A company is designing a new system for storing customer financial data. The system must ensure that data is only accessible to authorized personnel, remains accurate, and is available during business hours. Which set of controls should be prioritized?

Implement multi-factor authentication and audit logging.

Implement strong access controls, data validation checks, and redundant servers.

Implement encryption for data at rest and in transit, and use digital signatures.

Implement a firewall and intrusion detection system.

A government agency receives a software update from a vendor. The agency needs to confirm that the update was actually created by the vendor and has not been modified. Which process should be used?

Download the update from a mirror site and compare the hash.

Check the update's version number against the vendor's release notes.

Verify the digital signature on the update using the vendor's public key.

Compare the file size of the update to the size listed on the vendor's website.

A multinational corporation is implementing a new document management system. The system must ensure that only authorized users can read sensitive documents, that documents cannot be altered without detection, and that users cannot deny having uploaded a document. The company also requires that the system remain available during a regional outage. Which combination of controls best meets all these requirements?

Implement encryption at rest, hashing, and a load balancer.

Implement RBAC, digital signatures, and replicate the system to a secondary region.

Implement a VPN, data validation, and redundant servers.

Implement MFA, audit logging, and a backup strategy.

Which definition best describes the security concept of confidentiality?

Ensuring data is accessible only to authorized parties

Ensuring data is available when needed

Ensuring the origin of data can be verified

Ensuring data is accurate and unaltered

Certified Information Systems Security Professional

Domain 1Objective 2

1.2 - Understand and Apply Security Concepts CISSP Practice Questions (Page 1)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

16%of the exam

Questions 1–5

1application · medium
A company is designing a new system for storing customer financial data. The system must ensure that data is only accessible to authorized personnel, remains accurate, and is available during business hours. Which set of controls should be prioritized?
Select an answer first
2application · medium
A government agency receives a software update from a vendor. The agency needs to confirm that the update was actually created by the vendor and has not been modified. Which process should be used?
Select an answer first
3expert · hard
A multinational corporation is implementing a new document management system. The system must ensure that only authorized users can read sensitive documents, that documents cannot be altered without detection, and that users cannot deny having uploaded a document. The company also requires that the system remain available during a regional outage. Which combination of controls best meets all these requirements?
Select an answer first
4foundation · easy
Which definition best describes the security concept of confidentiality?
Select an answer first
5foundation · easy
Which security goal is primarily concerned with protecting data from unauthorized modification or destruction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

1.2 - Understand and Apply Security Concepts CISSP Practice Questions (Page 1)

Questions 1–5

A company is designing a new system for storing customer financial data. The system must ensure that data is only accessible to authorized personnel, remains accurate, and is available during business hours. Which set of controls should be prioritized?

A government agency receives a software update from a vendor. The agency needs to confirm that the update was actually created by the vendor and has not been modified. Which process should be used?

Which definition best describes the security concept of confidentiality?

Which security goal is primarily concerned with protecting data from unauthorized modification or destruction?

Keep studying — Security and Risk Management