Verified CC dumps Q&As - 2026 Latest CC Download
Updated 100% Cover Real CC Exam Questions - 100% Pass Guarantee
NEW QUESTION # 118
Who is responsible for publishing and signing the organization's policies?
- A. The legal department
- B. Senior management
- C. Human resources
- D. The security office
Answer: B
Explanation:
Senior management is ultimately responsible for approving, signing, and publishing organizational policies.
While departments such as security, HR, and legal may draft, review, or advise on policies, executive leadership provides formal authorization and accountability.
This responsibility aligns with governance principles outlined in frameworks like ISO/IEC 27001 and NIST, which emphasize management commitment to information security. Policies require executive endorsement to ensure they are enforceable, aligned with business objectives, and supported with appropriate resources.
Senior management's involvement demonstrates organizational commitment, establishes authority, and ensures compliance across all departments. Without leadership approval, policies lack legitimacy and may not be consistently followed.
Security operations rely on clear, management-approved policies to guide procedures, incident response, and compliance activities. Executive sponsorship also enables enforcement and disciplinary actions when policies are violated.
NEW QUESTION # 119
What is the main purpose of using digital signatures in communication security?
- A. To prevent unauthorized access to a network
- B. To encrypt sensitive data during transmission
- C. To compress data to reduce bandwidth usage
- D. To verify the identity of the sender and ensure the integrity of the message (Correct)
Answer: D
NEW QUESTION # 120
What is the primary goal of incident management?
- A. To protect life, health, and safety
- B. To prepare for any incident
- C. To reduce the impact of an incident
- D. To resume interrupted operations as soon as possible
Answer: C
Explanation:
The primary goal of incident management is toreduce the impact of an incidenton the organization. Incident management focuses on minimizing damage, limiting scope, and restoring stability as quickly as possible.
Preparation is handled before incidents occur, and disaster recovery focuses on long-term system restoration.
Protecting life and safety is important but not the core definition of incident management in cybersecurity frameworks.
NIST SP 800-61 emphasizes rapid containment, mitigation, and impact reduction as the central objectives of incident management.
NEW QUESTION # 121
What is the first step in incident response planning?
- A. Train staff
- B. Develop a management-approved policy
- C. Identify critical systems
- D. Form the IR team
Answer: B
Explanation:
An incident response policy establishes authority, scope, and direction. Without management approval, IR activities lack legitimacy.
NEW QUESTION # 122
What is the main objective of DRP after a breach shuts down systems?
- A. Restore systems
- B. Prosecution
- C. Employee safety
- D. Relocation
Answer: A
Explanation:
The primary objective of DRP is restoring IT systems to a reliable operational state.
NEW QUESTION # 123
Triffid Corporation has a rule that all employees working with sensitive hardcopy documents must put the documents into a safe at the end of the workday, where they are locked up until the following workday. What kind of control is the process of putting the documents into the safe?
- A. Administrative
- B. Technical
- C. Physical
- D. Tangential
Answer: A
NEW QUESTION # 124
Exhibit.
How many keys would be required to support 50 users in an asymmetric cryptography system?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
In anasymmetric cryptography system, each user is assigned akey pairconsisting ofone public key and one private key. These two keys are mathematically related but serve different purposes: the public key is shared openly for encryption or verification, while the private key is kept secret for decryption or signing.
To support50 users, each user must have2 keys:
* 1 public key
* 1 private key
Therefore, the total number of keys required is:
50 users × 2 keys per user = 100 keys
This is one of the major advantages of asymmetric cryptography over symmetric cryptography. In symmetric systems, the number of required keys grows rapidly as the number of users increases (n(n#1)/2), making key management complex. Asymmetric cryptography scales much more efficiently because each user manages only their own key pair.
Asymmetric encryption is widely used in secure communications such as TLS, digital signatures, and PKI- based authentication. Standards bodies like NIST and ISO/IEC rely heavily on asymmetric cryptography for scalable and secure key management.
NEW QUESTION # 125
Example of Type 1 Authentication
- A. Password
- B. Finger Print
- C. Smart Card
- D. RSA Token
Answer: A
NEW QUESTION # 126
Which one of the following cryptographic algorithms does NOT depend upon the prime factorization problem?
- A. GPG - GNU Privacy Guard
- B. PGP - Pretty Good Privacy
- C. ECC - Elliptic Curve Cryptosystem
- D. RSA - Rivest-Shamir-Adleman
Answer: C
Explanation:
Elliptic Curve Cryptography (ECC) does not rely on the prime factorization problem. Instead, ECC is based on the mathematical difficulty of solving elliptic curve discrete logarithm problems.
RSA relies directly on the difficulty of factoring large prime numbers. GPG and PGP are encryption tools and standards that may use RSA or other algorithms internally.
ECC provides equivalent security with much smaller key sizes, making it efficient for mobile devices, embedded systems, and environments with limited processing power.
Modern security standards increasingly recommend ECC due to its performance and strong security properties.
NEW QUESTION # 127
Scans networks to determine connected devices and services:
- A. Wireshark
- B. Fiddler
- C. Zenmap
- D. Burp Suite
Answer: C
Explanation:
Zenmap is the graphical front end for Nmap. It performs host discovery, port scanning, service enumeration, and OS fingerprinting.
NEW QUESTION # 128
What cybersecurity principle focuses on granting users only the privileges necessary to perform their job functions?
- A. Separation of duties
- B. Defense in depth
- C. Least privilege
- D. Need-to-know basis
Answer: C
Explanation:
The principle of least privilege ensures users have only the minimum permissions necessary to perform their tasks. This limits damage from compromised accounts and insider threats.
It is foundational to access control, IAM, and zero trust architectures and is recommended by all major security frameworks.
NEW QUESTION # 129
Which of the following does not normally influence an organization's retention policy for logs?
- A. Laws
- B. Audits
- C. Regulations
- D. Corporate governance
Answer: B
NEW QUESTION # 130
Ensuring a process cannot be completed by a single person is known as:
- A. Least privilege
- B. Rule-based access control
- C. Segregation of duties
- D. Privileged account
Answer: C
Explanation:
Segregation of duties reduces fraud and insider threats by requiring multiple individuals to complete critical tasks.
NEW QUESTION # 131
Which of the following is NOT a feature of a cryptographic hash function?
- A. Deterministic
- B. Reversible
- C. Useful
- D. Unique
Answer: B
Explanation:
Cryptographic hash functions areone-wayfunctions and are intentionallynot reversible. Given a hash value, it should be computationally infeasible to recover the original input.
Hash functions are deterministic (same input produces the same output), designed to minimize collisions (unique in practice), and useful for integrity verification, password storage, and digital signatures.
Reversibility would completely undermine their security purpose.
NEW QUESTION # 132
Prachi works as a database administrator for Triffid, Inc. Prachi is allowed to add or delete users, but is not allowed to read or modify the data in the database itself. When Prachi logs onto the system, an access control list (ACL) checks to determine which permissions Prachi has.
In this situation, what is Prachi?
- A. The object
- B. The rule
- C. The subject
- D. The file
Answer: C
NEW QUESTION # 133
The means by which a threat actor carries out their objectives.
- A. Exploit
- B. Threat Vector
- C. Threat
- D. Intrusion
Answer: B
Explanation:
Athreat vectoris the path or method used by a threat actor to exploit vulnerabilities, such as phishing, malware, or network attacks.
NEW QUESTION # 134
Which service uses a registered port?
- A. TCP
- B. HTTP
- C. MS SQL Server
- D. SMB
Answer: C
Explanation:
Microsoft SQL Server commonly uses TCP port 1433, which falls in the registered port range.
NEW QUESTION # 135
What is an IP address
- A. An address that denotes the vendor or manufacturer of the physical network interface
- B. An Address that represents the network interface within the network
- C. A physical address used to connect multiple devices in a network
- D. A Logical address associated with a unique network interface within the network
Answer: D
NEW QUESTION # 136
Which of the following is a subject?
- A. Filename
- B. File
- C. Fence
- D. User
Answer: D
Explanation:
A subject in cybersecurity is an active entity that initiates actions and requests access to resources. Among the options provided, auseris the correct example of a subject because users actively authenticate, request access, and perform operations on systems.
Files and filenames are objects, not subjects. They are passive entities that store data and do not initiate actions. A fence is a physical security control and does not function as a subject within access control models.
Subjects can include human users, system processes, applications, or services acting on behalf of users. In access control decisions, systems evaluate whether a subject is authorized to perform a specific action on an object based on identity, role, or security label.
Understanding the distinction between subjects and objects is essential for designing secure systems and implementing access control policies. It supports core principles such as least privilege and separation of duties. Without clearly identifying subjects, organizations cannot accurately enforce permissions, monitor activity, or perform effective auditing and incident response.
NEW QUESTION # 137
Who should participate in creating a BCP
- A. Only members from the management team
- B. Only members from the IT department
- C. Only members from the finanace department
- D. Members from across the organization
Answer: D
NEW QUESTION # 138
A collection of actions that must be followed in order to complete a task or process in accordance with a set of rules
- A. Policy
- B. Standard
- C. Procedure
- D. Law
Answer: C
NEW QUESTION # 139
......
Use Real Dumps - 100% Free CC Exam Dumps: https://freetorrent.dumpsmaterials.com/CC-real-torrent.html
