A company has a high rate of employees writing down passwords on sticky notes. The security team wants to reduce this behavior. Which control would be most effective?

Implement a firewall to block access to password-cracking tools

Increase password complexity requirements

Implement a password manager and provide training on its use

A bank processes wire transfers. A customer claims they never authorized a transfer, but the bank's system shows the transfer was initiated with the customer's valid credentials and a one-time passcode. The bank needs to prove to a regulator that the customer did authorize the transaction. Which security mechanism would best provide this proof?

Real-time fraud monitoring alerts

Digital signature on the transaction record

Regular backup of transaction logs

Strong password policy for customer accounts

EC-CouncilCertified Security Specialist

Domain 3Objective 1

Information Security Fundamentals ECSS Practice Questions (Page 1)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

50questions here

10free pages

10concepts

10 Concepts in This Objective

Confidentiality, Integrity, and Availability (CIA) Triad
Authentication, Authorization, and Accounting (AAA)
Non-repudiation
Information Security Threats and Vulnerabilities
Risk Management Fundamentals
Security Controls (Preventive, Detective, Corrective)
Security Policies, Standards, and Procedures
Data Classification and Handling
Security Awareness and Training
Incident Response Fundamentals

Questions 1–5

1application · medium
A company has a high rate of employees writing down passwords on sticky notes. The security team wants to reduce this behavior. Which control would be most effective?
Select an answer first
2foundation · easy
An intrusion detection system (IDS) that alerts administrators when suspicious network activity occurs is an example of which type of security control?
Select an answer first
3foundation · easy
An organization decides to accept the risk of a low-impact, low-probability security incident rather than spend money on additional controls. This decision is an example of:
Select an answer first
4foundation · easy
A security guard checks employee badges at the entrance to a data center. This control is best classified as:
Select an answer first
5application · medium
A bank processes wire transfers. A customer claims they never authorized a transfer, but the bank's system shows the transfer was initiated with the customer's valid credentials and a one-time passcode. The bank needs to prove to a regulator that the customer did authorize the transaction. Which security mechanism would best provide this proof?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Information Security Fundamentals ECSS Practice Questions (Page 1)

Questions 1–5

A company has a high rate of employees writing down passwords on sticky notes. The security team wants to reduce this behavior. Which control would be most effective?

An intrusion detection system (IDS) that alerts administrators when suspicious network activity occurs is an example of which type of security control?

An organization decides to accept the risk of a low-impact, low-probability security incident rather than spend money on additional controls. This decision is an example of:

A security guard checks employee badges at the entrance to a data center. This control is best classified as:

Keep studying — Ethical Hacking Fundamentals and Core Attacks