Pass the ISC certification CC Questions and answers with Dumpstech

Logical (technical) controls such as encryption, access controls, DLP, and firewalls directly prevent unauthorized data access and exfiltration.

DDoS attacks can target bothLayer 3 (Network)andLayer 4 (Transport)by overwhelming IP routing, ICMP traffic, TCP SYN floods, or UDP floods. Hence, both layers are impacted.

Privacy focuses on individual rights over personal information, distinct from confidentiality which focuses on access control.

Cloud computing is defined by five essential characteristics per NIST: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Therefore, all listed options are valid characteristics.

A Business Impact Analysis (BIA) identifies critical systems, dependencies, and acceptable downtime. It is foundational to both BCP and DRP development.

The feasibility study determines whether a project is technically, economically, and operationally viable before development begins.

Mandatory Access Control (MAC) enforces centrally managed security labels and clearances, making it suitable for classified and government systems.

Black box penetration testing requires the most effort because the testing team hasno prior knowledgeof the target system. Testers must perform reconnaissance, discovery, enumeration, vulnerability identification, and exploitation without any internal documentation or credentials.

In contrast, white box testing provides full knowledge of systems, source code, and configurations, significantly reducing discovery effort. Gray box testing provides partial information, offering a balance between realism and efficiency. “Blue box” is not a standard penetration testing category.

Black box testing closely simulates real-world external attackers, making it valuable for assessing perimeter defenses, but it is time-consuming and resource-intensive. Testers must identify attack surfaces from scratch and may miss internal vulnerabilities due to lack of access.

Security frameworks recognize black box testing as the most labor-intensive but also the most realistic external threat simulation.

A session key is a temporary cryptographic key used to encrypt communication between two systems for a single session. Session keys are typically symmetric keys generated during secure key exchange processes such as TLS handshakes.

They provide confidentiality and efficiency because symmetric encryption is much faster than asymmetric encryption. Once the session ends, the key is discarded, limiting exposure even if the key is later compromised.

Public keys are used for key exchange and authentication, not bulk data encryption. “Temporary key” and “section key” are not standard cryptographic terms.

Session keys are fundamental to secure network communications and are recommended by all modern cryptographic standards due to their performance and security benefits.

Hashing ensuresintegrityby allowing detection of unauthorized changes to data.