CC Practice Exam.
Free practice test — 30 verified questions, instant feedback.

Answer: A
Least privilege means each user is granted only the access rights needed for their job function; the clerk gets read-only while the manager gets read/write reflects tailored authorization. Non-repudiation concerns proving an action occurred and who performed it, not access levels. Availability concerns uptime, not permission scope. Physical zoning concerns facility access, not logical record permissions.

Answer: A
Encryption at rest renders stored data unreadable without the decryption key, protecting confidentiality even if physical files are exfiltrated. Network segmentation limits lateral movement but does not protect copied files. MFA strengthens authentication to systems but does nothing once files are already off the disk. Vulnerability scanning finds weaknesses but does not itself protect data confidentiality.

Answer: A
Integrity is about the accuracy and trustworthiness of data; unauthorized modification of invoice amounts directly corrupts data integrity. A DDoS attack primarily harms availability. Viewing files without authorization is a confidentiality breach, not integrity. An unlocked cabinet is a physical control weakness that could enable a confidentiality or availability issue but is not itself an integrity violation.

Answer: A
RTO defines the maximum acceptable time to restore a system or process after a disruption, matching the 4-hour resumption target described. RPO instead measures the maximum acceptable amount of data loss measured in time, not restoration speed. MTBF is a reliability metric estimating average time between equipment failures, unrelated to recovery targets. An SLA uptime percentage describes ongoing availability commitments, not a one-time recovery deadline after a disaster.

Answer: A
RPO specifies the acceptable amount of data loss measured as a point in time, and a 15-minute tolerance directly matches that definition, implying backups or replication must occur at least that frequently. RTO instead measures how quickly systems must be restored, not how much data can be lost. MTD represents the total time a business function can be disrupted before causing unacceptable harm, a broader concept than a single data-loss tolerance. A BCP activation threshold refers to criteria for declaring a disaster, not a data-loss metric.

Answer: A
Containment aims to limit the scope and impact of an incident, and isolating infected hosts (e.g., network segmentation or disconnection) directly stops further spread while preserving evidence for analysis. Deleting logs destroys evidence needed for root-cause analysis and is never appropriate during containment. Public announcements before investigation and legal/communications review can cause reputational and legal harm and are not a containment action. Restoring from backup without analysis risks reintroducing the same vulnerability or malware and belongs to the recovery phase, which should follow eradication, not replace containment.

Answer: A
Separation of duties splits critical tasks between multiple people so that no single individual can complete a sensitive process alone, reducing fraud risk, exactly as described. SSO is an authentication convenience allowing one login to access multiple systems and has nothing to do with dividing responsibilities. Federated identity management allows identity trust across organizational boundaries, unrelated to task segregation. DAC lets resource owners assign access at their discretion, which does not by itself enforce a two-person process control.

Answer: A
RBAC grants permissions according to predefined roles that map to job functions, simplifying administration by assigning users to roles rather than individually. MAC assigns access based on data classification labels and clearance levels set by a central authority, not job titles. DAC allows the resource owner to grant access at their own discretion, rather than through predefined organizational roles. Rule-based access control applies specific conditional rules like time-of-day, which is narrower than and distinct from role-based job function mapping.

Answer: A
MAC enforces access through system-wide policy comparing data classification against user clearance, and individual owners cannot override this, which distinguishes it from discretionary models. Allowing owners to grant access describes DAC, the opposite of MAC's centralized enforcement. MAC decisions are driven by classification/clearance policy, not ad hoc helpdesk group assignments. While MAC and ABAC both involve centrally defined rules, MAC specifically centers on classification/clearance labels and the two are not identical in mechanism.

Answer: A
Authorization determines what an already-authenticated user is permitted to do, such as access a specific file, which matches the described second step. Authentication is the process of verifying identity (the login itself), which already occurred before this step. Identification is merely claiming an identity, such as entering a username, which precedes both authentication and authorization. Accounting (or auditing) refers to logging and tracking user activity after access is granted, not determining permission itself.

Answer: A
A smart card is 'something you have' and a PIN is 'something you know,' so requiring both is true multi-factor authentication spanning two different factor categories. Using two passwords would still be a single factor category ('something you know') repeated, not multi-factor. Biometrics would involve 'something you are' such as a fingerprint, which is not used here. Federated SSO concerns trusting authentication across organizational domains, not the number or type of factors used at login.

Answer: A
Periodic credential rotation combined with monitoring for anomalous or repeated failed logins reduces the window during which stolen cached credentials remain useful. Disabling logging would remove visibility needed to detect misuse, worsening the risk. Allowing unlimited login attempts removes a key control (account lockout) that helps detect and slow brute-force or misuse attempts. Removing authentication entirely eliminates the very control meant to prevent unauthorized access, directly increasing risk.

Answer: A
Least privilege means granting only the access necessary to perform one's job, so scoping DBA rights to the specific databases they manage (rather than the whole enterprise) is the correct application. Granting domain-wide admin rights for convenience is the opposite of least privilege and creates excessive risk. Shared generic accounts violate accountability and traceability principles, undermining both least privilege and non-repudiation. Never reviewing granted rights violates the ongoing access review practices that support least privilege over time (privilege creep).

Answer: A
Blocking everything by default and only permitting specifically approved traffic is the 'default deny' or implicit-deny model, which is a security best practice that minimizes the attack surface. Default permit with blacklisting only blocks known-bad traffic while allowing everything else, which is far less secure than default deny. Full mesh connectivity between zones would eliminate segmentation benefits and increase risk, the opposite of restrictive firewall rules. Disabling a firewall for performance reasons removes the control entirely and is never an appropriate trade-off for security.

Answer: A
A DMZ is a network segment that exposes public-facing services to the internet while isolating them from the trusted internal network, matching the scenario exactly. A VPN concentrator is a device that terminates encrypted remote-access tunnels, not a network segmentation zone for public servers. A SAN is a dedicated storage network for block-level data access, unrelated to public/internal segmentation. A CDN origin cluster refers to the source servers behind a content delivery network, a different architectural concept from DMZ segmentation.

Answer: A
A VPN creates an encrypted tunnel over the public internet that lets remote users securely reach internal resources as if locally connected, which is exactly the stated need. A public DNS resolver only translates domain names to IP addresses and provides no secure remote access capability. An unauthenticated FTP server exposed to the internet would be insecure and is the opposite of a protective solution. NAT alone translates addresses for outbound/inbound routing but does not provide encryption or authenticated remote access by itself.

Answer: A
Segmenting device types into separate VLANs with restricted routing contains an attacker or compromised device to a smaller portion of the network, limiting lateral movement, which is the core security benefit of segmentation. VLAN segmentation is about traffic isolation and access control, not bandwidth allocation, which is a QoS concern. Segmentation does not remove the need for authentication controls on any network, including guest Wi-Fi. VLANs are a network-layer control and have no capability to patch device firmware.

Answer: A
Telnet sends all data, including usernames and passwords, unencrypted across the network, making it vulnerable to interception, whereas SSH encrypts the entire session, protecting credentials and data. Port number has nothing to do with the security weakness being addressed; both services can be filtered by firewalls regardless of port. Performance/speed is not the reason for replacing Telnet; the concern is confidentiality of the session, not throughput. Telnet works fine over Ethernet networks; that is not a limiting factor in this decision.

Answer: A
Password spraying involves trying a small number of common passwords against many different accounts to avoid account lockout thresholds, matching the described pattern of one source hitting many accounts. A DDoS attack aims to overwhelm system resources or bandwidth, not to guess account credentials. A MITM attack intercepts and potentially alters communications between two parties, which is unrelated to repeated login attempts against multiple accounts. SQL injection exploits input validation flaws in database-driven applications, not authentication login attempts.

Answer: A
A site-to-site VPN encrypts traffic between locations so that any intermediary network operator, including an ISP, sees only ciphertext and cannot read the contents. Adjusting MTU size affects packet fragmentation and performance, not confidentiality of the data. QoS prioritization manages bandwidth allocation and traffic shaping, unrelated to encryption or confidentiality. Switching address families from IPv4 to IPv6 changes addressing scheme, not the confidentiality of the payload, and provides no inherent encryption.

Answer: A
An IPS sits directly in the traffic path (inline) so it can actively block or drop malicious packets immediately, while an IDS commonly analyzes a mirrored copy of traffic out-of-band and can only alert, not block. Neither technology is restricted to wireless networks only; both apply broadly to wired and wireless environments. Detection accuracy depends on tuning and technology, not an inherent IDS-vs-IPS advantage, so this is not a defining differentiator. IPS and IDS differ meaningfully in deployment (inline vs. passive) and response capability (block vs. alert only), so they are not interchangeable terms.

Answer: A
The CC exam contains between 100 and 125 questions, a range that reflects its computerized adaptive testing format. 50 to 75 understates the actual question range. 150 to 175 overstates the actual question range. The exam does not have a fixed exact count; the adaptive format produces a range of 100-125 items rather than exactly 100.

Answer: A
The CC exam uses multiple choice and advanced item types administered as Computerized Adaptive Testing (CAT), which adjusts subsequent question difficulty based on the candidate's performance on prior questions. A fixed-form paper exam presents the same static set of questions to every candidate and does not adapt, which is not how CC is delivered. CC is proctored at testing centers, not an open-book take-home format. The exam is administered via computer at Pearson VUE centers, not as an oral examination.

Answer: A
Pearson VUE charges a reschedule fee of U.S. $50 for changing an existing appointment. Rescheduling is not free; a specific fee applies. $199 is the exam registration price, not the reschedule fee, and conflating the two overstates the cost. $100 is actually the cancellation fee amount, not the reschedule fee, so this choice confuses the two distinct charges.

Answer: A
Members who hold only the CC certification pay an Annual Maintenance Fee (AMF) of U.S. $50. $125 overstates the actual fee amount for CC-only members. A maintenance fee is required to keep the certification active; it is not waived entirely. The AMF is a small fixed fee, not equivalent to re-paying the full $199 exam registration cost annually.

Answer: A
Members are given a 90-day period from the due date to pay their AMF before facing further consequences. A 10-day period significantly understates the actual grace period granted. Certification is not revoked immediately on the due date; a defined grace period exists first. A full 12-month grace period substantially overstates the actual 90-day window.

Answer: A
The registration price for the CC exam is U.S. $199. $50 is actually the Annual Maintenance Fee amount, not the exam registration price, so this choice confuses two separate fees. $349 overstates the actual registration cost. $700 corresponds to the passing score value, not a dollar fee, and using it as a price is a clear mismatch.

Answer: A
The CC exam is organized around 5 domains of foundational cybersecurity knowledge: Security Principles; BC/DR/IR Concepts; Access Controls Concepts; Network Security; and Security Operations. Four domains understates the officially defined structure. Seven and ten domains overstate the count; the exam blueprint defines exactly five.

Answer: A
Security Principles is weighted at 26%, the highest of the five domains, reflecting its role as the foundational domain underpinning the rest of the exam content. Network Security at 24% is the second-highest weighting, not the largest. Access Controls Concepts at 22% is weighted lower than both Security Principles and Network Security. Security Operations at 18% is the third-lowest weighting among the five domains.

Answer: A
Candidates are given 2 hours, or 120 minutes, to complete the CC exam. 90 minutes understates the allotted time by 30 minutes. 180 minutes (3 hours) overstates the allotted time. 240 minutes (4 hours) significantly overstates the official duration.