Free BCS Foundation Certificate in Information Security Management Principles Practice Questions

Sample Practice Questions

Try these 10 sample questions from the BCS Foundation Certificate in Information Security Management Principles practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A salary file is disclosed to an employee who has no permission to read it. Which information security property has been directly breached?

   1. A.Availability
   2. B.ConfidentialityCorrect answer: B
   3. C.Data integrity
   4. D.Accountability

   Explanation: NIST defines confidentiality as "Preserving authorized restrictions on information access and disclosure". Reading by an unauthorised employee breaks that restriction. Availability concerns access when needed, integrity concerns alteration, and accountability concerns tracing actions.

   Reference: NIST An Introduction to Information Security — Section 1.4, Confidentiality

2. 2An application contains an unchecked input field that an attacker could exploit. What does this weakness represent?

   1. A.An impact
   2. B.A vulnerabilityCorrect answer: B
   3. C.A risk appetite
   4. D.A threat actor

   Explanation: The source states: "A vulnerability is a weakness in a system, system security procedure, internal controls, or implementation that could be exploited by a threat source.". The input flaw is the exploitable weakness. Impact is harm, appetite is willingness to bear risk, and the actor is the source of a threat.

   Reference: NIST An Introduction to Information Security — Section 4

3. 3Which document would normally give a new administrator the detailed sequence for creating a user account?

   1. A.Security policy
   2. B.Technical standard
   3. C.Security guideline
   4. D.Operating procedureCorrect answer: D

   Explanation: The source states: "They are detailed steps to be followed by users, system operations personnel, or others to accomplish a particular task". A procedure provides task steps. Policy gives direction, a standard specifies uniform requirements, and a guideline gives adaptable advice.

   Reference: NIST An Introduction to Information Security — Section 5.1

4. 4An analyst needs read access to one reporting database. Which access allocation applies least privilege?

   1. A.Grant administrator access for troubleshooting.
   2. B.Grant access to all departmental databases.
   3. C.Grant the read access needed for assigned tasks.Correct answer: C
   4. D.Grant the permissions of the previous employee.

   Explanation: The source states: "only authorized access for users or processes acting on behalf of users that is necessary to accomplish assigned tasks". Least privilege limits access to task requirements. The other allocations grant unnecessary or unvalidated privileges.

   Reference: NIST An Introduction to Information Security — Section 5.4.3

5. 5When should information receive appropriate protection during its lifecycle?

   1. A.Only after it reaches permanent storage
   2. B.Only while it is actively being processed
   3. C.Only after its retention period has expired
   4. D.Throughout creation, use, storage and disposalCorrect answer: D

   Explanation: The source states: "All information needs to be managed carefully throughout its lifecycle, from creation to destruction". Protection spans the lifecycle. Limiting it to storage, active processing or the end of retention leaves other stages unmanaged.

   Reference: BCS CISMP v10 syllabus — p.18, 5.1 guidance

6. 6A company uses a provider's web-based email application without managing the servers or operating systems. Which cloud service model is this?

   1. A.Infrastructure as a Service
   2. B.Platform as a Service
   3. C.Software as a ServiceCorrect answer: C
   4. D.Private cloud deployment

   Explanation: The source states: "use the provider’s applications running on a cloud infrastructure". SaaS delivers the provider's application. IaaS provides computing resources; PaaS hosts customer-deployed apps; private cloud is a deployment model.

   Reference: NIST Definition of Cloud Computing — Service Models, SaaS

7. 7What is the primary purpose of physical access controls for a server room?

   1. A.To restrict entry to authorised individualsCorrect answer: A
   2. B.To record ownership of equipment in the room
   3. C.To detect environmental overheating in the room
   4. D.To maintain power during electricity interruptions

   Explanation: The source states: "limit physical access to systems, equipment, and the respective operating environments to authorized individuals". Entry controls restrict who enters. Asset ownership, environmental monitoring and emergency power address other physical security objectives.

   Reference: NIST An Introduction to Information Security — Section 10.13

8. 8A response team disconnects a compromised host to stop the incident spreading to other systems. Which incident response objective does this action serve?

   1. A.Eradication
   2. B.Reporting
   3. C.ContainmentCorrect answer: C
   4. D.Recovery

   Explanation: The source states: "Containment refers to preventing the expansion of an incident.". Isolation prevents expansion. It does not by itself remove persistence, report results or restore normal operations.

   Reference: NIST Incident Response Recommendations — Table 3, RS.MI-01

9. 9Why are universal factory-default passwords a security concern for IoT devices?

   1. A.Known shared credentials can enable unauthorised access.Correct answer: A
   2. B.Default credentials authenticate only people physically at the device.
   3. C.A shared password provides a unique identity for each device.
   4. D.Factory credentials automatically expire after the first connection.

   Explanation: The UK consumer IoT code states: "All IoT device passwords shall be unique and not resettable to any universal factory default value". Shared, publicly known defaults make unauthorised login easier across multiple devices. They do not inherently restrict authentication to physically present people, provide per-device uniqueness or expire after first use. The quoted design guidance addresses this shared-credential weakness.

   Reference: UK Code of Practice for Consumer IoT Security — Guideline 1, No default passwords

10. 10A transfer changes an invoice amount without authorisation, although authorised staff can still retrieve the invoice. Which property of the data has failed?

    1. A.Data integrityCorrect answer: A
    2. B.Availability
    3. C.Confidentiality
    4. D.Non-repudiation

    Explanation: NIST states: "The property that data has not been altered in an unauthorized manner." The unauthorised change violates data integrity. Retrieval remains possible; disclosure and denial of an action are different issues.

    Reference: NIST An Introduction to Information Security — Section 1.4, Data Integrity