BCS Foundation Certificate in Information Security Management Principles Free Sample Questions
Description
Covers information security principles and risk management, security governance frameworks and standards, security architecture and operations, DevSecOps, network and technical security, and recovery.
12 free sample questions111 in the full practice test
Information Security Principles · Terms and concepts of information security management
A customer disputes an online transaction, claiming they never placed the order. The e-commerce company provides cryptographic logs showing the customer's unique digital signature was used to authorise the purchase. Which core principle of information assurance is the company relying on to defend against the customer's claim?
Answer and explanation
Correct answer: D
Non-repudiation ensures that a party to a transaction cannot later deny having performed the action. By using digital signatures, the e-commerce company can cryptographically prove the customer's involvement, fulfilling the non-repudiation requirement.
Q2Question 2
Advanced
Information Security Principles · Personal data privacy legislation
A UK-based healthcare provider (HealthTrust) collects patient data to provide medical services. To improve efficiency, HealthTrust subscribes to a cloud-based Software-as-a-Service (SaaS) platform provided by CloudMed Inc. to store and manage this patient data.
CloudMed Inc. strictly follows the instructions provided by HealthTrust and does not use the patient data for its own purposes. However, to ensure high availability, CloudMed Inc. subcontracts data hosting to a third-party infrastructure provider, InfraHost.
Under the UK GDPR and Data Protection Act 2018, how are the roles of HealthTrust and CloudMed Inc. legally defined in this scenario?
flowchart LR
A[Patients] -->|Provide Data| B(HealthTrust)
B -->|Determines Purpose| C{Data Controller}
B -->|Uploads Data| D(CloudMed Inc.)
D -->|Follows Instructions| E{Data Processor}
D -->|Subcontracts| F[InfraHost]
Answer and explanation
Correct answer: C
Under GDPR, the Data Controller (HealthTrust) determines the purposes and means of processing personal data. The Data Processor (CloudMed Inc.) processes personal data only on behalf of the controller and strictly according to their instructions. InfraHost would be considered a sub-processor.
Q3Question 3
Beginner
Information Security Principles · Terms and concepts of information security management
Risk tolerance refers to the broad, high-level amount of risk an organisation is willing to accept in pursuit of its strategic objectives, whereas risk appetite is the specific, acceptable variance around a specific objective.
Answer and explanation
Correct answer: B
The statement has the definitions reversed. Risk APPETITE is the broad, high-level amount of risk an organisation is willing to accept. Risk TOLERANCE is the specific, acceptable variance around a particular objective or initiative.
Q4Question 4
Intermediate
Information Risk · Key components of risk management
A financial organisation has implemented a mantrap (security vestibule) at the entrance of its data centre. The mantrap requires a valid smart card to enter the first door, and a biometric retina scan to open the second door, preventing tailgating. How is this control correctly categorised according to the CISMP v10.0 syllabus?
Answer and explanation
Correct answer: B
A mantrap is a physical control (it is a tangible, architectural security measure). Its purpose is to stop unauthorized entry before it occurs, making it a preventive control.
Q5Question 5
Intermediate
Information Risk · Risk management lifecycle
A security manager is performing a quantitative risk analysis on a legacy database server. If the server fails, the business estimates the Single Loss Expectancy (SLE) to be £12,000 in lost revenue and recovery costs. Historical data suggests this type of failure occurs once every three years. What is the Annual Loss Expectancy (ALE) for this risk?
Answer and explanation
Correct answer: C
ALE is calculated by multiplying the Single Loss Expectancy (SLE) by the Annual Rate of Occurrence (ARO). The SLE is £12,000. An event occurring once every three years means the ARO is 0.333 (1/3). Therefore, ALE = £12,000 * (1/3) = £4,000.
Q6Question 6
Beginner
Information Risk · Risk management lifecycle
An organisation decides that the cost of implementing encryption and access controls for a low-value, publicly available marketing dataset far exceeds the potential impact of its exposure. Management formally documents this decision and takes no further security action regarding this dataset. Which risk treatment option has been applied?
Answer and explanation
Correct answer: D
Risk acceptance occurs when an organisation acknowledges a risk but decides not to take any action to mitigate, transfer, or avoid it, typically because the cost of the control outweighs the potential loss. This must be formally documented.
Register free for 6 more questions
Or unlock all 111 CISMP questions with explanations, timed mode and flashcards.
