,WGU D481: Security Foundations (ISC2 CC)
Comprehensive Practice Examination (70 Questions with Answer
Key & Detailed Rationales)
EXAM INSTRUCTIONS & DOMAIN OVERVIEW
• Total Questions: 70 Multiple Choice Questions (Simulating the ISC2 Certified in Cybersecurity exam format).
• Passing Score Threshold: ~70% (49/70 correct).
• Domain Coverage:
1. Security Principles (CIA Triad, Risk Management, Ethics, Controls)
2. Business Continuity (BCP), Disaster Recovery (DRP), & Incident Response (IR)
3. Access Controls Concepts (MAC, DAC, RBAC, ABAC, MFA, Authentication)
4. Network Security (OSI Model, TCP/IP, Firewalls, Wireless, Cloud, Attacks)
5. Security Operations (Data Security, Hardening, Patching, Encryption, Policies)
Structure: Section 1 contains the 70 Practice Questions. Section 2 contains the Complete Answer Key with In-
Depth Explanations & Rationales for each option.
SECTION 1: PRACTICE QUESTIONS
Question 1
Which core pillar of information security is primary when ensuring that sensitive medical records are protected
from unauthorized disclosure to non-medical personnel?
A. Integrity
B. Confidentiality
C. Availability
D. Non-repudiation
Question 2
An organization implements checksums and cryptographic hashing algorithms (such as SHA-256) on critical
system configuration files. Which CIA Triad property is this measure directly designed to enforce?
A. Confidentiality
B. Availability
C. Integrity
D. Accountability
Question 3
A denial-of-service (DoS) attack floods a company's web server, causing the website to crash and preventing
legitimate users from accessing services. Which security goal is violated?
A. Confidentiality
, B. Integrity
C. Availability
D. Authenticity
Question 4
What is the primary risk management strategy being used when an organization purchases a cyber insurance
policy to cover potential financial losses from data breaches?
A. Risk Avoidance
B. Risk Mitigation
C. Risk Transference
D. Risk Acceptance
Question 5
A company decides to completely discontinue a risky legacy web application because it can no longer be patched
against critical vulnerabilities. Which risk treatment strategy does this represent?
A. Risk Avoidance
B. Risk Transference
C. Risk Mitigation
D. Risk Tolerance
Question 6
Installing anti-malware software, implementing firewall rules, and enforcing security awareness training are all
examples of which risk response strategy?
A. Risk Acceptance
B. Risk Avoidance
C. Risk Transference
D. Risk Mitigation
Question 7
According to the ISC2 Code of Ethics, what is the highest priority and paramount duty of a certified security
professional?
A. Protect the organization's intellectual property and financial assets
B. Protect society, the common good, necessary public trust, and the infrastructure
C. Provide competent service to principals and employers
D. Advance and protect the security profession
Question 8
Which category of security control includes security awareness training, employee background checks, and
organizational security policies?
A. Technical / Logical Control
B. Physical Control
C. Administrative / Managerial Control
D. Operational Control
Question 9
A security guard stationed at an entry gate and biometric door locks are examples of which control category?
Comprehensive Practice Examination (70 Questions with Answer
Key & Detailed Rationales)
EXAM INSTRUCTIONS & DOMAIN OVERVIEW
• Total Questions: 70 Multiple Choice Questions (Simulating the ISC2 Certified in Cybersecurity exam format).
• Passing Score Threshold: ~70% (49/70 correct).
• Domain Coverage:
1. Security Principles (CIA Triad, Risk Management, Ethics, Controls)
2. Business Continuity (BCP), Disaster Recovery (DRP), & Incident Response (IR)
3. Access Controls Concepts (MAC, DAC, RBAC, ABAC, MFA, Authentication)
4. Network Security (OSI Model, TCP/IP, Firewalls, Wireless, Cloud, Attacks)
5. Security Operations (Data Security, Hardening, Patching, Encryption, Policies)
Structure: Section 1 contains the 70 Practice Questions. Section 2 contains the Complete Answer Key with In-
Depth Explanations & Rationales for each option.
SECTION 1: PRACTICE QUESTIONS
Question 1
Which core pillar of information security is primary when ensuring that sensitive medical records are protected
from unauthorized disclosure to non-medical personnel?
A. Integrity
B. Confidentiality
C. Availability
D. Non-repudiation
Question 2
An organization implements checksums and cryptographic hashing algorithms (such as SHA-256) on critical
system configuration files. Which CIA Triad property is this measure directly designed to enforce?
A. Confidentiality
B. Availability
C. Integrity
D. Accountability
Question 3
A denial-of-service (DoS) attack floods a company's web server, causing the website to crash and preventing
legitimate users from accessing services. Which security goal is violated?
A. Confidentiality
, B. Integrity
C. Availability
D. Authenticity
Question 4
What is the primary risk management strategy being used when an organization purchases a cyber insurance
policy to cover potential financial losses from data breaches?
A. Risk Avoidance
B. Risk Mitigation
C. Risk Transference
D. Risk Acceptance
Question 5
A company decides to completely discontinue a risky legacy web application because it can no longer be patched
against critical vulnerabilities. Which risk treatment strategy does this represent?
A. Risk Avoidance
B. Risk Transference
C. Risk Mitigation
D. Risk Tolerance
Question 6
Installing anti-malware software, implementing firewall rules, and enforcing security awareness training are all
examples of which risk response strategy?
A. Risk Acceptance
B. Risk Avoidance
C. Risk Transference
D. Risk Mitigation
Question 7
According to the ISC2 Code of Ethics, what is the highest priority and paramount duty of a certified security
professional?
A. Protect the organization's intellectual property and financial assets
B. Protect society, the common good, necessary public trust, and the infrastructure
C. Provide competent service to principals and employers
D. Advance and protect the security profession
Question 8
Which category of security control includes security awareness training, employee background checks, and
organizational security policies?
A. Technical / Logical Control
B. Physical Control
C. Administrative / Managerial Control
D. Operational Control
Question 9
A security guard stationed at an entry gate and biometric door locks are examples of which control category?
