50 Free ISC2 Certified in Cybersecurity (CC) Practice Questions

Answer: b) Ensuring data is accessible only to authorized individuals

Explanation: Confidentiality protects sensitive information from unauthorized disclosure. It's typically implemented through encryption, access controls, and classification.

Answer: b) Data should be accurate and protected from unauthorized modification

Explanation: Integrity ensures that data is accurate, consistent, and protected from unauthorized modification. Hashing, version control, and access controls help maintain integrity.

Answer: c) Firewall

Explanation: Preventive controls stop security incidents before they occur. A firewall prevents unauthorized network access. CCTV and IDS are detective controls. Log monitoring is detective.

Answer: b) A threat is a potential danger; a vulnerability is a weakness

Explanation: A threat is any potential danger that could exploit a vulnerability. A vulnerability is a weakness in a system that could be exploited.

Answer: b) Least privilege

Explanation: Least privilege ensures users have only the minimum permissions necessary to perform their job functions, reducing the potential damage from accidents or malicious actions.

Answer: a) Different people perform different parts of a sensitive task to prevent fraud

Explanation: Separation of duties prevents any single person from having too much control over sensitive processes. For example, the person who approves a payment shouldn't be the same person who processes it.

Answer: b) Administrative

Explanation: Administrative controls are policies, procedures, and training that govern behavior. Security awareness training is an administrative control that educates employees about security risks.

Answer: b) The likelihood that a threat will exploit a vulnerability, combined with the impact

Explanation: Risk = Likelihood × Impact. It's the potential for loss or damage when a threat exploits a vulnerability.

Answer: b) Risk mitigation

Explanation: Risk mitigation (or reduction) involves implementing security controls to reduce the likelihood or impact of a risk. This is the most common risk management strategy.

Answer: b) The framework of policies, procedures, and processes for managing security

Explanation: Governance establishes the framework for decision-making, accountability, and oversight of security practices. It includes policies, standards, procedures, and metrics.

Answer: b) Backup restoration

Explanation: Corrective controls fix or restore systems after an incident. Restoring from backup after a ransomware attack is corrective. Firewalls are preventive, motion detectors are detective.

Answer: a) The minimum level of security required for a system

Explanation: A security baseline defines the minimum security configurations and controls that must be applied to a system before it's deployed or connected to a network.

Answer: b) The legal concept of taking reasonable steps to protect assets

Explanation: Due care means taking reasonable and prudent steps to protect organizational assets. Failure to exercise due care can result in legal liability.

Answer: b) To guide professional conduct and decision-making

Explanation: A code of ethics (like the ISC2 Code of Ethics) provides ethical guidelines for cybersecurity professionals, covering principles like protecting society, acting honorably, and providing diligent service.

Answer: b) Preparation

Explanation: Preparation is the first phase where organizations establish incident response policies, train teams, acquire tools, and develop playbooks before incidents occur.

Answer: b) Containment

Explanation: Containment focuses on limiting the impact of an incident (e.g., isolating affected systems, blocking malicious IPs) to prevent further damage.

Answer: b) Maintaining critical business functions during and after a disruption

Explanation: BCP focuses on ensuring that essential business operations can continue during and after a disruptive event, regardless of the cause.

Answer: a) Hot site is fully operational; cold site has no equipment

Explanation: A hot site has all infrastructure ready and running (servers, networking, data synchronized), enabling immediate failover. A cold site has basic facilities but no equipment, requiring days/weeks to become operational.

Answer: b) Maximum acceptable downtime for a service

Explanation: RTO is the maximum acceptable time that a service can be unavailable after a disaster. It determines the required speed of recovery procedures.

Answer: c) Full

Explanation: A full backup copies all selected data regardless of when it was last modified. It's the slowest and largest backup but requires only one file for a complete restore.

Answer: b) Discussing and walking through response scenarios without actual system changes

Explanation: A tabletop exercise is a discussion-based session where team members walk through a hypothetical disaster scenario to identify gaps in plans and improve coordination.

Answer: b) DAC (Discretionary Access Control)

Explanation: DAC allows resource owners to set permissions on their own objects. This is common in file systems (e.g., Linux file permissions, Windows NTFS).

Answer: b) Something you know

Explanation: Passwords, PINs, and passphrases are "something you know" factors. They're the most common but also the most vulnerable to theft.

Answer: b) Password + SMS code

Explanation: True MFA requires factors from different categories. Password (something you know) + SMS code (something you have) qualifies. Options a and d use only one factor category.

Answer: b) Grant only the permissions required to perform job functions

Explanation: Least privilege restricts user access to the minimum necessary to perform their job. This limits the attack surface and reduces potential damage from compromised accounts.

Answer: b) Access based on job functions and roles

Explanation: RBAC assigns permissions to roles (e.g., "Manager", "HR Staff") rather than individuals. Users are assigned to roles, making permission management more efficient and scalable.

Answer: b) A system that allows users to authenticate once and access multiple applications

Explanation: SSO enables users to authenticate once and gain access to multiple applications without re-entering credentials. SAML, OAuth, and OpenID Connect are common SSO protocols.

Answer: b) Regularly reviewing user accounts to verify they're still needed and properly configured

Explanation: Regular account reviews ensure that accounts of former employees or contractors are disabled, permissions remain appropriate (least privilege), and no unauthorized accounts exist.

Answer: b) The accumulation of excessive permissions over time as roles change

Explanation: Privilege creep occurs when users accumulate permissions over time as they change roles or take on new responsibilities but old permissions are never removed. Regular access reviews prevent this.

Answer: b) Authenticator app (like Google Authenticator)

Explanation: TOTP authenticator apps generate time-based codes that change every 30 seconds. They're more secure than SMS-based codes (which can be intercepted via SIM swapping).

Answer: b) Creating trust relationships between organizations so users from one can access resources in another

Explanation: Federated identity allows users from one organization to use their credentials to access resources in another organization. SAML is a common federation standard.

Answer: d) ABAC (Attribute-Based Access Control)

Explanation: ABAC evaluates attributes of the subject (user role, department), object (file classification), and environment (time, location) to make access decisions.

Answer: b) Defining requirements for password creation, usage, and management

Explanation: A password policy defines requirements like minimum length, complexity, expiration, reuse restrictions, and account lockout thresholds.

Answer: c) Firewall

Explanation: A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on a defined set of security rules.

Answer: b) Protecting data in transit from interception

Explanation: Network encryption (TLS, IPsec) protects data as it travels across networks, making it unreadable to anyone who intercepts it.

Answer: b) SSH

Explanation: SSH (Secure Shell) provides encrypted remote terminal access and file transfer. Telnet and FTP are unencrypted and should be avoided.

Answer: b) Hosting public-facing services while isolating them from the internal network

Explanation: A DMZ (Demilitarized Zone) is a network segment that sits between the internet and internal network, hosting external-facing services (web, email, DNS) to prevent direct access to internal resources.

Answer: b) An encrypted tunnel for secure communication over public networks

Explanation: A Virtual Private Network (VPN) creates an encrypted connection (tunnel) between a device and a network, protecting data transmitted over public networks like the internet.

Answer: b) Dividing a network into smaller segments to improve security and performance

Explanation: Network segmentation divides a network into smaller parts (using VLANs, subnets) to isolate traffic, contain breaches, and improve security (e.g., separating guest from corporate networks).

Answer: b) Switch

Explanation: Switches operate at Layer 2 (Data Link layer) and forward traffic based on MAC addresses. Routers operate at Layer 3 (Network layer) using IP addresses.

Answer: b) A firewall that filters HTTP/HTTPS traffic to protect web applications

Explanation: A WAF filters, monitors, and blocks HTTP/HTTPS traffic to and from web applications, protecting against attacks like SQL injection, XSS, and CSRF.

Answer: b) DDoS

Explanation: A Distributed Denial of Service (DDoS) attack floods a target (server, application, network) with massive traffic from multiple sources, making it unavailable to legitimate users.

Answer: b) Monitoring network traffic and alerting on suspicious activity

Explanation: An IDS monitors network traffic for suspicious patterns and known attack signatures. It alerts administrators but does not block traffic (unlike IPS).

Answer: a) Router connects networks; switch connects devices within a network

Explanation: A router forwards data between different networks (e.g., between your LAN and the internet). A switch forwards data within the same network between devices.

Answer: b) SMTPS (SMTP over TLS)

Explanation: SMTPS uses TLS encryption to secure email transmission. Unencrypted SMTP sends emails in plaintext and should not be used.

Answer: b) A vulnerability that is unknown to the vendor and has no patch

Explanation: A zero-day vulnerability is a security flaw unknown to the software vendor, leaving no patch available. Zero-day exploits are extremely dangerous as there's no known defense.

Answer: b) Educating employees about security risks and their responsibilities

Explanation: Security awareness training ensures employees understand phishing, password security, data handling procedures, and incident reporting — reducing the human risk factor.

Answer: b) Report it to IT/security and do not plug it in

Explanation: Unknown USB drives could contain malware (USB drop attack). They should be reported to security personnel and never connected to any system.

Answer: b) Preventing sensitive information from being visible when not in use

Explanation: A clean desk policy requires employees to secure sensitive documents, lock their computers, and remove sensitive items from desks when away, preventing unauthorized access.

Answer: b) Ensuring systems are configured consistently and securely

Explanation: Configuration management maintains consistent security baselines across systems, tracks changes, and ensures systems are configured according to security standards.