CC Practice Questions

The current industry best practice for authentication is Multi-Factor Authentication (MFA). MFA strengthens access control by requiring a user to present two or more independent pieces of evidence (called factors) to an authentication mechanism. This layered defense makes it significantly more difficult for an unauthorized person to gain access. The factors are categorized as something you know (e.g., password, PIN), something you have (e.g., security token, smartphone app), and something you are (e.g., fingerprint, facial scan). Option D correctly encapsulates this principle by recommending the use of "two or more authentication methods" and providing valid examples.

A. A username is an identifier, not an authentication factor. This option describes single-factor authentication (password only), which is not a best practice.

B. This option incorrectly classifies a username as an authentication method. While it describes two-factor authentication, option D is a more accurate and general statement of the best practice.

C. Using only one method, known as single-factor authentication, is considered a weak security posture and is vulnerable to common attacks like password guessing or phishing.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63B: Digital Identity Guidelines: Authentication and Lifecycle Management.

Section 5.1.1

"MFA": "When MFA is used for authentication

the verifier SHALL require at least two independent authentication factors... Using multiple authenticators that are all of the same factor (e.g.

a password and a PIN

both of which are something you know) is not MFA." This directly supports the principle of using two or more distinct factors as a best practice.

2. Stanford University IT. (n.d.). Two-Step Authentication.

Overview Section: "Two-step authentication adds a second layer of security to your online accounts. Verifying your identity using a second factor (like your phone or other mobile device) prevents anyone but you from logging in

even if they know your password." This resource from a reputable university endorses the use of a second factor as a critical security practice.

3. OWASP Foundation. (n.d.). Authentication Cheat Sheet.

Section "Multi-Factor Authentication": "Multi-factor authentication (MFA) should be implemented on all internet-facing applications that handle sensitive data... MFA is a method of confirming a user's claimed identity in which a user is granted access only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism." This reinforces MFA as a standard for securing applications.

The primary benefit of using real-life examples and scenarios in security awareness training is to enhance learning and retention. Abstract security policies can be difficult for employees to apply to their daily tasks. By presenting relatable situations, such as a realistic phishing email or a social engineering phone call, the training becomes more engaging. This approach helps employees connect theoretical knowledge to practical, real-world threats, thereby improving their ability to recognize and respond to security incidents appropriately. It transforms passive learning into an active understanding of the implications of their actions on organizational security.

A. The goal of security training is to improve the security posture, not reduce it.

B. Training should highlight that security threats are a significant and relevant concern, not dismiss them.

C. This describes a security failure, which is the exact outcome that awareness training aims to prevent.

1. National Institute of Standards and Technology (NIST). (2003). Special Publication 800-50: Building an Information Technology Security Awareness and Training Program. Section 5.2

"Implementation

" states

"Using examples of previous incidents at the organization or at other organizations can be an effective way to emphasize the importance of security." This supports using real-world scenarios to demonstrate practical implications.

2. Tsohou

A.

& Karyda

M. (2015). The role of storytelling in information security awareness. Information & Computer Security

23(5)

549-567. This academic paper argues that storytelling and scenarios make security messages more engaging

memorable

and persuasive

which directly supports the idea that they help employees better understand practical implications. (https://doi.org/10.1108/ICS-04-2015-0016)

3. SANS Institute. (2022). 2022 SANS Security Awareness Report: Managing Human Risk. Page 11 discusses the importance of making training "personal and engaging" to effectively change behavior

which is achieved through relatable content like real-life scenarios.

Security Awareness Training is a security control, not a foundational security principle. It is an administrative control implemented to educate employees about security threats and organizational policies. While essential for a robust security posture, it is a practical measure or activity, unlike principles which are fundamental tenets or rules that guide the design and implementation of security systems. Principles like Least Privilege and Separation of Duties are core concepts that form the basis of security architecture.

A. Least Privilege: This is a fundamental security principle stating that a user or entity should only have the minimum access rights and permissions necessary to perform their required tasks.

B. Zero Trust model: While a modern model or architecture, Zero Trust is a strategic approach built upon a collection of guiding principles, chief among them being "never trust, always verify." It functions as a set of overarching principles for system design.

D. Separation of Duties: This is a classic security principle designed to prevent fraud and error by ensuring that no single individual has control over all aspects of a critical transaction or process.

1. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

38-41. In this foundational paper

"Principle of least privilege" and "Separation of privilege" (a concept directly related to Separation of Duties) are explicitly defined as core design principles for secure systems (Section I.A.3

"Design Principles").

2. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Rev. 5). U.S. Department of Commerce. In this standard

"Awareness and Training" is defined as a family of security controls (AT family)

not a principle. For example

control AT-2 is "Literacy Training and Awareness."

3. National Institute of Standards and Technology (NIST). (2020). Zero Trust Architecture (NIST Special Publication 800-207). U.S. Department of Commerce. This document describes Zero Trust as a "model

" "architecture

" and a set of "concepts and ideas" (Abstract

Section 1.1). It is fundamentally a collection of tenets or principles that guide a security strategy.

The attack described is a form of social engineering known as phishing. The attacker sends a fraudulent email that appears to be from a trusted source to deceive the recipient. The goal is to trick the user into revealing sensitive information (e.g., credentials, financial details) or executing malicious code by clicking a link or opening an attachment. Spear phishing is a highly targeted version of this attack, often customized for a specific individual, organization, or group to increase its perceived legitimacy and success rate. Among the options provided, this is the most accurate description of the attack.

A. Distributed Denial-of-Service Attack: This attack focuses on overwhelming a target system with traffic to make it unavailable, not on deceiving users via email for information theft.

B. Man-in-the-Middle Attack: This involves an attacker secretly intercepting and relaying communications between two parties, rather than sending a deceptive email directly to a victim.

C. Cross-Site Scripting Attack: This is a web application vulnerability where malicious scripts are injected into trusted websites; it is not an email-based social engineering attack.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. Appendix A

A.2 Definitions. "Phishing: A technique for attempting to acquire sensitive information... through a fraudulent solicitation in email or on a web site

in which the perpetrator masquerades as a legitimate business or reputable person."

2. National Institute of Standards and Technology (NIST). (2015). Special Publication 800-82 Rev. 2: Guide to Industrial Control Systems (ICS) Security. Section 3.3.3

Social Engineering. "Phishing is a form of social engineering that uses email or malicious websites... to solicit personal information... by posing as a trustworthy organization or entity. A spear phishing attack is a targeted phishing attack..."

3. Warner

J. (2012). Understanding phishing and its impact on organizations. SANS Institute InfoSec Reading Room. Page 4. "Spear phishing is a targeted attack against a specific company

organization

or even an individual."

4. Hale

C.

& Heartfield

R. (2020). A Thematic Analysis of Human Elicitation Techniques in Social Engineering. In Proceedings of the 15th International Conference on Availability

Reliability and Security (ARES '20). Association for Computing Machinery

New York

NY

USA

Article 58

1–10. https://doi.org/10.1145/3407023.3407081 (The paper discusses phishing and spear phishing as primary social engineering techniques used for information elicitation).

A detection control is a type of security control designed to discover and alert on security events or incidents either as they occur or after they have occurred. A smoke sensor perfectly fits this definition; it does not prevent a fire but detects the presence of smoke (an indicator of fire) and triggers an alarm to initiate a response. Its primary function is to identify that an undesirable event is happening.

B. Turnstiles are a preventive physical control designed to stop unauthorized individuals from entering a secure area before access is granted.

C. Firewalls are a preventive technical control that enforces a security policy by blocking unauthorized network traffic, thus preventing potential intrusions.

D. Bollards are a preventive physical control used to block vehicle access, thereby stopping a potential ramming attack or unauthorized entry before it happens.

1. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Detective Control. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/detectivecontrol. The definition states

"A security control that is used to discover events that have occurred."

2. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Preventive Control. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/preventivecontrol. The definition states

"A security control that is used to stop events from occurring." This applies to firewalls

turnstiles

and bollards.

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 8

Section 8.3

"Types of Controls

" discusses how controls can be physical

procedural

or technical and are classified by their function (e.g.

preventive

detective

corrective). Detective controls

such as sensors and alarms

are noted for their role in reporting that an undesirable event has occurred.

Authentication is the process of verifying a claimed identity. When a user provides a user ID, they are making a claim about who they are. The password serves as a secret piece of information (a knowledge factor) to prove that claim. The system then compares these credentials against its stored records to confirm the user's identity. This verification process is the fundamental definition of authentication within the Identity and Access Management (IAM) framework.

A. Validation is a generic term for checking data correctness; it is not the specific security function for verifying a user's identity.

B. Authorization is the process of granting permissions to resources, which occurs after a user has been successfully authenticated.

C. Login is a user-facing term for the overall process of gaining access, but the specific technical function being performed is authentication.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. Section 1.2

"Introduction to Digital Identity". The document states

"Authentication is the process of verifying a claimant’s identity."

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

377–408. Section I.A.2

"Authentication". This foundational paper defines authentication as the mechanism for "associating a unique system-identifier with that principal." The use of a password is a primary example. (DOI: https://doi.org/10.1145/361011.361062)

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2014). 6.857 Computer and Network Security

Lecture 2: Control of Information. The lecture notes clearly distinguish authentication ("Who are you?") from authorization ("What are you allowed to do?").

The widely accepted framework for security learning programs consists of three distinct activities: Awareness, Training, and Education (ATE). Awareness focuses on making individuals conscious of security concerns ("what" and "why"). Training is skill-based, teaching individuals "how" to perform specific tasks securely. Education provides in-depth, foundational knowledge and understanding. A "tutorial" is a specific method or format of instruction (e.g., a video tutorial) that can be used within a training or education activity, but it is not considered a primary, distinct type of learning activity within the established ATE model.

A. Education: This is a core component of the ATE model, providing in-depth knowledge and understanding of security principles.

B. Awareness: This is the foundational level of the ATE model, intended to change behavior by raising consciousness about security risks.

D. Training: This is a fundamental component of the ATE model, focused on building specific skills and competencies required for a job role.

1. National Institute of Standards and Technology (NIST) Special Publication 800-50

Building an Information Technology Security Awareness and Training Program. Section 2.2

"The Building Blocks: Awareness

Training

and Education

" explicitly defines these three components as the distinct pillars of a security learning program. It states

"IT security awareness

training

and education are not the same... Awareness is not training; training is not education; and education is not awareness." The document does not list "tutorial" as a primary category.

2. (ISC)² Certified in Cybersecurity (CC) Certification Exam Outline (Effective August 1

2022). Domain 1: Security Principles

Objective 1.4 is "Understand security awareness

training

and education." This shows that the certifying body itself defines the program around these three specific components.

3. Wilson

M.

& Hash

J. (2003). Building an Information Technology Security Awareness and Training Program (NIST Special Publication 800-50). National Institute of Standards and Technology. Page 4

Section 2.2. Available at: https://csrc.nist.gov/publications/detail/sp/800-50/final

The scenario describes a mechanism for enforcing an Acceptable Use Policy (AUP). An AUP is a formal document that defines the rules and constraints users must agree to for access to a corporate system or network. It explicitly outlines what constitutes acceptable and unacceptable behavior. Requiring employees to click an "Accept Terms" button before using an application is a standard method to obtain and document their acknowledgment and agreement to abide by the organization's AUP. This action creates a clear understanding of the rules of behavior for using the company's digital assets.

B. Service Level Agreement (SLA): An SLA is a contract that defines service performance metrics (e.g., uptime, availability) between a provider and a customer, not rules for user conduct.

C. Non-Disclosure Agreement (NDA): An NDA is a legal contract focused specifically on protecting confidential information from being shared, not the general rules for using a system or application.

D. Memorandum of Understanding (MOU): An MOU is a non-binding agreement, typically between organizations, to outline a common line of action, not an individual employee's agreement to usage policies.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control PL-4 (Rules of Behavior) states that organizations must establish and make available the rules describing responsibilities and expected behavior for system usage. The discussion section explicitly notes

"The rules of behavior can be implemented as an acceptable use policy..."

2. National Institute of Standards and Technology (NIST) Special Publication 800-12

Revision 1

An Introduction to Information Security. Section 4.2.1

"Policy

" discusses the hierarchy of policies

with issue-specific policies like an AUP stemming from a broader program policy to govern the use of IT assets.

3. Carnegie Mellon University

Information Security Office

Guidelines for Appropriate Use of Computing and Network Resources. This document exemplifies an AUP

stating its purpose is to "outline the acceptable use of computer equipment... and establish a culture of openness

trust

and integrity." This aligns directly with the scenario's intent.

Procedures are the formal documentation of the specific, detailed steps required to perform a task or a series of tasks. They are operational in nature and are created to implement the intent of high-level policies and meet the requirements of standards. By providing a step-by-step guide, procedures ensure that tasks are performed consistently and in compliance with organizational directives. This directly addresses the question's focus on "detailed steps to complete tasks" that support policies.

A. Standards: Standards specify mandatory requirements for systems or processes, not the step-by-step instructions for implementing them.

B. Policies: Policies are high-level statements of management's intent and goals, lacking the detailed steps for specific tasks.

D. Regulations: Regulations are external rules or laws imposed by a governing body, not internal organizational documents detailing task steps.

1. National Institute of Standards and Technology (NIST). (2017). An Introduction to Information Security (NIST Special Publication 800-12 Rev. 1). U.S. Department of Commerce.

Page 16

Section 3.2.3

"Procedures": "Procedures are the detailed

step-by-step instructions on how to perform a given activity. Procedures are derived from the parent policy and standards that direct their creation." This source explicitly defines procedures as containing "detailed

step-by-step instructions."

2. National Institute of Standards and Technology (NIST). (2020). Glossary of Key Information Security Terms (NISTIR 7298 Rev. 3). U.S. Department of Commerce.

Page 151: Defines "Procedure" as "A set of detailed instructions for performing a given task." This directly supports the correct answer.

3. Swanson

M.

& Guttman

M. (1996). Generally Accepted Principles and Practices for Securing Information Technology Systems (NIST Special Publication 800-14). U.S. Department of Commerce.

Page 13

Section 4.2.3

"Procedures": "Procedures detail the steps of how to implement policies

standards

and guidelines... Procedures are low-level

step-by-step implementation guides." This reference clearly distinguishes procedures as the "how-to" documents that implement higher-level policies.

The (ISC)² Code of Ethics consists of four mandatory canons that all members must adhere to. Option D, "Provide diligent and competent service to principals," is a verbatim match for the third canon of this code. The other options are either incomplete or altered versions of the remaining canons. The four official canons are:

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.

2. Act honorably, honestly, justly, responsibly, and legally.

3. Provide diligent and competent service to principals.

4. Advance and protect the profession.

A. This is an incomplete version of the first canon; it omits the phrase "necessary public trust and confidence."

B. This incorrectly uses the word "promote" instead of "protect," which is the term used in the fourth canon.

C. This incorrectly includes the word "safely" and omits "justly, responsibly" from the second canon.

1. (ISC)². (n.d.). Code of Ethics. Retrieved from https://www.isc2.org/Ethics. The four canons are listed in the "Code of Ethics Canons" section.

2. Carnegie Mellon University

Software Engineering Institute. (2017). The CERT® Guide to Coordinated Vulnerability Disclosure (CMU/SEI-2017-SR-022). p. 51. The document references the (ISC)² Code of Ethics

stating

"For example

the (ISC)² code of ethics includes the tenets 'Protect society...' and 'Provide diligent and competent service to principals.'" This confirms the wording of the canons.