ISC2 CC Practice — Set 2 (Imported 2026-05)

1. Sarah works in the HR department and needs access to employee records to process payroll. Her manager grants her access only to the payroll-related information, and she cannot view other sensitive employee data like performance reviews. Which security principle is being applied here?

2. A company implements firewalls at the network perimeter and also installs antivirus software on individual computers. This layered approach to security ensures that if one security measure fails, others are in place. What security concept does this demonstrate?

3. Mark identifies a weakness in the company's web server software that could allow unauthorized access. He reports this vulnerability to the IT department so they can apply a patch. Which step of the risk management process is Mark primarily involved in?