CC Exam Dumps - ISC certification Questions and Answers

Logical (technical) controls such as encryption, access controls, DLP, and firewalls directly prevent unauthorized data access and exfiltration.

When incidents escalate beyond containment and business continuity measures are insufficient, theDisaster Recovery Plan (DRP)is activated to restore IT systems and infrastructure.

Risk transference is a risk management strategy in which an organization or individual shifts the financial impact of a risk to a third party. Purchasing insurance is a classic example of risk transference. In this scenario, Mark transfers the financial consequences of potential damage to the laptop screen to the insurance provider.

Risk acceptance involves acknowledging a risk and choosing to do nothing. Risk deterrence discourages risky behavior through controls or penalties. Risk mitigation reduces the likelihood or impact of a risk through safeguards such as protective cases or training.

Risk transference does not eliminate the risk itself; the laptop can still be damaged. However, it reduces the financial burden associated with the event. In cybersecurity, common examples include cyber insurance, outsourcing, and service-level agreements (SLAs).

This strategy is widely recognized in risk management frameworks such as NIST SP 800-30 and ISO 31000 as an appropriate option when mitigation is too costly or impractical.

Defense in depth requiresmultiple layers of security controls. None of the listed scenarios include layered controls, making “None” the correct answer.

The feasibility study determines whether a project is technically, economically, and operationally viable before development begins.

A security assessment evaluates the effectiveness of security controls and verifies whether they meet security requirements. It differs from risk assessments, which focus on identifying threats and vulnerabilities.

Microsegmentation enables fine-grained, software-defined security controls, limiting lateral movement within networks.

Address Space Layout Randomization (ASLR) randomizes the memory locations used by applications, making it significantly harder for attackers to predict where malicious payloads should be placed during buffer overflow attacks.

Buffer overflow exploits rely on predictable memory layouts. ASLR disrupts this predictability, increasing attacker effort and reducing exploit reliability.

The other options are either non-standard terms or unrelated to buffer overflow mitigation. ASLR is widely used in modern operating systems and is a key defensive control recommended by secure coding and system hardening guidelines.

ASLR does not eliminate vulnerabilities but raises the attack complexity, which is a core defensive strategy.

A threat actor is the individual or group responsible for carrying out attacks. Threat vectors describe methods, not entities.

Business Continuity (BC) ensures thatcritical business operations continue during and after an incident. Business Continuity Planning focuses on people, processes, and alternative workflows to keep the organization functioning.

Disaster Recovery (DR) focuses specifically on restoring IT systems and infrastructure after a disruption, while Incident Response focuses on detecting and containing security incidents.

Because the question emphasizes maintaining business operations, Business Continuity is the most accurate answer.