ISC2 CC Practice — Set 1 (Imported 2026-05)

1. A company is concerned about unauthorized physical access to its data center. Which of the following controls would be the MOST effective in preventing this?

2. An organization identifies that its executives are being targeted with sophisticated phishing emails attempting to obtain sensitive information. What type of social engineering attack is this an example of?

3. During a risk assessment, a security analyst determines that a critical server has a vulnerability. The likelihood of exploitation is high, and the impact would be severe. According to basic risk management principles, what should be the FIRST course of action?