Pass the ISC ISC certification CC Questions and answers with CertsForce

Regulations are legally enforceable requirements issued by governments or regulatory bodies. Violating regulations such as GDPR, HIPAA, or PCI DSS can result in fines and penalties.

Standards, policies, and procedures may influence compliance but do not carry direct legal penalties unless codified into law.

TLS Session Resumption is used to optimize the TLS handshake process by reducing the number of round trips required between the client and server. Instead of performing a full handshake, session resumption allows previously negotiated security parameters to be reused.

This significantly improves performance and reduces latency, especially for applications with frequent connections such as web services and APIs. Session resumption can be implemented using session IDs or session tickets.

TLS renegotiation re-establishes parameters mid-session, TLS heartbeat is unrelated and historically associated with vulnerabilities, and “TLS FastTrack” is not a valid standard. TLS Session Resumption is formally defined in TLS specifications and is widely used in modern secure communications.

IPv6 allows removal of leading zeros and compression of consecutive zero blocks using “::”, making option A correct.

Ransomware affects victims’ files primarily byencryptingthem, rendering the data inaccessible without a decryption key. Attackers then demand a ransom in exchange for restoring access.

While modern ransomware may also steal data, encryption is the defining characteristic of ransomware attacks. Destroying or selling files is not the primary mechanism.

Strong backups, access controls, and endpoint protection are key defenses against ransomware, as emphasized by NIST and CIS.

The IPv6 address rangefc00::/7, which includesfc00:: to fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, is reserved forUnique Local Addresses (ULAs). ULAs are the IPv6 equivalent of private IPv4 addresses (such as 10.0.0.0/8 or 192.168.0.0/16). These addresses are intended for internal communications within an organization and arenot routable on the public Internet.

ULAs allow organizations to design internal IPv6 networks without relying on globally routable addresses. This enhances security by reducing external exposure and simplifies internal network design. According to RFC 4193, ULAs are designed to be globally unique within private networks while remaining isolated from the public Internet.

Security benchmarks define baseline performance and configuration standards against which systems are measured.

Security policies are high-level, mandatory statements approved by management that define security objectives, principles, and rules. Procedures and standards support policies but do not establish overarching intent.

Risk tolerance, risk appetite, and acceptable risk are closely related terms describing how much risk an organization is willing to accept.

Symmetric encryption uses a single shared key for both encryption and decryption. This means that both the sender and receiver must securely possess the same key.

Symmetric algorithms are fast and efficient, making them ideal for encrypting large amounts of data. Common examples include AES and ChaCha20.

Asymmetric (public key) encryption uses two keys—public and private—and is slower. “TCB key” is not a recognized encryption type.

Because of key distribution challenges, symmetric encryption is often combined with asymmetric encryption for secure key exchange. This hybrid approach is used in protocols like TLS and is recommended by modern cryptographic standards.

Data Loss Prevention (DLP) is designed to protect sensitive data across all states: at rest, in motion, and in use. DLP solutions monitor, detect, and prevent unauthorized access, sharing, or exfiltration of data.

While encryption protects data at rest and in transit, it does not prevent authorized users from misusing data. Hashing ensures integrity, not confidentiality. Threat modeling identifies risks but does not enforce protection.

DLP tools enforce policies, inspect content, and prevent data leakage through email, web uploads, removable media, and cloud services. They are especially valuable for protecting regulated data such as PII and financial records.

NIST and CIS recognize DLP as a critical control for comprehensive data protection strategies.