Free Practice Questions for ISC CC Exam

White-box testing involves examining an application’s internal structure, including source code, logic paths, and configurations, to identify vulnerabilities and security weaknesses. Testers have full knowledge of the system and can analyze how data flows and how controls are implemented.

This testing approach is effective for identifying issues such as insecure coding practices, logic flaws, and hard-coded credentials. Black-box testing does not involve source code access, functional testing validates behavior, and user acceptance testing focuses on business requirements.

White-box testing is commonly used in secure code reviews, static application security testing (SAST), and DevSecOps pipelines. Security standards strongly recommend white-box techniques for early vulnerability detection.

In access control models, asubjectis an active entity that requests access to a resource. In this scenario, Derrick is the subject because he is the user initiating an action—logging into a system and attempting to read a file. Subjects can be users, processes, or systems acting on behalf of users.

Anobject, by contrast, is a passive entity that is being accessed, such as a file, database, printer, or network resource. The file Derrick wants to read is the object. Access control systems evaluate whether a subject has the appropriate permissions to perform an action (such as read, write, or execute) on an object.

This subject-object relationship is foundational to many security models, including discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC). Proper identification of subjects is essential for authentication, authorization, auditing, and accountability. By clearly defining who the subject is, organizations can enforce least privilege, track user actions, and maintain strong security governance across systems.

Identification is the act of claiming an identity (e.g., username). Authentication is the process of verifying that claim (e.g., password, biometrics). Authorization follows authentication.

Metal detectors are effectivepreventive physical controlsthat detect electronic devices and storage media. They are commonly used in high-security environments to enforce device restrictions.

Dumpster diving is a physical social engineering attack in which an attacker searches trash bins to recover sensitive information such as passwords, financial records, network diagrams, or personal data. Because the attack targets discarded physical materials, technical controls such as anti-malware software or data loss prevention tools are ineffective in preventing it.

Shredding is the most effective defense because it physically destroys sensitive documents before disposal, making the information unreadable and unusable. Security best practices recommend cross-cut or micro-cut shredders for documents containing confidential or regulated data. This control directly addresses the attack vector and eliminates the risk at its source.

A clean desk policy reduces exposure during business hours but does not address improper disposal. DLP tools focus on electronic data movement, not physical waste. Therefore, shredding is considered a critical administrative and physical security control for preventing information leakage via dumpster diving, as emphasized in NIST SP 800-53 and ISO/IEC 27001 physical security guidelines.

Elliptic Curve Cryptography (ECC) does not rely on the prime factorization problem. Instead, ECC is based on the mathematical difficulty of solving elliptic curve discrete logarithm problems.

RSA relies directly on the difficulty of factoring large prime numbers. GPG and PGP are encryption tools and standards that may use RSA or other algorithms internally.

ECC provides equivalent security with much smaller key sizes, making it efficient for mobile devices, embedded systems, and environments with limited processing power.

Modern security standards increasingly recommend ECC due to its performance and strong security properties.

Zero Trust assumes no implicit trust and requires continuous verification of every access request. Microsegmentation is a core Zero Trust technique that limits lateral movement.

A Virtual Private Network (VPN) creates an encrypted tunnel between a user’s device and a remote network or server. This tunnel protects data confidentiality and integrity by encrypting all traffic passing through it, even when using untrusted networks such as public Wi-Fi.

HTTPS encrypts only web traffic, antivirus detects malware, and IDS monitors for suspicious activity. Only a VPN provides full-tunnel encryption for all network communications. VPNs are commonly implemented using protocols such as IPSec or SSL/TLS and are widely recommended for secure remote access.

Password Authentication Protocol (PAP) is the least secure option because it transmits credentials in clear text over the network. This makes PAP highly vulnerable to eavesdropping and credential theft.

CHAP improves security by using challenge-response mechanisms. EAP supports strong authentication methods, including certificates and MFA. IPsec provides encrypted and authenticated network communication.

Because PAP lacks encryption and protection mechanisms, it is generally discouraged and considered obsolete. Modern security standards strongly advise against its use in favor of encrypted authentication protocols.