SFPC Information Security Fundamentals 2 — Questions and Answers

Question 1: What are the three core principles of information security (the CIA Triad)?

Confidentiality, Intelligence, Authentication
Confidentiality, Integrity, Availability (Correct answer)
Control, Integrity, Authorization
Classification, Investigation, Assessment

Correct answer: Confidentiality, Integrity, Availability

The CIA Triad represents the three fundamental goals of information security: Confidentiality (protecting information from unauthorized access), Integrity (ensuring accuracy and completeness), and Availability (ensuring authorized users can access information when needed).

The CIA Triad is the foundational model for information security. Confidentiality ensures that information is accessible only to authorized individuals. Integrity ensures that information is accurate, complete, and trustworthy. Availability ensures that information and systems are accessible to authorized users when needed. Security programs must balance all three objectives.

Question 2: What is 'two-factor authentication' (2FA)?

Using two separate computers to access a system
A security process requiring two different types of verification before granting access (Correct answer)
Having two passwords for a single account
Logging in twice to confirm identity

Correct answer: A security process requiring two different types of verification before granting access

2FA requires users to provide two different types of verification factors — something they know, something they have, or something they are — to access a system.

Two-factor authentication (2FA) is a security mechanism that requires users to provide two different authentication factors from different categories: something you know (password or PIN), something you have (smart card, token, or phone), or something you are (biometric). This significantly improves security over single-factor authentication by requiring that an attacker obtain multiple types of credentials.

Question 3: What is the purpose of 'access control lists' (ACLs) in information security?

To track employee attendance
To specify which users or system processes have permission to access specific resources (Correct answer)
To organize files alphabetically
To monitor network traffic volumes

Correct answer: To specify which users or system processes have permission to access specific resources

ACLs define the permissions and restrictions for users or system processes accessing specific resources, implementing the principle of least privilege.

Access Control Lists (ACLs) are lists of permissions attached to objects or resources that specify which subjects (users, processes, systems) are authorized to access the resource and what operations they are permitted to perform. ACLs are a fundamental tool for implementing access control policies and the principle of least privilege in information systems.

Question 4: What is 'defense in depth' in information security?

Encrypting only the most sensitive data
Using multiple layers of security controls so that if one fails, others still provide protection (Correct answer)
Defending only the perimeter of a network
Using the most advanced security technology available

Correct answer: Using multiple layers of security controls so that if one fails, others still provide protection

Defense in depth is a security strategy that employs multiple layers of controls, ensuring that if one control fails, additional controls continue to provide protection.

Defense in depth (also called the layered security approach) is a cybersecurity strategy that uses multiple security controls at different layers of an IT system. The principle is that no single security control is completely reliable, so multiple overlapping controls create redundancy. If an attacker bypasses one layer, they still face additional barriers. This approach is modeled after medieval castle defenses.

Question 5: What is a 'penetration test' in information security?

Testing network cable connections
An authorized simulated attack to evaluate the security of a system (Correct answer)
A type of malware
A method for recovering deleted files

Correct answer: An authorized simulated attack to evaluate the security of a system

A penetration test is an authorized, simulated attack against a system to identify vulnerabilities that could be exploited by real attackers.

A penetration test (pen test) is an authorized cybersecurity assessment where skilled testers attempt to exploit vulnerabilities in systems, networks, or applications using the same techniques real attackers would use. The goal is to identify vulnerabilities before malicious actors do, providing actionable recommendations for improving security posture.

Question 6: What is 'data classification' in an organizational context?

Organizing files by date created
The process of categorizing data based on its sensitivity and the impact of unauthorized disclosure (Correct answer)
Sorting database records alphabetically
Identifying duplicate records in a database

Correct answer: The process of categorizing data based on its sensitivity and the impact of unauthorized disclosure

Data classification is the process of categorizing organizational data based on its sensitivity level and the potential impact of unauthorized disclosure, loss, or modification.

Data classification is the systematic process of organizing data into categories based on its level of sensitivity, value, and criticality. Classification enables organizations to apply appropriate security controls based on the sensitivity of the data. Common classification levels include Public, Internal, Confidential, and Restricted (or government equivalents: Unclassified, Confidential, Secret, Top Secret).

SFPC Information Security Fundamentals 2

What are the three core principles of information security (the CIA Triad)?