Domain 1: Security Principles

Information assurance concepts, risk management, security controls, ethics, and governance processes.

5 minutes 5 Questions

Domain 1: Security Principles forms the foundational cornerstone of the ISC2 Certified in Cybersecurity (CC) certification. This domain covers the essential concepts that every cybersecurity professional must understand. At its core, this domain introduces the CIA Triad — Confidentiality, Integrit…

Concepts covered
Technical Security ControlsPrivacy Concepts in Information AssuranceRisk Treatment and Response StrategiesPhysical Security ControlsISC2 Code of Ethics and Professional ConductSecurity Policies and ProceduresConfidentiality, Integrity, and Availability (CIA Triad)Authentication Methods and Multi-Factor AuthenticationNon-RepudiationRisk Identification and AssessmentRisk Priorities and Risk ToleranceAdministrative Security ControlsRegulations and LawsSecurity Standards and FrameworksPhysical Access Control FundamentalsAuthorized vs Unauthorized PersonnelSecurity Monitoring (CCTV, Alarms, Logs)Badge Systems and Gate Entry ControlsEnvironmental Design for Physical SecuritySecurity Guards and Access LogsAuthentication, Authorization, and Accounting (AAA)Due Care and Due Diligence
Test mode:
Start practice test

CC - Domain 1: Security Principles Example Questions

Test your knowledge of Domain 1: Security Principles

Question 1

A new employee at a company asks their supervisor where to find the rules about using company computers for personal tasks. The supervisor tells them to check a specific document. Which type of document would most likely contain these rules?

Correct Answer: An Acceptable Use Policy that defines permitted and prohibited activities on company systems

An Acceptable Use Policy (AUP) is specifically designed to define what employees can and cannot do with company technology resources, including whether personal use is permitted.

A Business Continuity Plan focuses on maintaining operations during disruptions, not regulating daily computer usage. An Incident Response Procedure outlines steps to follow when a security event occurs, not everyday acceptable behavior. A Change Management Policy governs how changes to systems and processes are requested, approved, and implemented, not personal use of equipment.

The key concept tested is understanding the purpose of an Acceptable Use Policy as the governance document that establishes rules for appropriate use of organizational assets.

Question 2

Which component functions as a technical security control used to manage network communications?

Correct Answer: An automated perimeter firewall moderating digital packet exchange via predefined logical rule configurations.

A firewall is a technical control because it utilizes dedicated hardware and software configurations to actively enforce security policies and automatically manage network traffic.
An administrative governance policy and a compliance framework are administrative controls that rely on written rules and manual directives rather than technological enforcement. A mechanical interlock scheme is a physical control designed to secure tangible assets and restrict human facility access.
The core concept tested here is the ability to specifically distinguish between technical, administrative, and physical security controls.

Question 3

In physical security, what does the term 'tailgating' refer to?

Correct Answer: An unauthorized person following an authorized person through a secured entry point

Tailgating refers to an unauthorized person closely following an authorized person through a secured entry point without presenting their own credentials, essentially slipping in behind them before the door closes.

Using a stolen badge to gain entry is credential theft, not tailgating, since the person is independently authenticating. An authorized person voluntarily holding the door open for someone describes piggybacking, which is a related but distinct concept where there is awareness and consent from the authorized individual. Bypassing a biometric scanner with forged credentials is spoofing or credential forgery, not tailgating.

The key concept tested is understanding tailgating as a physical access control bypass through social engineering.

More Domain 1: Security Principles questions
921 questions (total)
Practice 100 questions
One session at a time, always new questions