A company has experienced multiple phishing incidents where employees clicked on malicious links. The security team wants to reduce the likelihood of these incidents. Which control would be most effective in addressing the root cause?

Implement a spam filter on the email gateway

Deploy an intrusion prevention system (IPS)

Conduct regular security awareness training and simulated phishing exercises

Increase the frequency of data backups

A company's finance application requires users to log in with a username and password, then restricts access so that only accounts-payable staff can approve invoices. The system also records every approval action with the user's identity and timestamp. Which combination of AAA components is being implemented?

Identification (login), Non-repudiation (approval), Accounting (user roles)

Authentication (invoice approval), Authorization (login), Accounting (password storage)

Authentication (login), Authorization (invoice approval rights), Accounting (audit log of approvals)

Confidentiality (login), Integrity (approval), Availability (audit log)

A company has a high rate of employees plugging in unknown USB drives, leading to malware infections. The security team wants to reduce this behavior. They are considering a mandatory training program, a technical control that disables USB ports, and a policy prohibiting personal USB drives. Which approach is most effective as a primary control?

Post warning signs near workstations

Conduct a one-time security awareness training session

Publish a policy prohibiting personal USB drives

Disable USB ports via group policy on all company workstations

A document is classified as 'Confidential' in an organization's data classification scheme. Which of the following handling requirements is most likely to apply?

Data must be destroyed immediately after use

Data can be shared freely within the organization

Access limited to authorized personnel with a need-to-know

No restrictions on distribution

EC-CouncilCertified Security Specialist

Domain 3Objective 1

Information Security Fundamentals ECSS Practice Questions (Page 2)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

50questions here

10free pages

10concepts

10 Concepts in This Objective

Confidentiality, Integrity, and Availability (CIA) Triad
Authentication, Authorization, and Accounting (AAA)
Non-repudiation
Information Security Threats and Vulnerabilities
Risk Management Fundamentals
Security Controls (Preventive, Detective, Corrective)
Security Policies, Standards, and Procedures
Data Classification and Handling
Security Awareness and Training
Incident Response Fundamentals

Questions 6–10

6application · medium
A company has experienced multiple phishing incidents where employees clicked on malicious links. The security team wants to reduce the likelihood of these incidents. Which control would be most effective in addressing the root cause?
Select an answer first
7application · medium
A company's finance application requires users to log in with a username and password, then restricts access so that only accounts-payable staff can approve invoices. The system also records every approval action with the user's identity and timestamp. Which combination of AAA components is being implemented?
Select an answer first
8expert · hard
A company has a high rate of employees plugging in unknown USB drives, leading to malware infections. The security team wants to reduce this behavior. They are considering a mandatory training program, a technical control that disables USB ports, and a policy prohibiting personal USB drives. Which approach is most effective as a primary control?
Select an answer first
9foundation · easy
Which of the following is an example of a common information security threat?
Select an answer first
10foundation · easy
A document is classified as 'Confidential' in an organization's data classification scheme. Which of the following handling requirements is most likely to apply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Information Security Fundamentals ECSS Practice Questions (Page 2)

Questions 6–10

A company has experienced multiple phishing incidents where employees clicked on malicious links. The security team wants to reduce the likelihood of these incidents. Which control would be most effective in addressing the root cause?

Which of the following is an example of a common information security threat?

A document is classified as 'Confidential' in an organization's data classification scheme. Which of the following handling requirements is most likely to apply?

Keep studying — Ethical Hacking Fundamentals and Core Attacks