CC Exam Dumps - ISC certification Questions and Answers

TheBusiness Continuity Planincludes immediate response actions, communication plans, and leadership guidance.

Zero Trust assumes no implicit trust and requires continuous verification of users, devices, and access requests, regardless of location.

Crime Prevention Through Environmental Design (CPTED) uses environmental design principles such as visibility, lighting, access control, and territorial reinforcement to deter criminal activity.

ABusiness Continuity Plan (BCP)ensures critical business functions continue or are restored during and after disruptions.

Corrective controls are designed torestore systems to normal operation after a security incident or attack has occurred. Examples include restoring data from backups, reimaging compromised systems, applying patches, and resetting credentials.

Detective controls identify incidents, preventive controls stop incidents, and corrective controls fix the damage. While recovery controls are sometimes mentioned informally, most security frameworks (including NIST) classify restoration activities under corrective controls.

Corrective controls are critical for minimizing downtime and ensuring business resilience following an incident.

Anti-malware solutions provide broader detection than traditional antivirus by covering multiple malware classes.

Role-Based Access Control (RBAC) assigns permissions based on job roles, making it scalable and efficient for large organizations. It simplifies access management and supports least privilege.

A wall is a physical deterrent that prevents and discourages unauthorized access. Signs are administrative deterrents, cameras are detective controls, and razor tape is a physical barrier but typically supplements perimeter defenses rather than serving as the primary deterrent.

HTTPS (Hypertext Transfer Protocol Secure) is the most suitable protocol for secure communication between clients and servers. HTTPS uses TLS to encrypt data in transit, ensuring confidentiality, integrity, and authentication. This prevents attackers from eavesdropping, tampering, or impersonating servers.

HTTP and FTP transmit data in clear text, making them vulnerable to interception. SMTP is used for email delivery, not client-server web communication. Modern security standards mandate HTTPS for all production web applications.

The final phase in the data security lifecycle isdestruction. After data is no longer required for business, legal, or regulatory purposes, it must be securely destroyed to prevent unauthorized recovery or misuse.

Encryption, backup, and archival are all earlier phases focused on protecting data during use, storage, and retention. Destruction ensures data is permanently removed through secure wiping, degaussing, or physical destruction of media.

Improper data disposal can lead to data breaches through remanence. NIST SP 800-88 provides detailed guidance on secure media sanitization and destruction methods. Secure destruction is especially critical for sensitive and regulated data such as PII, PHI, and financial records.