Pass the ISC certification CC Questions and answers with Dumpstech

Infrastructure as a Service (IaaS) provides security teams with the greatest access to forensic data because customers retain control over operating systems, logs, storage, and network configurations.

In SaaS and FaaS models, the provider controls most of the infrastructure, limiting visibility. PaaS provides partial access but still restricts OS-level forensics.

IaaS allows collection of disk images, memory dumps, system logs, and network traffic, which are essential for incident response and forensic investigations.

Security teams prefer IaaS for high-control environments where deep visibility is required.

Mandatory Access Control (MAC) usesdata classification (sensitivity)anduser clearances, which are often tied to job roles. Access decisions are centrally enforced and cannot be changed by users or data owners.

Logical access controls enforce security through software-based mechanisms such as access control lists, authentication systems, and configuration settings.

An accurate asset inventory is foundational to security. Without knowing what assets exist, organizations cannot secure, monitor, or protect them effectively.

Log retention policies are primarily driven by laws, regulations, and governance requirements. Audits review compliance but do not typically define retention durations themselves.

Anexecutive summarygives leadership a concise overview of objectives, scope, and recovery strategies without technical detail.

In Software as a Service (SaaS), the provider manages nearly all infrastructure, platforms, and applications, leaving customers responsible mainly for data and access.

Limiting administrative privileges enforces theprinciple of least privilege, reducing ransomware’s ability to spread or encrypt critical systems. Many ransomware attacks rely on elevated privileges to maximize damage.

ABusiness Continuity Plan (BCP)ensures critical business functions continue or are restored during and after disruptions.

A Business Continuity Plan is enacted when an organization experiences aloss or disruption of critical business operations. The goal of BCP is to ensure that essential business functions continue or are quickly restored, regardless of the cause of the disruption.

While events, incidents, or natural disasters may trigger disruptions, BCP activation is based onimpact to operations, not the type of event itself. BCP focuses on people, processes, facilities, and third parties—not just IT systems.