

Question 34Security Principles and Risk Management

An organization purchases a cyber insurance policy to cover financial losses from ransomware. Which risk treatment option does this represent?

  1. Risk acceptance
  2. Risk mitigation
  3. Risk transference Correct answer.
  4. Risk avoidance

Explanation

Transference shifts the financial consequences of a risk to another party, such as an insurer, while the underlying risk remains. Avoidance eliminates the activity, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 35Security Principles and Risk Management

Which statement best describes qualitative risk analysis?

  1. It expresses risk in monetary terms using asset value and exposure factor
  2. It models outcomes by simulating variable inputs thousands of times
  3. It ranks risk using descriptive scales based on judgment and experience Correct answer.
  4. It derives annualized loss expectancy from historical frequency data

Explanation

Qualitative analysis uses descriptive ratings such as high, medium, and low, informed by expert judgment, and is useful when reliable numeric data is unavailable. Monetary calculations and simulation are quantitative techniques.

Question 36Security Principles and Risk Management

Why does an organization require staff to rotate periodically through different job assignments?

  1. To satisfy the availability requirements defined in the disaster recovery plan
  2. To reduce the cost of cross-training new employees across several teams
  3. To detect fraud by preventing sustained control of one process Correct answer.
  4. To remove the need for background checks on staff

Explanation

Job rotation is a detective administrative control that keeps one person from controlling a process long enough to conceal abuse and gives others a chance to notice irregularities. It is not a substitute for personnel screening or recovery planning.

Question 37Security Principles and Risk Management

Who is accountable for determining the classification and protection requirements of a data set?

  1. The data custodian who runs the backup systems
  2. The data owner accountable for the information asset Correct answer.
  3. The data subject whose records are stored
  4. The system administrator who configures access

Explanation

The data owner, typically a business manager, is accountable for classifying the information and defining who may use it. Custodians and administrators implement those decisions technically.

Question 38Security Principles and Risk Management

A privacy principle states that personal data must not be kept longer than necessary for the stated purpose. Which term names this principle?

  1. Storage limitation Correct answer.
  2. Purpose limitation
  3. Accuracy
  4. Data minimization

Explanation

Storage limitation restricts how long personal data may be retained. Data minimization limits the amount collected, purpose limitation restricts use to stated purposes, and accuracy requires correct and current records.

Question 39Security Principles and Risk Management

What is the primary output of a business impact analysis?

  1. A network diagram showing data flows between internal systems
  2. A ranked list of technical vulnerabilities with CVSS scores
  3. An inventory of security controls mapped to a chosen framework
  4. An identification of critical business functions and their recovery needs Correct answer.

Explanation

A business impact analysis identifies the functions whose loss would most harm the organization and establishes their recovery priorities and requirements. Vulnerability rankings, diagrams, and control mappings come from other activities.

Question 40Security Principles and Risk Management

A legacy application cannot enforce multifactor authentication, so the team places it behind a VPN that requires multifactor authentication for access. This is an example of which control category?

  1. A corrective control
  2. A directive control
  3. A compensating control Correct answer.
  4. A deterrent control

Explanation

A compensating control provides an alternative safeguard when the preferred or required control cannot be implemented in a system. It substitutes for the missing control rather than repairing, discouraging, or directing behavior.

Question 41Security Principles and Risk Management

Which framework is mandatory for organizations that store, process, or transmit payment card data?

  1. ISO/IEC 27001
  2. COBIT
  3. NIST Cybersecurity Framework
  4. PCI DSS Correct answer.

Explanation

PCI DSS is contractually required by the payment card brands for any entity handling cardholder data. ISO/IEC 27001, the NIST Cybersecurity Framework, and COBIT are voluntary or governance frameworks.

Question 42Security Principles and Risk Management

In STRIDE threat modeling, an attacker impersonating a legitimate user to gain access is classified as which threat category?

  1. Tampering
  2. Spoofing Correct answer.
  3. Elevation of privilege
  4. Repudiation

Explanation

Spoofing is pretending to be another user, system, or component. Tampering alters data, repudiation concerns denying actions, and elevation of privilege gains rights beyond those granted.

Question 43Security Principles and Risk Management

Which statement best distinguishes a vulnerability scan from a penetration test?

  1. A scan identifies potential weaknesses, while a test attempts to exploit them under control Correct answer.
  2. A scan is performed manually, while a test is always fully automated
  3. A scan requires written authorization, while a test does not
  4. A scan attempts to exploit weaknesses, while a test only enumerates them

Explanation

Scanning enumerates potential weaknesses for later triage, whereas penetration testing attempts controlled exploitation to prove real impact. Both require authorization and careful scoping.

Question 44Security Principles and Risk Management

Which access control model grants permissions based on attributes such as department, location, and time of day?

  1. Mandatory access control
  2. Discretionary access control
  3. Role-based access control
  4. Attribute-based access control Correct answer.

Explanation

Attribute-based access control evaluates multiple attributes of the subject, resource, and environment in its policy decisions. Role-based control relies on job roles, discretionary control on owner decisions, and mandatory control on sensitivity labels.

Question 45Security Principles and Risk Management

A customer asks a company to delete the personal data it holds about them. Under common privacy frameworks, this right is called which of the following?

  1. The right to data portability
  2. The right of access
  3. The right to rectification
  4. The right to erasure Correct answer.

Explanation

The right to erasure, sometimes called the right to be forgotten, allows individuals to request deletion of their personal data in defined circumstances. Access, rectification, and portability cover viewing, correcting, and moving data.

Question 46Security Principles and Risk Management

An analyst draws asset value, exposure factor, and threat frequency from probability distributions and repeats the calculation thousands of times to obtain a range of annual loss outcomes. Which technique is being used?

  1. Qualitative scenario ranking
  2. Fault tree analysis
  3. Delphi estimation
  4. Monte Carlo simulation Correct answer.

Explanation

Monte Carlo simulation performs repeated random sampling from input distributions to produce a distribution of possible outcomes rather than a single point estimate. Delphi and scenario ranking rely on expert judgment, and fault trees model causal paths to failure.

Question 47Security Principles and Risk Management

Two business units rate the same risk very differently because each weighs most heavily the incidents its staff have personally experienced. Which cognitive bias best explains the divergence?

  1. Availability bias Correct answer.
  2. Confirmation bias
  3. Anchoring
  4. Optimism bias

Explanation

Availability bias causes people to overestimate the likelihood of events that are recent, vivid, or easily recalled. Anchoring relies on an initial reference value, confirmation bias favors supporting evidence, and optimism bias understates adverse outcomes.

Question 48Security Principles and Risk Management

An organization in the EU must send personal data to a processor located in a country with no adequacy decision. Which mechanism most commonly legitimizes that transfer?

  1. An adequacy decision covering the destination country
  2. A consent form signed by the processor's works council
  3. Standard contractual clauses signed by exporter and importer Correct answer.
  4. Adequacy of the processor's internal network segmentation

Explanation

Where no adequacy decision exists, standard contractual clauses between exporter and importer provide an approved transfer safeguard. Network segmentation and works council consent are not transfer mechanisms, and the premise excludes adequacy.

Question 49Security Principles and Risk Management

An organization needs assurance about the operating effectiveness of a service provider's controls over a defined period. Which report provides an opinion on that?

  1. A SOC 2 Type 2 report Correct answer.
  2. A SOC 3 general use report
  3. A SOC 2 Type 1 report
  4. A SOC 1 Type 1 report

Explanation

A Type 2 report covers the suitability of control design and the operating effectiveness of those controls across a period of time. Type 1 reports address design at a single point in time.

Question 50Security Principles and Risk Management

In the Lockheed Martin kill chain, which phase involves pairing an exploit with a deliverable payload?

  1. Delivery
  2. Exploitation
  3. Installation
  4. Weaponization Correct answer.

Explanation

Weaponization couples a remote exploit with a malicious payload into a deliverable artifact. Delivery transmits that artifact, exploitation triggers the vulnerability, and installation establishes persistence on the target.