An organization's security policy states that 'all sensitive data must be encrypted in transit.' The security team needs to implement this requirement. They are deciding between a standard that specifies TLS 1.2 or higher and a procedure that describes how to configure TLS on each server. Which statement correctly distinguishes these documents?

The procedure is a high-level statement, while the standard is a step-by-step guide

The procedure defines the mandatory requirement, while the standard provides optional guidance

The standard is a high-level policy, while the procedure is a detailed standard

The standard defines the mandatory technical requirement, while the procedure provides step-by-step instructions for implementation

A company's security team is designing a layered defense. They deploy a firewall to block unauthorized inbound traffic, an IDS to alert on suspicious activity, and a backup system to restore data after a ransomware attack. Which classification correctly describes these controls in order?

Preventive, detective, corrective

Corrective, preventive, detective

Preventive, corrective, detective

Detective, preventive, corrective

EC-CouncilCertified Security Specialist

Domain 3Objective 1

Information Security Fundamentals ECSS Practice Questions (Page 4)

Part of the Ethical Hacking Fundamentals and Core Attacks domain, which makes up ~17% of our current practice bank.

50questions here

10free pages

10concepts

10 Concepts in This Objective

Confidentiality, Integrity, and Availability (CIA) Triad
Authentication, Authorization, and Accounting (AAA)
Non-repudiation
Information Security Threats and Vulnerabilities
Risk Management Fundamentals
Security Controls (Preventive, Detective, Corrective)
Security Policies, Standards, and Procedures
Data Classification and Handling
Security Awareness and Training
Incident Response Fundamentals

Questions 16–20

16expert · hard
An organization's security policy states that 'all sensitive data must be encrypted in transit.' The security team needs to implement this requirement. They are deciding between a standard that specifies TLS 1.2 or higher and a procedure that describes how to configure TLS on each server. Which statement correctly distinguishes these documents?
Select an answer first
17expert · hard
A company's security team is designing a layered defense. They deploy a firewall to block unauthorized inbound traffic, an IDS to alert on suspicious activity, and a backup system to restore data after a ransomware attack. Which classification correctly describes these controls in order?
Select an answer first
18foundation · easy
In risk management, what is the term for the process of identifying, analyzing, and evaluating risk?
Select an answer first
19foundation · easy
In the AAA framework, which component is responsible for verifying the identity of a user attempting to access a system?
Select an answer first
20foundation · easy
Which pillar of the CIA triad ensures that information is not altered or destroyed by unauthorized parties?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Information Security Fundamentals ECSS Practice Questions (Page 4)

Questions 16–20

A company's security team is designing a layered defense. They deploy a firewall to block unauthorized inbound traffic, an IDS to alert on suspicious activity, and a backup system to restore data after a ransomware attack. Which classification correctly describes these controls in order?

In risk management, what is the term for the process of identifying, analyzing, and evaluating risk?

In the AAA framework, which component is responsible for verifying the identity of a user attempting to access a system?

Which pillar of the CIA triad ensures that information is not altered or destroyed by unauthorized parties?

Keep studying — Ethical Hacking Fundamentals and Core Attacks