A company is implementing MFA for remote access. The security team is considering two options: (1) a one-time password (OTP) sent via SMS to the user's personal phone, or (2) a hardware token that generates a code. The company is concerned about SIM-swapping attacks. Which option is more secure and why?

Hardware token, because it is not tied to a phone number and is resistant to SIM-swapping attacks

SMS OTP, because it uses something you have (the phone) and something you know (the password)

SMS OTP, because it is easier for users and does not require additional hardware

Both are equally secure, because both provide a second factor

Which practice directly supports the availability of a critical service?

Enforcing strong password policies

Using digital signatures on software

A legal firm must ensure that electronic contracts are not altered after signing and that the signing party cannot deny having signed. The firm currently uses a simple checksum (e.g., CRC) to verify file integrity. A security consultant recommends replacing the checksum with a digital signature. Which information assurance goals does the digital signature provide that the checksum does not?

Non-repudiation and confidentiality

Certified in Cybersecurity

Domain 1Objective 1

1.1 - Understand the Security Concepts of Information Assurance CC Practice Questions (Page 3)

Part of the Security Principles domain, which accounts for 26% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–21 in this domain), expect 3–4 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

26%of the exam

Questions 11–15

11foundation · easy
Which mechanism is commonly used to verify the integrity of a file?
Select an answer first
12application · medium
An e-commerce company's website experiences a distributed denial-of-service (DDoS) attack that overwhelms the servers, making the site unreachable for customers. Which information assurance goal is being directly violated during this attack?
Select an answer first
13expert · hard
A company is implementing MFA for remote access. The security team is considering two options: (1) a one-time password (OTP) sent via SMS to the user's personal phone, or (2) a hardware token that generates a code. The company is concerned about SIM-swapping attacks. Which option is more secure and why?
Select an answer first
14foundation · easy
Which practice directly supports the availability of a critical service?
Select an answer first
15expert · hard
A legal firm must ensure that electronic contracts are not altered after signing and that the signing party cannot deny having signed. The firm currently uses a simple checksum (e.g., CRC) to verify file integrity. A security consultant recommends replacing the checksum with a digital signature. Which information assurance goals does the digital signature provide that the checksum does not?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.

1.1 - Understand the Security Concepts of Information Assurance CC Practice Questions (Page 3)

Questions 11–15

Which mechanism is commonly used to verify the integrity of a file?

An e-commerce company's website experiences a distributed denial-of-service (DDoS) attack that overwhelms the servers, making the site unreachable for customers. Which information assurance goal is being directly violated during this attack?

Which practice directly supports the availability of a critical service?

Keep studying — Security Principles