ISC2 CC Practice Test.

Answer: A
Least privilege means each user is granted only the access rights needed for their job function; the clerk gets read-only while the manager gets read/write reflects tailored authorization. Non-repudiation concerns proving an action occurred and who performed it, not access levels. Availability concerns uptime, not permission scope. Physical zoning concerns facility access, not logical record permissions.

Answer: A
Encryption at rest renders stored data unreadable without the decryption key, protecting confidentiality even if physical files are exfiltrated. Network segmentation limits lateral movement but does not protect copied files. MFA strengthens authentication to systems but does nothing once files are already off the disk. Vulnerability scanning finds weaknesses but does not itself protect data confidentiality.

Answer: A
Integrity is about the accuracy and trustworthiness of data; unauthorized modification of invoice amounts directly corrupts data integrity. A DDoS attack primarily harms availability. Viewing files without authorization is a confidentiality breach, not integrity. An unlocked cabinet is a physical control weakness that could enable a confidentiality or availability issue but is not itself an integrity violation.

Answer: A
RTO defines the maximum acceptable time to restore a system or process after a disruption, matching the 4-hour resumption target described. RPO instead measures the maximum acceptable amount of data loss measured in time, not restoration speed. MTBF is a reliability metric estimating average time between equipment failures, unrelated to recovery targets. An SLA uptime percentage describes ongoing availability commitments, not a one-time recovery deadline after a disaster.

Answer: A
RPO specifies the acceptable amount of data loss measured as a point in time, and a 15-minute tolerance directly matches that definition, implying backups or replication must occur at least that frequently. RTO instead measures how quickly systems must be restored, not how much data can be lost. MTD represents the total time a business function can be disrupted before causing unacceptable harm, a broader concept than a single data-loss tolerance. A BCP activation threshold refers to criteria for declaring a disaster, not a data-loss metric.

Answer: B
Containment aims to limit the scope and impact of an incident, and isolating infected hosts (e.g., network segmentation or disconnection) directly stops further spread while preserving evidence for analysis. Deleting logs destroys evidence needed for root-cause analysis and is never appropriate during containment. Public announcements before investigation and legal/communications review can cause reputational and legal harm and are not a containment action. Restoring from backup without analysis risks reintroducing the same vulnerability or malware and belongs to the recovery phase, which should follow eradication, not replace containment.

Answer: A
Separation of duties splits critical tasks between multiple people so that no single individual can complete a sensitive process alone, reducing fraud risk, exactly as described. SSO is an authentication convenience allowing one login to access multiple systems and has nothing to do with dividing responsibilities. Federated identity management allows identity trust across organizational boundaries, unrelated to task segregation. DAC lets resource owners assign access at their discretion, which does not by itself enforce a two-person process control.

Answer: C
RBAC grants permissions according to predefined roles that map to job functions, simplifying administration by assigning users to roles rather than individually. MAC assigns access based on data classification labels and clearance levels set by a central authority, not job titles. DAC allows the resource owner to grant access at their own discretion, rather than through predefined organizational roles. Rule-based access control applies specific conditional rules like time-of-day, which is narrower than and distinct from role-based job function mapping.

Answer: D
MAC enforces access through system-wide policy comparing data classification against user clearance, and individual owners cannot override this, which distinguishes it from discretionary models. Allowing owners to grant access describes DAC, the opposite of MAC's centralized enforcement. MAC decisions are driven by classification/clearance policy, not ad hoc helpdesk group assignments. While MAC and ABAC both involve centrally defined rules, MAC specifically centers on classification/clearance labels and the two are not identical in mechanism.

Answer: A
Authorization determines what an already-authenticated user is permitted to do, such as access a specific file, which matches the described second step. Authentication is the process of verifying identity (the login itself), which already occurred before this step. Identification is merely claiming an identity, such as entering a username, which precedes both authentication and authorization. Accounting (or auditing) refers to logging and tracking user activity after access is granted, not determining permission itself.

Answer: A
A smart card is 'something you have' and a PIN is 'something you know,' so requiring both is true multi-factor authentication spanning two different factor categories. Using two passwords would still be a single factor category ('something you know') repeated, not multi-factor. Biometrics would involve 'something you are' such as a fingerprint, which is not used here. Federated SSO concerns trusting authentication across organizational domains, not the number or type of factors used at login.

Answer: A
Periodic credential rotation combined with monitoring for anomalous or repeated failed logins reduces the window during which stolen cached credentials remain useful. Disabling logging would remove visibility needed to detect misuse, worsening the risk. Allowing unlimited login attempts removes a key control (account lockout) that helps detect and slow brute-force or misuse attempts. Removing authentication entirely eliminates the very control meant to prevent unauthorized access, directly increasing risk.

Answer: A
Least privilege means granting only the access necessary to perform one's job, so scoping DBA rights to the specific databases they manage (rather than the whole enterprise) is the correct application. Granting domain-wide admin rights for convenience is the opposite of least privilege and creates excessive risk. Shared generic accounts violate accountability and traceability principles, undermining both least privilege and non-repudiation. Never reviewing granted rights violates the ongoing access review practices that support least privilege over time (privilege creep).

Answer: A
Blocking everything by default and only permitting specifically approved traffic is the 'default deny' or implicit-deny model, which is a security best practice that minimizes the attack surface. Default permit with blacklisting only blocks known-bad traffic while allowing everything else, which is far less secure than default deny. Full mesh connectivity between zones would eliminate segmentation benefits and increase risk, the opposite of restrictive firewall rules. Disabling a firewall for performance reasons removes the control entirely and is never an appropriate trade-off for security.

Answer: A
A DMZ is a network segment that exposes public-facing services to the internet while isolating them from the trusted internal network, matching the scenario exactly. A VPN concentrator is a device that terminates encrypted remote-access tunnels, not a network segmentation zone for public servers. A SAN is a dedicated storage network for block-level data access, unrelated to public/internal segmentation. A CDN origin cluster refers to the source servers behind a content delivery network, a different architectural concept from DMZ segmentation.

Answer: A
A VPN creates an encrypted tunnel over the public internet that lets remote users securely reach internal resources as if locally connected, which is exactly the stated need. A public DNS resolver only translates domain names to IP addresses and provides no secure remote access capability. An unauthenticated FTP server exposed to the internet would be insecure and is the opposite of a protective solution. NAT alone translates addresses for outbound/inbound routing but does not provide encryption or authenticated remote access by itself.

Answer: A
Authentication proves the claimed identity, authorization determines what that identity may do, and accounting records what was done. Identification precedes authentication as the claim of who one is, so a username identifies while a password authenticates, and confusing the two obscures where a control actually applies.

Answer: A
Segmenting device types into separate VLANs with restricted routing contains an attacker or compromised device to a smaller portion of the network, limiting lateral movement, which is the core security benefit of segmentation. VLAN segmentation is about traffic isolation and access control, not bandwidth allocation, which is a QoS concern. Segmentation does not remove the need for authentication controls on any network, including guest Wi-Fi. VLANs are a network-layer control and have no capability to patch device firmware.

Answer: A
Telnet sends all data, including usernames and passwords, unencrypted across the network, making it vulnerable to interception, whereas SSH encrypts the entire session, protecting credentials and data. Port number has nothing to do with the security weakness being addressed; both services can be filtered by firewalls regardless of port. Performance/speed is not the reason for replacing Telnet; the concern is confidentiality of the session, not throughput. Telnet works fine over Ethernet networks; that is not a limiting factor in this decision.

Answer: A
Password spraying involves trying a small number of common passwords against many different accounts to avoid account lockout thresholds, matching the described pattern of one source hitting many accounts. A DDoS attack aims to overwhelm system resources or bandwidth, not to guess account credentials. A MITM attack intercepts and potentially alters communications between two parties, which is unrelated to repeated login attempts against multiple accounts. SQL injection exploits input validation flaws in database-driven applications, not authentication login attempts.

Answer: A
A site-to-site VPN encrypts traffic between locations so that any intermediary network operator, including an ISP, sees only ciphertext and cannot read the contents. Adjusting MTU size affects packet fragmentation and performance, not confidentiality of the data. QoS prioritization manages bandwidth allocation and traffic shaping, unrelated to encryption or confidentiality. Switching address families from IPv4 to IPv6 changes addressing scheme, not the confidentiality of the payload, and provides no inherent encryption.

Answer: A
An IPS sits directly in the traffic path (inline) so it can actively block or drop malicious packets immediately, while an IDS commonly analyzes a mirrored copy of traffic out-of-band and can only alert, not block. Neither technology is restricted to wireless networks only; both apply broadly to wired and wireless environments. Detection accuracy depends on tuning and technology, not an inherent IDS-vs-IPS advantage, so this is not a defining differentiator. IPS and IDS differ meaningfully in deployment (inline vs. passive) and response capability (block vs. alert only), so they are not interchangeable terms.

Answer: A
The CC exam uses multiple choice and advanced item types administered as Computerized Adaptive Testing (CAT), which adjusts subsequent question difficulty based on the candidate's performance on prior questions. A fixed-form paper exam presents the same static set of questions to every candidate and does not adapt, which is not how CC is delivered. CC is proctored at testing centers, not an open-book take-home format. The exam is administered via computer at Pearson VUE centers, not as an oral examination.

Answer: A
Pearson VUE charges a reschedule fee of U.S. $50 for changing an existing appointment. Rescheduling is not free; a specific fee applies. $199 is the exam registration price, not the reschedule fee, and conflating the two overstates the cost. $100 is actually the cancellation fee amount, not the reschedule fee, so this choice confuses the two distinct charges.

Answer: A
Members who hold only the CC certification pay an Annual Maintenance Fee (AMF) of U.S. $50. $125 overstates the actual fee amount for CC-only members. A maintenance fee is required to keep the certification active; it is not waived entirely. The AMF is a small fixed fee, not equivalent to re-paying the full $199 exam registration cost annually.

Answer: A
Members are given a 90-day period from the due date to pay their AMF before facing further consequences. A 10-day period significantly understates the actual grace period granted. Certification is not revoked immediately on the due date; a defined grace period exists first. A full 12-month grace period substantially overstates the actual 90-day window.

Answer: C
The registration price for the CC exam is U.S. $199. $50 is actually the Annual Maintenance Fee amount, not the exam registration price, so this choice confuses two separate fees. $349 overstates the actual registration cost. $700 corresponds to the passing score value, not a dollar fee, and using it as a price is a clear mismatch.

Answer: D
The CC exam is organized around 5 domains of foundational cybersecurity knowledge: Security Principles; BC/DR/IR Concepts; Access Controls Concepts; Network Security; and Security Operations. Four domains understates the officially defined structure. Seven and ten domains overstate the count; the exam blueprint defines exactly five.

Answer: B
Security Principles is weighted at 26%, the highest of the five domains, reflecting its role as the foundational domain underpinning the rest of the exam content. Network Security at 24% is the second-highest weighting, not the largest. Access Controls Concepts at 22% is weighted lower than both Security Principles and Network Security. Security Operations at 18% is the third-lowest weighting among the five domains.

Answer: A
Self-propagation is what makes worms spread at machine speed across a network, while a virus depends on a user opening or running an infected file. A trojan is a third category disguising itself as legitimate software, and ransomware describes the payload's behaviour rather than the propagation method.

Answer: A
Integrity concerns whether data is correct and unaltered, which is what an unauthorized change to a medication record would violate. Confidentiality would be violated by an unauthorized person reading the record, and availability by the record being inaccessible when a clinician needs it, so the same asset carries all three requirements at once.

Answer: A
Role-based control scales because a job change means a role reassignment rather than an audit of dozens of individual grants. Discretionary control lets the owner decide per request, and mandatory control uses system-enforced labels on subjects and objects that users cannot override, each suiting different environments.

Answer: A
The three categories are knowledge, possession and inherence, and genuine multi-factor authentication draws from different categories rather than combining two of the same kind. Location and behaviour are sometimes treated as additional contextual factors, but they supplement rather than replace the core three.

Answer: A
Controls are categorized by implementation as physical, technical or administrative, and separately by function as deterrent, preventive, detective, corrective or compensating. A single control can serve several functions, which is why a guard is often the example used to show that the two classification axes are independent.

Answer: A
The identity lifecycle runs from provisioning through modification to deprovisioning, and the final step is the one most often delayed because it depends on human resources notifying IT promptly. An orphaned account is particularly dangerous because no one is monitoring its use and the credentials may be known to someone with a grievance.

Answer: B
Each state needs different protection: storage encryption at rest, transport encryption in transit, and memory protections in use, which is the hardest of the three to address. Classification levels and data structure are separate dimensions that determine how strongly each state must be protected rather than what the states are.

Answer: C
Non-repudiation binds an action to an identity in a way the actor cannot later disown, which is why digital signatures using a private key only the signer holds provide it while a shared account fundamentally cannot. Logging supports it only where the log is protected from alteration by the party it implicates.

Answer: A
Separation of duties splits a sensitive process so that fraud requires collusion rather than a single decision. Job rotation and mandatory vacation are companion controls that make ongoing concealment harder, since a scheme requiring continuous attention tends to surface when someone else performs the role.

Answer: A
Layered controls assume each individual control will eventually fail or be bypassed, so protection depends on an attacker having to defeat several independent mechanisms. The layers must be genuinely independent, since controls sharing a common dependency such as a single directory service fail together despite appearing layered.

Answer: A
Routers operate at the network layer using IP addresses to move traffic between networks, while switches operate at the data link layer using MAC addresses within a network. A hub repeats every signal to every port, which is why hubs create both collision and security problems and have been superseded by switches.

Answer: A
Stateful inspection maintains a connection table so a response to an allowed outbound request is permitted without a separate inbound rule, which a stateless packet filter cannot do safely. Application-layer inspection is a further capability that examines payload content, and it is distinct from statefulness.

Answer: A
A screened subnet, historically called a demilitarized zone, isolates internet-facing services so the trust boundary sits between the exposed host and the internal network. The design assumes the exposed server will eventually be compromised and limits what that compromise reaches, which is why traffic from the subnet inward must be restricted as tightly as traffic from the internet.

Answer: B
HTTPS listens on 443, SSH on 22 and DNS on 53, while 80 is HTTP, 23 is Telnet and 25 is SMTP. Knowing the mapping matters operationally because firewall rules, log review and scan results are all expressed in port numbers, and the insecure counterparts such as Telnet on 23 and FTP on 21 are the ones to look for and eliminate.

Answer: A
A VPN secures the path, not the endpoints, so an infected laptop connected over a VPN delivers its malware straight into the network with the tunnel's protection applied. Encryption and the additional routing typically reduce rather than improve throughput, and organizational monitoring generally applies at the tunnel's endpoint.

Answer: A
Denial of service attacks availability directly by exhausting a resource, and the distributed variant uses many sources, which makes simple source blocking ineffective. Availability attacks are distinctive in that they need not breach any confidentiality or integrity control to cause substantial harm.

Answer: A
The inline position is what gives a prevention system its blocking capability and also its risk, since a false positive drops legitimate traffic rather than merely generating noise. That trade-off is why organizations often run in detection mode first, tuning the rule set before enabling blocking.

Answer: A
Social engineering targets people rather than systems, and the levers used here are authority and urgency, which together suppress the recipient's inclination to verify. Targeted attacks on specific individuals are called spear phishing, and those aimed at executives are called whaling, but the defensive answer is the same verification through an independent channel.

Answer: A
A differential backup captures everything changed since the last full backup, so each successive differential grows but only the latest one is needed alongside the full. Incremental backups capture changes since the last backup of any type, which makes them faster to create but requires the full plus every incremental in sequence to restore.

Answer: A
The rule addresses correlated failure: multiple copies protect against media failure, different media types protect against a technology-specific fault, and the offsite copy protects against a site-level event. Ransomware has driven a common extension adding an offline or immutable copy, since network-accessible backups are encrypted along with production data.

Answer: C
Preparation comes first because capability must exist before an incident, and post-incident activity comes last to feed lessons back into preparation, making the model a cycle rather than a line. Containment necessarily precedes eradication, since removing the cause before bounding the spread lets the incident continue elsewhere.

Answer: A
Business continuity is the broader discipline covering people, premises, processes and suppliers, with disaster recovery as the technology restoration component within it. A plan restoring systems into an organization with no premises, staff arrangements or supplier alternatives has restored only part of what is needed to operate.

Answer: A
The centre is the detection and first-response capability, distinguishing routine noise from events requiring action and escalating accordingly. Policy setting is a governance activity and change approval belongs to change management, so a centre absorbing those responsibilities dilutes the monitoring function it exists to provide.

Answer: A
Patch management balances the risk of exploitation against the risk of the patch itself causing an outage, and both risks are real. A critical internet-facing vulnerability under active exploitation may justify accelerated deployment, which is why patch policies specify different timelines by severity and exposure rather than a single rule.

Answer: C
These are administrative controls addressing the exposure created by physical presence, which technical network controls do not touch. The threat includes insiders and authorized visitors, not just intruders, which is why the controls apply throughout the workday rather than only outside hours.

Answer: A
Data held past its retention period remains a liability in a breach and may violate regulations that require deletion, so retention schedules specify destruction as well as keeping. Removing an index while retaining files leaves the data recoverable and discoverable, which achieves none of the objective while creating a false record of disposal.

Answer: A
Hashing is one-way and deterministic, so recomputing the hash and comparing detects any alteration without needing the original alongside. It provides no confidentiality, since the file itself is unchanged, and it is not reversible, which is precisely what distinguishes it from encryption.

Answer: B
Asymmetric operations are computationally expensive, so hybrid schemes use them to establish a shared symmetric key and then encrypt the data symmetrically. Symmetric encryption's difficulty is distributing the shared key securely to every party that needs it, which is the exact problem asymmetric cryptography was developed to solve.

Answer: A
Access, rectification and erasure in defined circumstances are the common core of modern privacy regimes, along with portability and objection rights in several. Erasure is qualified rather than absolute, since legal retention obligations and other lawful bases can override a deletion request.

Answer: A
Identification establishes who is present while escorting constrains what they can reach and observe, and the two together address different aspects of the same risk. Logging remains necessary because the escort's memory is not a record, and visitor badges must be visually distinct and time-limited so unescorted presence is immediately apparent.

Answer: A
Reuse converts any single service's breach into a compromise of every account sharing that password, which automated credential stuffing exploits at scale. Length addresses brute force and guessing, while shoulder surfing and keyloggers capture the credential regardless of its strength or uniqueness, requiring different controls.

Answer: D
Single sign-on reduces password fatigue and reuse while concentrating risk in one credential, which is why it is paired with strong multi-factor authentication at the identity provider. The concentration also means session handling and identity provider availability become critical dependencies for every federated application.

Answer: A
A false positive is a benign event flagged as malicious, and its practical cost is alert fatigue, which degrades detection even though each individual false alert is harmless. A false negative is a genuine attack that produced no alert, and tuning always trades one against the other rather than eliminating both.

Answer: A
People are targeted directly by social engineering that no technical control fully blocks, which is why awareness is a genuine control layer rather than a compliance formality. Recurrence matters because attack techniques evolve and staff turnover continually introduces untrained people into the organization.

Answer: B
An acceptable use policy sets behavioural expectations for users and, by defining consequences, provides the basis for enforcement action when they are breached. Its practical value depends on staff having actually acknowledged it, which is why signed or recorded acknowledgment at onboarding and on material change is part of the control.

Answer: A
A threat with no corresponding vulnerability produces no risk, and a vulnerability no threat can reach is similarly inert, which is why both must be present for risk to exist. This is also why risk can be reduced either by removing the vulnerability, which the organization controls, or by reducing exposure to the threat, which it usually does not.