20 free ISC2 CC practice questions

Correct answer: B · Availability, timely and reliable access to information and systems

FIPS 200 defines availability as ensuring timely and reliable access to and use of information, and a flood that keeps customers from reaching the booking site for three hours attacks exactly that. The stem rules out the other two parts of the CIA triad: no customer data was read or copied, so confidentiality held, and none was changed, so integrity held. Non-repudiation concerns proof of who sent or approved something, which a traffic flood does not touch. The company still has to respond to the attack, even though no data left its control.

Look for this next time: An attack that makes a system unreachable without exposing or changing data is an attack on availability.

Correct answer: D · Non-repudiation, because the signature ties the quote to its sender

FIPS 186-5, NIST's digital signature standard, describes non-repudiation as assurance of the integrity and origin of data that a third party can verify as coming from the entity that holds the private key, the signatory. Because the signature verifies with the supplier's public key, the buyer can show that the holder of the supplier's private key signed that exact quote, which answers the claim that it was never sent. A signature does not keep the quote secret, so it gives no confidentiality. Being able to open the file later is not what the signature proves, and authorization is about permissions, not proof of origin.

Look for this next time: A valid digital signature gives non-repudiation: proof of who signed the data and that it was not changed.

Correct answer: A · Risk avoidance, ending the activity that is the basis for the risk

NIST SP 800-39 says risk avoidance may be the appropriate response when a risk exceeds the organization's risk tolerance, and that it involves eliminating the activity or technology that is the basis for the risk. Shutting down the upload feature does exactly that. Transfer, such as buying insurance, shifts liability to another organization but keeps the feature running. Acceptance fits a risk within the risk tolerance, which the assessment rules out. Mitigation would add controls to the feature, an option leadership rejected on cost.

Look for this next time: Ending the activity that creates a risk is risk avoidance; insurance is transference and added controls are mitigation.

Correct answer: C · A written password policy that each employee signs yearly

NIST's glossary describes administrative safeguards as policies and procedures that manage security measures and the conduct of the workforce, which is what a written password policy that staff sign each year is. FIPS 200 defines technical controls as safeguards that the system itself implements and executes through hardware, software, or firmware, which covers both the email gateway rule and full-disk encryption. A badge reader on a door is a physical measure that protects buildings and equipment from unauthorized intrusion.

Look for this next time: Policies and procedures are administrative controls; system-enforced safeguards are technical; locks and badge readers are physical.

Correct answer: C · Act honorably, honestly, justly, responsibly, and legally

Changing a date so a report misstates when a patch was installed is dishonest, and the canon on acting honorably, honestly, justly, responsibly, and legally speaks to it most directly. The canon on protecting society, the common good, public trust, and the infrastructure is broader and concerns harm to the public. The canon on diligent and competent service to principals covers the CC holder's duty to an employer, which is where the request comes from, not the reason to refuse it. Advancing and protecting the profession concerns the profession as a whole. ISC2 requires every member to commit to the Code.

Look for this next time: When a request asks you to deceive, the canon to apply is acting honorably, honestly, justly, responsibly, and legally.

Correct answer: A · The recovery point objective, and nightly backups do not meet it

NIST SP 800-34 defines the recovery point objective (RPO) as the point in time to which data must be recovered after an outage, so a limit on how much recent data the clinic can lose is an RPO. With one backup a night, a failure late in the day could lose almost a full day of entries, far more than 1 hour, so the schedule does not meet it. The recovery time objective (RTO) is how long system components can stay in the recovery phase before the mission suffers, so it is set against the clinic's 8-hour downtime limit, not the 1-hour data-loss limit. Meeting this RPO would take backups or replication at least every hour.

Look for this next time: The RPO limits how much data you can lose; the RTO limits how long recovery can take.

Correct answer: D · Decline, then call the help desk at its known number and report it

CISA's guidance on social engineering says to be suspicious of unsolicited calls asking for internal information, to verify a caller's identity directly with the organization, and not to share information unless you are certain of the person's authority. CISA calls this voice-based approach vishing. A sign-in code sent to her phone is meant for her alone, and reading it out could let the caller finish a sign-in as her, so she should decline, reach the help desk through a number she already knows, and report the call. An employee ID or a manager's name can be found or made up, so details the caller supplies do not verify him.

Look for this next time: Never share a sign-in code with a caller; verify through a channel you already know and report the call.

Correct answer: B · A key risk indicator, a metric that measures the level of risk

NIST SP 800-55 defines a key risk indicator (KRI) as a metric used to measure risk and a key performance indicator (KPI) as a metric of progress toward intended results. The board wants a warning about exposure measured against its risk appetite, and a share of exposed servers with old critical flaws rises as that risk rises, so it is a KRI. A KPI would track progress toward a target, such as the share of staff who finished awareness training. A recovery time objective limits how long recovery may take. A compliance finding is the result of one audit, not a running metric with an escalation threshold.

Look for this next time: A metric that rises with exposure and triggers escalation against risk appetite is a key risk indicator.

Correct answer: A · Govern, setting the risk strategy, roles, and policy for security

CSF 2.0 describes the Govern Function as establishing, communicating, and monitoring the organization's cybersecurity risk management strategy, expectations, and policy. Its categories include Risk Management Strategy, with risk appetite statements (GV.RM), Roles, Responsibilities, and Authorities (GV.RR), and Policy (GV.PO), which match all three tasks. Identify is about understanding the organization's current cybersecurity risks, for example through asset management. Protect covers the safeguards used to manage those risks, and Detect covers finding and analyzing possible attacks and compromises. CSF 2.0 says Govern informs how the other five Functions are prioritized.

Look for this next time: In CSF 2.0, setting risk appetite, accountability, and policy belongs to the Govern Function.

Correct answer: C · Deprovisioning, removing access when it is no longer needed

ISC2's CC outline lists the identity life cycle as roles definition, provisioning, review, and deprovisioning. Her accounts should have been disabled when she left, and the request that never went from HR to IT is a deprovisioning failure. NIST describes least privilege as restricting access to the minimum necessary for assigned tasks, and a former employee has no assigned tasks. Provisioning and role definition happened when she was hired and are not what went wrong. A periodic access review might have caught the account later, but the stem says the next one is still a month away.

Look for this next time: When someone leaves, deprovisioning should remove access right away instead of waiting for the next access review.

Correct answer: D · Give him a role that can only reset the passwords of staff accounts

NIST defines least privilege as restricting users' access privileges to the minimum necessary to accomplish assigned tasks. The technician's task is resetting staff passwords, so a role limited to that permission meets the need without giving him control of every server. A yearly review leaves the excess rights in place for months. A shared admin account is worse: it grants the same broad rights and makes it harder to tell who did what. An acceptable use policy is an administrative control that sets expectations, but it does not reduce the rights the account holds.

Look for this next time: Least privilege means granting only the permissions a task needs, not a broad group that happens to include them.

Correct answer: B · Separation of duties, splitting critical steps between different people

NIST describes separation of duty as the principle that no user should have enough privileges to misuse the system alone, with the example that the person authorizing a paycheck should not also be the one who prepares it. A clerk who can both create a vendor and approve payments to it could pay a fake vendor with no one else involved, so the two steps should belong to different people. The stem rules out least privilege as the gap, because both tasks are part of the clerk's job. Every change is logged under the clerk's own account, so actions can already be traced to one person. Defense in depth is about layering controls, which does not fix one person holding both steps.

Look for this next time: When one person can complete both halves of a critical transaction, the missing control is separation of duties.

Correct answer: A · Role-based access control, where permissions are tied to job roles

NIST describes role-based access control (RBAC) as a model in which permitted actions on resources are identified with roles rather than with individual identities, so moving her from the billing role to the pharmacist role changes her permissions in one step. In discretionary access control, an object's owner decides who gets access and what rights they have. In mandatory access control, a central authority makes the access decisions and users cannot change access rights. Attribute-based access control decides each request from attributes of the requester and of the object, such as location or time of creation, rather than from a role assignment.

Look for this next time: If permissions change when a person's job role changes, the model is role-based access control.

Correct answer: D · Remote Desktop Protocol (RDP), for graphical sessions on remote hosts

Microsoft's documentation says Remote Desktop accepts connections over the Remote Desktop Protocol (RDP) and listens on port 3389 by default, and IANA registers TCP 3389 as MS WBT Server. Repeated attempts from many internet addresses look like someone probing an exposed Remote Desktop service. IANA registers SSH on TCP 22, DNS on port 53, and HTTPS, HTTP over TLS, on port 443, so none of them matches port 3389.

Look for this next time: TCP 3389 is the default Remote Desktop (RDP) port, so traffic to it from the internet means someone is trying to reach a remote desktop.

Correct answer: C · Check user and device before each session to each internal resource

NIST SP 800-207 says zero trust grants no implicit trust to assets or user accounts based solely on their physical or network location, and that authentication and authorization of both the subject and the device happen before a session to an enterprise resource is established. Checking the user and device for each resource replaces the VPN's all-or-nothing access. Trusting every device on the office LAN keeps location-based trust, which zero trust removes. A second VPN concentrator changes capacity, not trust. A longer password strengthens one sign-in but still leaves anyone signed in able to reach every server.

Look for this next time: Zero trust removes trust based on network location and checks the user and device for each resource.

Correct answer: B · The startup, because in IaaS the consumer controls the operating system

NIST SP 800-145 defines Infrastructure as a Service (IaaS) as the consumer provisioning processing, storage, and networks to run arbitrary software, including operating systems, with control over the operating systems, storage, and deployed applications but not the underlying cloud infrastructure. Renting virtual machines and installing your own image is IaaS, so the startup patches the operating system, while the provider manages the infrastructure underneath. In Platform as a Service (PaaS), the consumer deploys applications and does not manage the operating systems, but the startup is not using PaaS. In Software as a Service (SaaS), the consumer uses the provider's application and manages even less.

Look for this next time: In IaaS the customer patches the operating system it installs; the provider manages the infrastructure underneath.

Correct answer: C · Rapid elasticity, adding and releasing capacity to match demand

NIST SP 800-145 lists rapid elasticity as an essential characteristic: capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward with demand. Adding servers as sale traffic climbs and releasing them afterward is that behavior. Measured service is the metering that lets resource use be monitored, controlled, and reported. Resource pooling means the provider's resources serve many consumers through a multi-tenant model. Broad network access means capabilities are available over the network through standard mechanisms from many kinds of client platforms.

Look for this next time: Automatic scaling out and back in with demand is rapid elasticity.

Correct answer: A · Purge the drives, so recovery is infeasible even with lab techniques

NIST SP 800-88 defines purge as a sanitization method that applies physical or logical techniques to make recovery of the target data infeasible using state-of-the-art laboratory techniques, which matches the firm's policy, and the laptops stay usable. Clear applies logical techniques to all user-addressable storage, such as rewriting through the normal read and write commands, and NIST describes it as protection against simple, non-invasive recovery, which falls short of the policy. Shredding the drives would protect the data but leaves laptops that cannot be donated in working order. Deleting folders meets neither standard: it removes only the files someone chose, while sanitization removes information from the media so that recovery is not possible.

Look for this next time: When media leaves your control but must stay usable, choose purge; clear protects only against simple recovery.

Correct answer: D · A tabletop exercise, a facilitated discussion of each step in the plan

NIST describes a tabletop exercise as discussion-based: people with roles in a plan meet in a classroom setting or in breakout groups, and a facilitator presents a scenario and asks questions so they can validate the plan by discussing their roles and responses. That matches this session, and nothing in it touches production. A red team, in NIST's terms, is an authorized group that emulates an adversary's attack capabilities against the enterprise. A penetration test tries to exploit vulnerabilities in real systems, and a failover test moves operations to backup systems. All three act on systems, which the team wants to avoid.

Look for this next time: A facilitated, discussion-only walk-through of a plan is a tabletop exercise.

Correct answer: B · A red team, which emulates a real adversary's attack capabilities

NIST, citing CNSSI 4009, defines a red team as a group authorized and organized to emulate a potential adversary's attack or exploitation capabilities against an enterprise's security posture, to show the impact of successful attacks and what works for the defenders. The blue team is the group that defends against those mock attackers, which here is the security operations team being tested. An audit team compares controls with requirements rather than attacking them. An incident response team handles real incidents; it might respond during the exercise, but it is not the group running the emulation.

Look for this next time: An authorized group that emulates an adversary's attacks is a red team; the defenders it tests are the blue team.