ISC2 CC Practice Test

Answer: D
Containment aims to limit the scope and impact of an incident, and isolating infected hosts (e.g., network segmentation or disconnection) directly stops further spread while preserving evidence for analysis. Deleting logs destroys evidence needed for root-cause analysis and is never appropriate during containment. Public announcements before investigation and legal/communications review can cause reputational and legal harm and are not a containment action. Restoring from backup without analysis risks reintroducing the same vulnerability or malware and belongs to the recovery phase, which should follow eradication, not replace containment.

Answer: D
Option D is correct: a virus attaches to a host file or program and needs a user to open or run it, while a worm is self-contained and exploits network services to copy itself between systems without any user action. Option A reverses the two definitions. Option B describes ransomware and spyware or keyloggers, which are classified by their payload behavior, not by how they propagate. Option C describes a Trojan horse (malware disguised as legitimate software) and a backdoor; neither term is defined by self-propagation, which is the distinguishing trait of a worm.

Answer: C
Option C is correct: the data lifecycle ends with destruction, and NIST SP 800-88 Rev. 1 describes clearing, purging or destroying media so the information is unrecoverable; data kept past its retention period is a liability in a breach and may violate regulations that require deletion. Option B is wrong because indefinite retention keeps the exposure indefinitely, and 'might be useful someday' is not a lawful retention purpose. Option D is wrong because moving data to an unsecured tier lowers protection without ending the exposure. Option A is wrong because deleting an index leaves the files recoverable and discoverable while creating a false record that disposal occurred.

Answer: A
Encryption at rest renders stored data unreadable without the decryption key, protecting confidentiality even if physical files are exfiltrated. Network segmentation limits lateral movement but does not protect copied files. MFA strengthens authentication to systems but does nothing once files are already off the disk. Vulnerability scanning finds weaknesses but does not itself protect data confidentiality.

Answer: C
Option C is correct: data is described as at rest (stored on disk, tape or other media), in transit (moving across a network) and in use (being processed in memory), and each state calls for a different protection, such as storage encryption, TLS or IPsec, and memory protections. Option B lists cryptographic operations applied to data, not the states data can be in. Option D lists classification levels, which describe how sensitive data is rather than where it is at a given moment. Option A lists data formats, which matter for storage and analysis but are not the three security states.

Answer: A
Option A is correct: a cryptographic hash such as SHA-256 (FIPS 180-4) is a one-way, deterministic function that yields a fixed-length digest; any change to the input changes the digest, and the input cannot practically be recovered from it, which is why recomputing and comparing hashes detects tampering. Option B is wrong because hashing is not encryption; the file remains readable and no key is involved. Option C is wrong because a hash cannot be expanded back into the original; it is not compression. Option D is wrong because a hash is not reversible by any key; digital signatures sign a hash, they do not reverse it.

Answer: B
Option B is correct: symmetric algorithms such as AES (FIPS 197) use one shared key and are fast, but every party needs that key securely; asymmetric algorithms such as RSA use a public/private pair, which solves distribution but is slow, so protocols like TLS use asymmetric operations to agree a symmetric session key. Option A reverses the two families. Option D is wrong because symmetric keys are not derived from the plaintext and their distribution is the central key-management problem, while asymmetric pairs are long-lived. Option C is wrong because AES is the standard choice for encrypting data at rest, such as full-disk and database encryption.

Answer: A
Option A is correct: NIST SP 800-61 Rev. 2 defines the incident response life cycle as preparation; detection and analysis; containment, eradication and recovery; and post-incident activity, in that order. Option C is wrong because containment cannot begin before an incident has been detected and analyzed. Option D is wrong because preparation (tools, training, plans) must exist before any detection is possible; it is the first phase. Option B is wrong because containment must precede eradication and recovery; removing the cause before bounding the spread lets the incident continue elsewhere.

Answer: C
Option C is correct: a security operations center is the monitoring and first-response function; it watches alerts around the clock, separates true events from noise, responds to routine ones and escalates those that need the wider incident response team (NIST SP 800-61). Option A is wrong because writing policy is a governance activity for security leadership, not a monitoring function. Option B is wrong because financial and compliance audits belong to internal audit. Option D is wrong because approving changes is the role of change management and the change advisory board; a SOC may be consulted but does not own approvals.

Answer: B
Option B is correct: NIST SP 800-40 Rev. 4 calls for testing patches in a representative non-production environment and then deploying them on a timeline set by severity and exposure, so the organization balances the risk of an outage against the risk of exploitation. Option A is wrong because vendor testing cannot cover an organization's own dependencies; untested patches have caused outages. Option C is wrong because a critical vulnerability cannot wait for a quarterly window; severity drives the timeline. Option D is wrong because incident history has no bearing on whether a system carries the vulnerability, and every affected system needs the patch.

Answer: A
Option A is correct: an alert on activity that turns out to be benign is a false positive, and a high false-positive rate causes alert fatigue, in which analysts tune out or close alerts without investigation and genuine intrusions slip through (NIST SP 800-94). Option B is wrong because a false negative is malicious activity that generated no alert; here an alert did fire and the activity was legitimate. Option C is wrong because a true positive is an alert on activity that really was malicious. Option D is wrong because a true negative means benign activity correctly produced no alert, whereas in this case an alert was raised.

Answer: D
SP 800-12 says issue-specific policies address areas of current relevance, instruct employees on proper usage, are written for each technology the organization uses, and must be reviewed regularly because technology changes quickly. Program policy is the high-level document creating the security program and assigning responsibility. System-specific policy sets security objectives and operational rules for one system. Regulatory obligations are inputs to policy, not a policy tier.

Answer: A
Pearson VUE charges a reschedule fee of U.S. $50 for changing an existing appointment. Rescheduling is not free; a specific fee applies. $199 is the exam registration price, not the reschedule fee, and conflating the two overstates the cost. $100 is actually the cancellation fee amount, not the reschedule fee, so this choice confuses the two distinct charges.

Answer: A
CIS defines IG1 as essential cyber hygiene, the foundational set of Safeguards every enterprise should implement regardless of size or resources, which fits a twelve-person nonprofit. IG2 adds Safeguards for organizations with more resources and greater risk exposure. IG3 is the full set for organizations with mature programs and targeted threats. CIS Benchmarks are separate documents giving prescriptive configuration settings for products, not a substitute for the Controls.

Answer: A
CIS Benchmarks are prescriptive configuration recommendations developed by consensus for specific vendor product families, exactly the setting-level guidance a server build needs. The CIS Controls are prioritized program-level safeguards, not per-product settings. The NIST CSF organizes cybersecurity outcomes at a high level and deliberately names no product settings. An acceptable use policy governs how staff may use systems, not how a server is configured.

Answer: A
Option A is correct: ISC2's member policies state that members who hold only the CC certification pay an Annual Maintenance Fee of U.S. $50, due on the certification cycle start date and each anniversary. Option B is wrong because U.S. $135 is the AMF for members holding any other ISC2 certification, such as the CISSP, not for CC-only members. Option C is wrong because the AMF is not waived; a CC holder who does not pay it faces suspension after the 90-day grace period. Option D is wrong because the AMF is a small fixed fee and is not tied to the U.S. $199 exam registration price.

Answer: D
Members are given a 90-day period from the due date to pay their AMF before facing further consequences. A 10-day period significantly understates the actual grace period granted. Certification is not revoked immediately on the due date; a defined grace period exists first. A full 12-month grace period substantially overstates the actual 90-day window.

Answer: A
The registration price for the CC exam is U.S. $199. $50 is actually the Annual Maintenance Fee amount, not the exam registration price, so this choice confuses two separate fees. $349 overstates the actual registration cost. $700 corresponds to the passing score value, not a dollar fee, and using it as a price is a clear mismatch.

Answer: A
Accounting is the A in AAA that tracks and records what an identity does once it is on the system, so the delete entry tying the command to an account is an accounting output. Authentication happened earlier, at sign-in. Authorization happened when the account was allowed to run the command. Attestation is a trusted-computing measurement of platform state, not a user activity record.

Answer: C
NIST SP 800-122 defines PII as any information that can be used to distinguish or trace an individual's identity, naming name, Social Security number and date of birth as examples, so the file is PII on its own. Financial data is not a precondition. It does not need to be joined to another system, since the identifiers already single out a person. Consent governs lawful use but does not remove the data from the PII definition.

Answer: C
NIST SP 800-39 describes four components, and framing risk comes first: it produces the risk management strategy stating how the organization intends to assess, respond to and monitor risk, including its assumptions and tolerances. Assessing identifies threats and impacts within that frame. Responding selects a course of action once risk is known. Monitoring tracks effectiveness afterwards, so none of the three can precede framing.

Answer: C
NIST lists accepting, avoiding, mitigating, sharing and transferring as the available risk responses; insurance moves the financial consequence to the insurer, which is transfer. Avoidance would mean no longer taking card payments at all. Mitigation would mean adding controls to reduce likelihood or impact, which the retailer rejected as impractical. Acceptance would mean carrying the loss itself, which the policy is bought to prevent.

Answer: C
Avoidance means not engaging in the activity that gives rise to the risk, and cancelling the passport-storage feature removes the exposure at its source. Acceptance would mean shipping the feature and living with the consequences. Mitigation would mean shipping it with controls such as encryption and short retention. Transfer would mean contracting or insuring the exposure to another party, which no cancellation does.

Answer: C
NIST defines residual risk as the portion of risk remaining after security measures have been applied, which is precisely what the assessor describes. Inherent risk is the exposure before controls, measured earlier. Risk appetite is a leadership statement about how much risk the clinic will take, not a measurement of what remains. Total risk describes the whole identified population, not the post-control remainder.

Answer: B
Risk appetite is the broad amount and type of risk an organization is willing to pursue, while risk tolerance is the specific level of variation it will withstand for a particular objective, so the board set an appetite for growth and a tight tolerance on trading availability. A risk assessment is analysis, not a leadership boundary. A register records identified risks. Transfer and acceptance are responses chosen after risk is known.

Answer: B
NIST SP 800-30 recognizes quantitative, qualitative and semi-quantitative approaches; ranking risks high, moderate or low from judgment is qualitative, which is fast and easy to discuss but resists precise comparison. Quantitative approaches express risk in measurable amounts and need loss data the charity does not have. Semi-quantitative uses bins, scales or representative numbers, a middle path not described here. Continuous monitoring tracks controls already in place.

Answer: D
NIST SP 800-30 sorts threat sources into adversarial, accidental, structural and environmental; a cooling unit that fails is a failure of environmental controls or equipment, which the taxonomy places under structural. Adversarial requires an actor with capability and intent. Accidental covers mistakes made by users or administrators, and nobody acted here. Environmental covers natural and man-made disasters such as fires, floods and storms, not an internal equipment failure.

Answer: B
NIST SP 800-12 describes policy as the broad statement of intent, with standards specifying the uniform technologies or parameters to be used and procedures giving the detailed steps for carrying a task out, which matches the encryption rule, the named algorithm and the click-by-click instructions. The other orders invert that hierarchy. A guideline differs again: it offers recommended, non-mandatory practice rather than a required setting or step.

Answer: B
CSF 2.0 names six Core Functions, and GOVERN is defined as establishing, communicating and monitoring the organization's cybersecurity risk management strategy, expectations and policy. IDENTIFY develops understanding of assets, suppliers and risks. PROTECT applies safeguards to manage those risks. RESPOND covers the actions taken once an incident is detected, and RECOVER restores what the incident affected.

Answer: B
The CC outline divides cybersecurity controls into technical, administrative and physical. A required training course is administrative because it is a management practice directed at people, disk encryption is technical because it is implemented in the system, and a badge-controlled door is physical because it restricts bodily access to a space. The other orderings misplace at least one of the three, most often calling encryption a physical measure.

Answer: A
ISC2 states that members are obligated to follow the ethics complaint procedure upon observing any action by a member that breaches the Code, and that failing to do so may itself be treated as a breach under Canon IV. The client is not the only party who may act. The canons never forbid reporting; Canon IV is about advancing and protecting the profession. Nothing in the procedure requires waiting for a demonstrated loss first.

Answer: B
ISC2 limits standing by canon: any member of the public may complain about a breach of Canons I or II, only principals in an employer or contractor relationship may complain about Canon III, and only other certified or licensed professionals bound by a code of ethics may complain about Canon IV. That makes the public complaint a Canon I or II matter and the former employer's service complaint a Canon III matter, and it rules out the options that widen or swap those rights.

Answer: A
Option A is correct: integrity is the assurance that data is accurate and has not been altered without authorization, and changing invoice amounts in transit corrupts that data directly. Option B describes an availability failure; a volumetric DDoS makes the service unreachable but changes no data. Option C is a confidentiality breach: information is read by someone not authorized to see it, while the files themselves remain unchanged. Option D is a weakness in a physical control that exposes the tape to theft or copying, again a confidentiality (and possibly availability) risk rather than an alteration of data.

Answer: C
Option C is correct: the current ISC2 CC exam outline (effective September 1, 2026) organizes the exam into five domains: Security Principles (24%), Security Governance (17.3%), Identity and Access Management (IAM) Concepts (20%), Networking and Cloud Security Concepts (21.3%), and Security Operations and Incident Response (17.3%). Option A is wrong because four would drop one of the five weighted domains. Option D and Option B are wrong because seven and ten overstate the count; the CISSP, not the CC, is the ISC2 exam with eight domains, and no ISC2 outline has ten.

Answer: C
Option C is correct: on the current ISC2 CC exam outline (effective September 1, 2026), Security Principles carries 24%, the largest single weighting of the five domains. Option D is wrong because Networking and Cloud Security Concepts is the second-largest domain at 21.3%. Option B is wrong because Identity and Access Management (IAM) Concepts is weighted at 20%, third of the five. Option A is wrong because Security Operations and Incident Response is weighted at 17.3%, tied with Security Governance for the smallest share. Earlier editions of the outline weighted Security Principles at 26%, which is why older study materials give that figure.

Answer: A
Option A is correct: integrity is the property that data has not been modified or destroyed in an unauthorized manner (FIPS 199), and preventing unauthorized changes to medication records protects exactly that. Option B is wrong because confidentiality is violated when an unauthorized person reads the record, not when it is altered. Option C is wrong because availability concerns whether the record can be reached when a clinician needs it, which the control does not address. Option D is wrong because non-repudiation is about proving who performed an action; it supports integrity investigations but is not one of the three CIA triad elements.

Answer: B
Option B is correct: non-repudiation is the assurance that the sender of information is provided with proof of delivery and the recipient with proof of the sender's identity, so neither can later deny having processed it (NIST SP 800-53 AU-10). A digital signature made with a private key only the employee holds is the classic mechanism. Option A describes availability, which has nothing to do with proving who acted. Option C describes confidentiality; keeping the approval secret does not stop the approver from denying it. Option D describes integrity; a hash proves the record was not altered but does not by itself bind the action to a specific person.

Answer: B
Option B is correct: modern privacy laws such as the EU GDPR and the California Consumer Privacy Act grant individuals the right to access the personal data held about them, to have inaccuracies corrected, and in defined circumstances to have it erased (the GDPR's right to erasure is subject to legal retention duties). Option A is wrong because no privacy regime grants individuals access to an organization's source code. Option C is wrong because budget approval is an internal governance matter, not a data-subject right. Option D is wrong because privacy law regulates how data is used and protected; it does not create a revenue-sharing entitlement.

Answer: A
Option A is correct: an acceptable use policy defines what users may and may not do with organizational systems, networks and data, and states the consequences of violation; NIST SP 800-53 PL-4 (rules of behavior) requires users to acknowledge it before receiving access. Option B describes configuration standards or secure baselines (CM-2, CM-6), which are technical documents aimed at administrators. Option C describes a disaster recovery plan (CP-2). Option D describes procurement or approved-vendor policy, which governs purchasing rather than user behavior.

Answer: A
Option A is correct: NIST SP 800-30 Rev. 1 defines a threat as any circumstance or event with the potential to adversely impact operations or assets, a vulnerability as a weakness that a threat source could exploit, and risk as a measure of the extent to which the organization is threatened, combining likelihood and impact. Option B swaps the terms: the weakness is the vulnerability and the actor is the threat source. Option C confuses risk with its components and with the control that treats it; loss and likelihood are inputs to risk, not definitions of threat and vulnerability. Option D is wrong because the three are distinct, and a risk exists only when a threat can reach a vulnerability.

Answer: B
Authorization determines what an already-authenticated user is permitted to do, such as access a specific file, which matches the described second step. Authentication is the process of verifying identity (the login itself), which already occurred before this step. Identification is merely claiming an identity, such as entering a username, which precedes both authentication and authorization. Accounting (or auditing) refers to logging and tracking user activity after access is granted, not determining permission itself.

Answer: B
Option B is correct: logging in is authentication (proving the claimed identity), being granted specific folders is authorization (deciding what that identity may do), and recording the actions is accounting, the three A's of access control. Option A is wrong because encryption protects data rather than deciding or recording access, and identification (claiming a username) is only the first step before authentication. Option C is wrong because it substitutes encryption for accounting, so nothing in that triple records what the user did. Option D is wrong because registration, validation and archiving are records-management terms, not the access-control processes described.

Answer: B
Option B is correct: controls are classified by how they are implemented (physical, technical or administrative) and separately by what they do (deterrent, preventive, detective, corrective, compensating). A fence, a badge reader and a guard are all physical controls, and a guard can deter, prevent and detect at once. Option A is wrong because technical controls are implemented in hardware or software logic such as firewalls and access control lists, and a fence does nothing corrective. Option C is wrong because administrative controls are policies, procedures and training, not barriers or people at a door. Option D is wrong because being hardware does not make a fence technical; physical controls protect facilities and equipment regardless of the mechanism, and a guard is still a physical control.

Answer: A
Option A is correct: issuing a badge and escorting the visitor applies need-based, supervised access, which NIST SP 800-53 PE-3 (physical access control) requires for visitors; the visitor is authorized to be present but not to roam. Option B is wrong because identification establishes who is present, not what they can safely reach; the risk continues throughout the visit. Option C is wrong because PE-8 requires visitor access records; an escort's memory is not an auditable log. Option D is wrong because visitor badges must be visually distinct and time-limited precisely so they do not confer employee-level access.

Answer: C
Option C is correct: the ISC2 CC exam outline states that the CC exam uses Computerized Adaptive Testing (CAT), in which the difficulty of subsequent items is adjusted to the candidate's performance on earlier ones. Option B is wrong because a linear fixed form presents the same static set of items in a set order to every candidate and does not adapt. Option D is wrong because the CC uses multiple-choice and advanced item types, not hands-on lab simulations. Option A is wrong because the CC is a closed-book, proctored exam delivered at Pearson VUE testing centers, not an essay or open-book assessment.

Answer: A
NIST defines confidentiality as preserving authorized restrictions on information access and disclosure; an unauthorized recipient reading the account numbers is exactly that loss. Integrity is guarding against improper modification, and nothing in the file was altered. Availability is timely, reliable access, and the records remain reachable. Non-repudiation concerns proving who performed an action, which the mail server's logs still support.

Answer: C
NIST defines availability as ensuring timely and reliable access to and use of information, and a six-hour outage denies exactly that. Integrity was untouched because no record was altered or destroyed. Confidentiality was untouched because no unauthorized party saw anything. Privacy concerns how personal data about individuals is handled, which a power failure does not affect.

Answer: D
Separation of duties splits critical tasks between multiple people so that no single individual can complete a sensitive process alone, reducing fraud risk, exactly as described. SSO is an authentication convenience allowing one login to access multiple systems and has nothing to do with dividing responsibilities. Federated identity management allows identity trust across organizational boundaries, unrelated to task segregation. DAC lets resource owners assign access at their discretion, which does not by itself enforce a two-person process control.

Answer: A
RBAC grants permissions according to predefined roles that map to job functions, simplifying administration by assigning users to roles rather than individually. MAC assigns access based on data classification labels and clearance levels set by a central authority, not job titles. DAC allows the resource owner to grant access at their own discretion, rather than through predefined organizational roles. Rule-based access control applies specific conditional rules like time-of-day, which is narrower than and distinct from role-based job function mapping.

Answer: B
Option B is correct: least privilege gives each identity only the access its duties require, and read-only for the clerk versus read/write for the manager is exactly that tailoring (NIST SP 800-53 control AC-6). Option A is wrong because separation of duties would split a single sensitive process, such as initiating and approving a payment, between two people; here each person performs their own whole task. Option C is wrong because non-repudiation proves who performed an action after the fact and does not define what anyone may access. Option D is wrong because defense in depth is about stacking independent control layers, not about scoping one permission set to a job.

Answer: B
Option B is correct: requiring two employees to authorize a large transfer is separation of duties (NIST SP 800-53 AC-5), which splits a sensitive process so that fraud requires collusion rather than one person's decision. Option A is wrong because least privilege scopes what each account may access; it does not require a second person to act. Option C is wrong because defense in depth layers different kinds of controls (network, endpoint, access); a two-person rule is a single administrative control. Option D is wrong because fail secure describes how a system behaves when a control fails, not how a normal transaction is approved.

Answer: A
Option A is correct: in mandatory access control the system compares the object's classification label with the subject's clearance under a policy set by a central authority, and the owner cannot override it (NIST SP 800-53 AC-3(3), mandatory access control). Option C describes discretionary access control, where the owner decides who may access a file. Option B describes group-based administration typical of RBAC or Windows ACLs, not label comparison. Option D describes attribute-based access control, which evaluates many attributes and policies rather than a single clearance-versus-classification rule.

Answer: D
Option D is correct: NIST SP 800-63B defines the three authentication factors as something you know, something you have and something you are; a smart card is a possession factor and the PIN is a knowledge factor, so the two together are genuine multi-factor authentication. Option C is wrong because a memorized PIN is a knowledge factor, not a second possession factor, so the combination is not single-factor. Option B is wrong because the card is a physical object that must be presented, not a number that is typed, so it is not a second knowledge factor. Option A is wrong because nothing in the scenario is biometric; 'something you are' would be a fingerprint or face scan.

Answer: A
Option A is correct: forcing cached credentials to expire on a schedule limits how long a stolen laptop remains usable, and lockout monitoring surfaces the failed and anomalous attempts that follow a theft (NIST SP 800-53 AC-7 unsuccessful logon attempts, IA-5 authenticator management). Option B is wrong because split tunneling only decides which traffic is routed through the tunnel; the stolen credentials still authenticate. Option C is wrong because a longer idle timeout keeps a hijacked session alive longer, increasing exposure. Option D is wrong because removing lockout eliminates the control that detects and slows misuse of the cached account.

Answer: B
Option B is correct: least privilege (NIST SP 800-53 AC-6) means an account holds only the rights its duties require, so scoping DBA rights to the instances that person actually supports is the textbook application. Option C is the opposite of least privilege; domain-wide administrator rights expose every server to one compromised account. Option A violates accountability and non-repudiation because a shared generic account cannot be traced to an individual, and it also gives each holder more access than their own duties need. Option D ignores the periodic access review (AC-2) that keeps privileges aligned with duties; rights that never change accumulate privilege creep as roles evolve.

Answer: A
Option A is correct: in role-based access control permissions are attached to roles that mirror job functions, and users acquire permissions only through role membership, so a job change is a role reassignment rather than an audit of individual grants (NIST SP 800-53 AC-2(7)). Option D describes user-based (per-account) administration, which RBAC exists to replace. Option B describes discretionary access control, where the owner decides each request. Option C describes mandatory access control, where system-enforced labels on subjects and objects determine access and users cannot override them.

Answer: A
Option A is correct: NIST SP 800-63B groups authenticators into knowledge (something you know, such as a PIN or password), possession (something you have, such as a hardware token or smart card) and inherence (something you are, such as a fingerprint or face). Option B is wrong because a fingerprint is a biometric characteristic, not an object you possess, and a token is not part of your body. Option C is wrong because a fingerprint is not memorized information and a PIN is not a biometric. Option D is wrong because a token is a physical object you have, while the PIN is the memorized secret you know.

Answer: C
Option C is correct: the identity and access lifecycle runs from provisioning through changes to deprovisioning, and NIST SP 800-53 AC-2 requires accounts to be disabled or removed when the user leaves; an account still active three weeks later is a deprovisioning failure. Option A is wrong because password rules govern the strength of a credential, not whether an account should exist at all. Option B is wrong because segmentation limits where traffic can flow; it is not an account-management process and would not remove a departed user's access. Option D is wrong because classification labels data by sensitivity and does not revoke anyone's rights.

Answer: C
Option C is correct: credential stuffing takes username and password pairs leaked from one breached service and replays them automatically against many other services, which only works when people reuse passwords; NIST SP 800-63B requires checking passwords against known-breached lists for the same reason. Option A is wrong because brute force attacks a single account by exhaustive guessing, which password length and lockout address. Option B is wrong because shoulder surfing captures one password by observation regardless of whether it is unique. Option D is wrong because a keylogger records whatever is typed; uniqueness does not stop the capture, endpoint protection does.

Answer: B
Option B is correct: single sign-on lets one authentication at the identity provider open every federated application, which reduces password fatigue and lets the organization enforce strong MFA in one place, but it concentrates risk because one stolen credential or session reaches everything (NIST SP 800-63C, federation). Option D is wrong because SSO centralizes authentication at the identity provider rather than distributing it. Option A is wrong because the user still authenticates, once, to the identity provider, which then asserts the identity to each application. Option C is wrong because tokens and the identity-provider credential can themselves be stolen or phished.

Answer: A
NIST SP 800-34 defines the BIA as the step that characterizes system components, the mission processes they support and their interdependencies, and it is what recovery objectives are derived from. A disaster recovery plan is written later and describes restoration at an alternate site. An after-action review looks backwards at an exercise already held. A crisis communications plan handles internal and external messaging during a disruption.

Answer: D
RTO defines the maximum acceptable time to restore a system or process after a disruption, matching the 4-hour resumption target described. RPO instead measures the maximum acceptable amount of data loss measured in time, not restoration speed. MTBF is a reliability metric estimating average time between equipment failures, unrelated to recovery targets. An SLA uptime percentage describes ongoing availability commitments, not a one-time recovery deadline after a disaster.

Answer: C
RPO specifies the acceptable amount of data loss measured as a point in time, and a 15-minute tolerance directly matches that definition, implying backups or replication must occur at least that frequently. RTO instead measures how quickly systems must be restored, not how much data can be lost. MTD represents the total time a business function can be disrupted before causing unacceptable harm, a broader concept than a single data-loss tolerance. A BCP activation threshold refers to criteria for declaring a disaster, not a data-loss metric.

Answer: C
NIST describes information security governance as establishing and maintaining a framework and supporting management structure and processes that assure security strategies align with business objectives, stay consistent with laws and regulations through policies and internal controls, and assign responsibility, all to manage risk. A control catalog, a testing schedule and an incident ledger are useful artifacts produced under governance, but none of them establishes the structure, alignment or accountability that the definition requires.

Answer: C
Option C is correct: a differential backup captures everything changed since the last full backup, so Thursday's differential already contains Monday through Thursday's changes and only it plus the Sunday full are needed. Option B describes an incremental scheme, where each backup holds only the changes since the previous backup of any type and every set from Monday to Thursday must be restored in order. Option D is wrong because a differential holds only changes; without the full backup the unchanged files are missing. Option A is wrong because the Sunday full alone omits four days of changes.

Answer: D
Option D is correct: the 3-2-1 rule calls for three copies of the data (production plus two backups), on two different media types so a single technology fault cannot destroy both, with one copy offsite so a fire, flood or ransomware event at the primary site cannot reach it. Option A is wrong because the rule sets copy counts and locations, not a backup frequency or testing cadence. Option B is wrong because retention periods and staffing are not part of the rule. Option C is wrong because the rule does not prescribe a mix of full, differential and incremental jobs.

Answer: C
Option C is correct: NIST SP 800-34 Rev. 1 describes the business continuity plan as sustaining mission and business processes during and after a disruption, while the disaster recovery plan is the IT-focused plan for restoring systems, applications and data at an alternate site. Option A reverses the two scopes. Option B is wrong because both plans address any cause of disruption; the split is business processes versus IT systems, not natural versus cyber events. Option D is wrong because they are distinct plans with different owners and scope, and disaster recovery is one component within the broader continuity program.

Answer: C
Option C is correct: a message impersonating the chief executive to pressure an employee into buying gift cards is social engineering; in NIST SP 800-61 terms it is a phishing (here spear-phishing or business email compromise) attack that exploits authority and urgency to short-circuit verification. Option A is wrong because nothing indicates the executive's password was guessed; the sender address is spoofed or look-alike. Option B is wrong because no service is being overloaded; the mail is delivered normally. Option D is wrong because the attack targets the recipient's judgment, not a vulnerability in the mail server.

Answer: C
Option C is correct: clean desk and screen-lock rules are administrative controls against the exposure created by physical presence; NIST SP 800-53 AC-11 (device lock) and the PE family exist because a visitor, contractor or coworker walking past can read a screen or pick up a document. Option D is wrong because internet-based intrusion is addressed by firewalls, patching and hardening, not by what is left on a desk. Option A is wrong because email malware is addressed by filtering, endpoint protection and awareness of attachments, not screen locking. Option B is wrong because backup media failure is addressed by backup verification and redundancy, and the policies do not make desk papers a backup.

Answer: D
Option D is correct: NIST SP 800-50 Rev. 1 treats awareness and training as a control layer aimed at people, who are targeted directly by social engineering that no technical control fully blocks, and requires it to be ongoing because attack techniques evolve and staff turn over. Option A is wrong because trained users still make mistakes; awareness complements filtering and endpoint controls rather than replacing them. Option B is wrong because a single onboarding session decays over time and misses new threats and new hires. Option C is wrong because phishing and pretexting target finance, HR and executives at least as often as technical staff.

Answer: B
Maximum tolerable downtime is the amount of time a mission process can be disrupted without causing significant harm, so the eight-hour limit is the MTD, and the six-hour restoration commitment is the recovery time objective, which must fall within it. A recovery point objective measures tolerable data loss, not elapsed downtime. Mean time to repair is an observed average, not a stated limit. A service level agreement is a contract that may carry these figures but is not itself one.

Answer: A
SP 800-34 describes hot sites as locations with fully operational equipment and capacity to take over system operations quickly after loss of the primary facility, which is what a two-hour target demands. Cold sites offer only space and environmental controls such as power and HVAC, so standing one up takes days. Warm sites hold partial equipment but still need data restoration and configuration. A reciprocal agreement with another organization gives no guaranteed capacity at that speed.

Answer: C
SP 800-34 lists reciprocal agreements alongside dedicated and commercially leased sites as alternate site options, but the reciprocal partner keeps running its own operations and holds no reserved capacity, so a regional event can leave both agencies without room. Such agreements are commonly used in the public sector, so legality is not the issue. A BIA is still required to set recovery priorities. No recovery point objective is implied by the agreement itself.

Answer: B
SP 800-34 says the crisis communications plan documents internal and external communication procedures and typically designates specific individuals as the only authority for providing information to the public, which is exactly the requirement. The occupant emergency plan covers life-safety response inside a facility, such as evacuation or shelter-in-place. An information system contingency plan restores a single system. A continuity of operations plan sustains essential functions, often from an alternate location.

Answer: D
In the NIST contingency planning family, disaster recovery addresses restoring systems and infrastructure after a major disruption, typically at an alternate site, while continuity of operations addresses sustaining the organization's essential functions through the same event. Swapping the two, so that disaster recovery sustains essential functions and continuity of operations restores infrastructure, inverts their scopes. The cause of the disruption does not determine which plan applies, so the cyber-versus-natural split is wrong. Ownership of the document is an organizational choice, not the defining difference in scope.

Answer: B
An incremental backup captures only the files created or changed since the last backup of any type, so recovery needs the last full backup plus every incremental taken since it, applied in order. Incrementals are not merged into the full set, so Saturday alone would lose four days of work. The cumulative behavior described in the other options belongs to differential backups, which store everything changed since the last full backup and therefore need only one media set.

Answer: A
CISA's ransomware guidance directs organizations to maintain offline, encrypted backups of critical data and to test their availability and integrity regularly, precisely because many variants seek out and delete or encrypt any backups they can reach. Longer retention on a reachable share leaves the copies in the malware's path. More frequent backups to the same mounted volume multiply the copies at risk. Compression delays nothing meaningful and does not protect the files.

Answer: A
A component whose failure alone halts the service is a single point of failure, and redundancy with automatic failover to a standby path removes it, since failover switches to a redundant system on failure of the active one. Residual risk is what remains after controls and names no design defect. A recovery point objective measures tolerable data loss, not hardware dependence. Restricting closet access addresses tampering, not the switch failing on its own.

Answer: D
An uninterruptible power supply has an internal battery that lets connected devices keep running for at least a short time when the primary power source is lost, which covers ninety-second dips without a restart. A cold site is for extended disasters and would take far longer to occupy than the outage lasts. Backups help recover lost data but do not prevent the restart. A utility credit compensates for an outage without keeping the server up.

Answer: D
Mirroring is a high availability measure, a failover feature ensuring availability during device or component interruptions, but a deletion or corruption is replicated to both copies instantly, so retained backups are still required. Mirroring provides no confidentiality and does not replace encryption. It is not a retention mechanism and cannot by itself meet a recovery point objective. Non-repudiation depends on signatures and logs, which replication does not provide.

Answer: B
NIST SP 800-50 frames awareness and training as an organization-wide learning program that includes role-based training and other workforce education, so staff with privileged duties get instruction tied to those duties rather than only the general course. Repeating the same general material addresses no role-specific gap. An acknowledgment records completion without teaching anything. Phishing simulations address a different behavior entirely and would not correct privileged-access errors.

Answer: B
CISA's guidance is to recognize the signs of phishing, resist the temptation to click, report the message using the report option or button, and then delete it without replying or clicking anything, including an unsubscribe link. Opening the link even in a private window still contacts attacker infrastructure. Replying confirms the address is live and invites further targeting. Using unsubscribe does the same and can itself deliver malicious content.

Answer: B
CISA describes vishing as the social engineering approach that leverages voice communication to entice a victim to call a number and divulge sensitive information, and smishing as a form of social engineering that exploits SMS text messages, so the voice call is vishing and the text message is smishing, and swapping those two labels is the common error. Pharming redirects traffic to a fraudulent site and spoofing falsifies an address, neither of which is a phone call. A logic bomb and a worm are malware, not messages.

Answer: A
CISA advises creating long, random, unique passwords with a password manager, calling it one of the easiest ways to protect accounts, precisely because nobody can memorize a unique strong password for every account. Reusing one passphrase means a single breach exposes every account through credential stuffing. A written list in a shared workspace is readable by anyone with physical access. Short passwords remain quick to crack no matter how often they rotate.

Answer: A
Option A is correct: segmenting device groups into separate VLANs with restricted inter-VLAN routing means a compromised IoT device or guest laptop can reach only its own segment, which contains lateral movement and limits the blast radius (NIST SP 800-53 SC-7 boundary protection). Option B is wrong because bandwidth guarantees are a quality-of-service function, not a security benefit, and VLANs do not reserve bandwidth by themselves. Option D is wrong because isolation never removes the need to authenticate users; guest networks still need a captive portal or pre-shared key. Option C is wrong because a VLAN is a Layer 2 construct and has no ability to deliver or install firmware.

Answer: C
Option C is correct: defense in depth layers independent controls (firewall, intrusion detection, endpoint protection, access controls) so that an attacker who defeats one still faces the others; NIST SP 800-53 describes this as a layered protection strategy. Option A is wrong because least privilege limits the scope of each account's access, which is one control, not the layering of several. Option B is wrong because separation of duties divides a task among people; it says nothing about stacking technical safeguards. Option D is the opposite of the design shown: a single point of failure is what layered controls are meant to avoid.

Answer: A
Option A is correct: blocking everything not explicitly permitted is the default-deny (implicit deny) posture that NIST SP 800-41 Rev. 1 recommends for firewall rule sets, and the approved ports and protocols form the explicit allow list. Option B is the opposite posture: default permit lets all unknown traffic through and blocks only what is already known to be bad. Option C names a firewall technology (stateless filtering) rather than a rule-set principle; a stateless filter can be configured either default-deny or default-permit. Option D describes an architecture with no segmentation or filtering at all, which the described rule set is designed to prevent.

Answer: B
A DMZ is a network segment that exposes public-facing services to the internet while isolating them from the trusted internal network, matching the scenario exactly. A VPN concentrator is a device that terminates encrypted remote-access tunnels, not a network segmentation zone for public servers. A SAN is a dedicated storage network for block-level data access, unrelated to public/internal segmentation. A CDN origin cluster refers to the source servers behind a content delivery network, a different architectural concept from DMZ segmentation.

Answer: D
A VPN creates an encrypted tunnel over the public internet that lets remote users securely reach internal resources as if locally connected, which is exactly the stated need. A public DNS resolver only translates domain names to IP addresses and provides no secure remote access capability. An unauthenticated FTP server exposed to the internet would be insecure and is the opposite of a protective solution. NAT alone translates addresses for outbound/inbound routing but does not provide encryption or authenticated remote access by itself.

Answer: A
Option A is correct: Telnet (RFC 854) sends every keystroke, including usernames and passwords, unencrypted, so anyone capturing traffic can read them, whereas SSH (RFC 4251) encrypts and authenticates the whole session. Option B is wrong because both services run on well-known TCP ports (23 and 22) that any firewall can filter; port number is not the weakness. Option C is wrong because speed is not the reason for the change, and encryption typically adds overhead rather than removing it. Option D is wrong because Telnet does prompt for a password; the problem is that the password crosses the network in plaintext.

Answer: D
Password spraying involves trying a small number of common passwords against many different accounts to avoid account lockout thresholds, matching the described pattern of one source hitting many accounts. A DDoS attack aims to overwhelm system resources or bandwidth, not to guess account credentials. A MITM attack intercepts and potentially alters communications between two parties, which is unrelated to repeated login attempts against multiple accounts. SQL injection exploits input validation flaws in database-driven applications, not authentication login attempts.

Answer: D
A site-to-site VPN encrypts traffic between locations so that any intermediary network operator, including an ISP, sees only ciphertext and cannot read the contents. Adjusting MTU size affects packet fragmentation and performance, not confidentiality of the data. QoS prioritization manages bandwidth allocation and traffic shaping, unrelated to encryption or confidentiality. Switching address families from IPv4 to IPv6 changes addressing scheme, not the confidentiality of the payload, and provides no inherent encryption.

Answer: A
Option A is correct: NIST SP 800-94 distinguishes the two by placement and response; an inline IPS is in the traffic path and can drop or reset malicious packets, while a passive IDS analyzes mirrored traffic and can only alert. Option B reverses the placements: a SPAN or mirror port is the passive IDS deployment, and a device off the traffic path cannot block anything. Option C is wrong because both IDS and IPS products use signature-based, anomaly-based and stateful protocol analysis; detection method does not define the difference. Option D is wrong because both IDS and IPS exist in network-based and host-based forms (NIDS/NIPS and HIDS/HIPS).

Answer: B
Option B is correct: a router operates at OSI Layer 3, reads the destination IP address in the packet header, consults its routing table and forwards the packet toward the other network. Option A is wrong because a switch operates at Layer 2 and forwards frames by MAC address only within a single network segment; it does not route between networks. Option C is wrong because a hub is a Layer 1 repeater that copies signals to every port and reads no addresses at all. Option D is wrong because a modem modulates and demodulates signals for the physical access line and makes no forwarding decision.

Answer: D
Option D is correct: a stateful firewall keeps a connection (state) table of sessions it has permitted outbound and automatically allows the matching return packets, so no separate inbound rule is needed (NIST SP 800-41 Rev. 1). Option C is wrong because a stateless filter has no memory of prior packets; without an explicit inbound rule it would drop the reply. Option B is wrong because application-layer inspection examines payload content for policy violations; it is not what associates a reply with an earlier request. Option A is wrong because NAT rewrites addresses so private hosts can share a public IP, but NAT alone does not decide whether a reply is permitted; the state table does.

Answer: A
Option A is correct: a screened subnet (formerly called a DMZ) puts internet-facing hosts in their own segment with filtered paths in both directions, so an attacker who compromises the web server still faces a firewall before reaching internal systems (NIST SP 800-41 Rev. 1). Option B is wrong because placement in a screened subnet is about isolation, not address translation or performance. Option C is wrong because an exposed server needs the fastest patching of all, not an exemption. Option D is wrong because traffic to a screened subnet is inspected by the perimeter firewall; the design adds inspection between segments rather than removing it.

Answer: D
Option D is correct: the IANA service name and port number registry assigns TCP 443 to HTTPS, TCP 22 to SSH and TCP/UDP 53 to DNS. Option A is wrong because 80 is HTTP (unencrypted web), 23 is Telnet and 25 is SMTP. Option B is wrong because 21 is FTP control, 443 is HTTPS rather than SSH, and 110 is POP3. Option C is wrong because 8080 is only a common alternate HTTP port, 53 belongs to DNS, and 22 belongs to SSH. Knowing the mapping matters because firewall rules, scan results and log entries are expressed in port numbers, and the insecure services on 23 and 21 are the ones to find and retire.

Answer: D
Option D is correct: a VPN (for example IPsec, NIST SP 800-77 Rev. 1, or TLS-based) encrypts and authenticates traffic between the remote device and the corporate gateway, protecting confidentiality and integrity while it crosses an untrusted network. Option A is wrong because a VPN protects the path, not the endpoint; an infected laptop delivers its malware through the tunnel. Option B is wrong because encryption and tunnel overhead typically reduce throughput rather than increase it. Option C is wrong because traffic is decrypted at the organization's gateway, where its monitoring applies; the tunnel hides traffic from the untrusted network, not from the employer.

Answer: C
Option C is correct: flooding a server so legitimate users cannot reach it is a denial-of-service attack, and the CIA triad element it attacks is availability, since the data is neither read nor altered. Option A is wrong because a man-in-the-middle attack intercepts or alters traffic between two parties, which threatens confidentiality and integrity rather than uptime. Option B is wrong because SQL injection exploits unvalidated input to read or modify database contents; it does not work by flooding. Option D is wrong because phishing deceives a person into surrendering credentials or running malware, an attack on people rather than on a server's capacity.

Answer: D
Option D is correct: NIST SP 800-94 describes an IDS as a passive monitor that alerts and an IPS as an inline device that can block, and the inline position is why a false positive on an IPS drops legitimate traffic instead of just generating an alert. Option A reverses the roles; it is the prevention system that blocks and the detection system that only alerts. Option C is wrong because the two differ in placement (passive copy versus inline) and in response capability, not merely in branding. Option B is wrong because both come in network-based and host-based forms (NIDS/NIPS and HIDS/HIPS).