ISC2 CCSP QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Secure Software Concepts (Q1–15)
Q1. Which security principle states that a user should be granted only the minimum access necessary to perform
their job?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Non-repudiation
Answer: B
Rationale: Least privilege means granting only the minimum permissions required. Separation of duties divides
tasks among users; defense in depth uses multiple layers; non-repudiation prevents denial of an action.
Q2. Confidentiality, integrity, and availability are collectively known as:
A) The CIA triad
,B) The Parkerian hexad
C) Defense in depth
D) The OSI model
Answer: A
Rationale: The CIA triad is the core model of information security. The Parkerian hexad adds possession,
authenticity, and utility.
Q3. Which of the following BEST describes non-repudiation?
A) Ensuring data is encrypted at rest
B) Proving that a party performed a specific action
C) Preventing unauthorized access
D) Ensuring systems remain available
Answer: B
, Rationale: Non-repudiation provides proof of the origin and integrity of data, preventing a party from denying an
action. It is often achieved via digital signatures.
Q4. In threat modeling, what does STRIDE stand for?
A) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
B) Secure, Trusted, Reliable, Integrated, Defensible, Encrypted
C) Spoofing, Testing, Risk, Integrity, Disclosure, Exploitation
D) Security, Threats, Risks, Incidents, Detection, Evaluation
Answer: A
Rationale: STRIDE is Microsoft's threat classification model covering Spoofing, Tampering, Repudiation,
Information disclosure, Denial of service, and Elevation of privilege.
Q5. Which principle suggests that security should not rely on the secrecy of the design or implementation?
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Secure Software Concepts (Q1–15)
Q1. Which security principle states that a user should be granted only the minimum access necessary to perform
their job?
A) Separation of duties
B) Least privilege
C) Defense in depth
D) Non-repudiation
Answer: B
Rationale: Least privilege means granting only the minimum permissions required. Separation of duties divides
tasks among users; defense in depth uses multiple layers; non-repudiation prevents denial of an action.
Q2. Confidentiality, integrity, and availability are collectively known as:
A) The CIA triad
,B) The Parkerian hexad
C) Defense in depth
D) The OSI model
Answer: A
Rationale: The CIA triad is the core model of information security. The Parkerian hexad adds possession,
authenticity, and utility.
Q3. Which of the following BEST describes non-repudiation?
A) Ensuring data is encrypted at rest
B) Proving that a party performed a specific action
C) Preventing unauthorized access
D) Ensuring systems remain available
Answer: B
, Rationale: Non-repudiation provides proof of the origin and integrity of data, preventing a party from denying an
action. It is often achieved via digital signatures.
Q4. In threat modeling, what does STRIDE stand for?
A) Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege
B) Secure, Trusted, Reliable, Integrated, Defensible, Encrypted
C) Spoofing, Testing, Risk, Integrity, Disclosure, Exploitation
D) Security, Threats, Risks, Incidents, Detection, Evaluation
Answer: A
Rationale: STRIDE is Microsoft's threat classification model covering Spoofing, Tampering, Repudiation,
Information disclosure, Denial of service, and Elevation of privilege.
Q5. Which principle suggests that security should not rely on the secrecy of the design or implementation?
