Pass the ISC CC Questions and answers with ValidTests

Platform as a Service (PaaS) provides customers with an environment tobuild, deploy, and manage applicationswithout managing underlying infrastructure. PaaS includes operating systems, middleware, runtime environments, and development tools.

SaaS delivers fully managed applications, while IaaS provides raw infrastructure. PaaS best balances flexibility and operational efficiency for software development.

Information riskrefers to the potential harm arising from the unauthorized access, disclosure, modification, or destruction of sensitive information. This includes credentials, financial records, intellectual property, and personally identifiable information (PII).

Information risk directly impacts theconfidentiality, integrity, and availability (CIA triad)of data. While such incidents may also lead to reputational damage or compliance violations, the primary category describing the exposure of sensitive data itself is information risk.

NIST SP 800-30 emphasizes information risk as a core component of enterprise risk management, especially in organizations that rely heavily on digital data for operations and decision-making.

The Disaster Recovery Plan (DRP) contains step-by-step technical procedures to restore IT systems, data, and infrastructure after a disruptive event. While the BCP focuses on maintaining operations, the DRP focuses onrestoration.

Asecurity breachrefers to an incident where an unauthorized individual successfully gains access to a system, application, network, or data resource. Unlike a general security event, a breach confirms that confidentiality, integrity, or availability has been compromised. According to NIST SP 800-61, a breach occurs when security controls fail and protected information is accessed, disclosed, altered, or destroyed without authorization.

Not every event or intrusion results in a breach. For example, a blocked attack detected by an IDS is an event, not a breach. A breach has legal, regulatory, and business implications, often triggering notification requirements, forensic investigations, and remediation actions.

Risk appetitedefines the level of risk an organization is willing to tolerate and guides decision-making across the enterprise.

Consistencyensures data remains uniform and synchronized across systems, databases, and backups—critical for accuracy and trustworthiness.

Authentication is the process of verifying that a user is who they claim to be. Identification occurs first (username), authentication verifies the claim (password, token, biometrics), and authorization determines access rights.

In Business Continuity Planning (BCP), the termbusinessrefers primarily to theoperational aspects of the organization—the people, processes, and activities required to deliver products and services. While IT systems, finances, and facilities support operations, BCP focuses on ensuring thatcritical business functions continueduring and after disruptions.

This includes customer service, supply chain operations, payroll, compliance activities, and decision-making processes. BCP is broader than disaster recovery, which focuses mainly on restoring IT systems. According to NIST SP 800-34, business continuity emphasizes mission-essential functions and their dependencies, including personnel, third parties, facilities, and technology.