Quiz: Security Principles
A 26-question self-check covering the chapter's principles and how they apply. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP — so certification candidates can self-assess. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] A ransomware attack encrypts files but neither reads nor alters their contents. Which leg of the CIA triad does it primarily attack? A. confidentiality B. integrity C. availability D. non-repudiation
2. An attacker silently changes account balances in a banking ledger while the system continues to report the corrupted values as correct. This is primarily an attack on: A. confidentiality B. integrity C. availability D. authentication
3. [Sec+] "Verifying that an entity is who it claims to be" defines: A. authorization B. authentication C. accounting D. non-repudiation
4. [CISSP] Determining what an authenticated user is permitted to do is: A. authentication B. authorization C. identification D. auditing
5. [Sec+] A locked server-room door is best classified as which control function and nature? A. detective / technical B. preventive / physical C. corrective / administrative D. compensating / physical
6. A SIEM correlation rule that alerts on suspicious logins is which function? A. preventive B. detective C. corrective D. compensating
7. [Sec+] You cannot patch a legacy system, so you isolate it on its own segment and monitor it heavily to satisfy the intent of the patching requirement. The isolation is a __ control. A. preventive B. corrective C. compensating D. directive
8. [CISSP] The principle that every user and process should have only the access required for its function — and no more — is: A. separation of duties B. least privilege C. defense in depth D. fail-safe default
9. Requiring that the person who initiates a wire transfer cannot also approve it is an example of: A. least privilege B. separation of duties C. fail-open D. non-repudiation
10. [Sec+] A firewall configured to deny all traffic except what is explicitly permitted is applying: A. fail-open B. default-deny / fail-safe default C. least privilege of the data D. dual control
11. [CISSP] Designing each defensive layer as if the layer in front of it has already failed describes: A. zero trust architecture B. defense in depth C. separation of duties D. compensating controls
12. "Never trust, always verify — no implicit trust by user, device, or network location" is the slogan of: A. the perimeter model B. zero trust C. fail-open design D. dual control
13. [Sec+] Three identical firewalls from the same vendor with the same misconfiguration provide, in effect: A. three independent layers B. one layer drawn three times C. defense in depth D. separation of duties
14. Which control most directly limits an attacker's lateral movement after they compromise one ordinary user account? A. a longer password policy B. least privilege C. a deterrent banner D. fail-open authentication
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
15. "Availability is an IT-operations concern, not a security concern."
16. [Sec+] "Enabling detailed logging automatically gives an organization non-repudiation."
17. "A defense made entirely of preventive controls is well designed as long as the controls are high quality."
18. [CISSP] "Zero trust is achieved by purchasing and deploying a single zero-trust product."
19. "Information systems should always fail open so that a control failure never blocks legitimate users."
20. "Separation of duties is defeated by an administrative account powerful enough to perform every step of a sensitive process alone."
Section 3 — Fill in the blank (1 pt each)
21. The two independent axes used to classify any control are its _ (preventive, detective, corrective, compensating) and its _ (administrative, technical, physical).
22. [Sec+] The three properties of the CIA triad are confidentiality, _, and _.
23. The slow accumulation of unnecessary access rights as people change roles is called _ _.
24. The working assumption that an attacker is already inside, so you design for detection and response as well as prevention, is called _ _.
Section 4 — Short answer (2 pts each)
25. [CISSP] Explain why the function × nature control matrix is described as a gap-analysis tool, and name the imbalance most common in immature security programs.
26. [Sec+] Zero trust is described in the chapter as a synthesis of earlier principles. Name two principles it combines and explain, in two or three sentences, how it is built from them.