I85PREP
⌘ K
CCPC study materials
CCPC study resources

CCPC practice questions

One question at a time. Build your CCPC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Policy Fundamentals and Governance

Which document type typically establishes an organization's overall intent and direction for protecting information, at the highest level of authority?

  1. A guideline
  2. A procedure
  3. A policy Correct answer.
  4. A standard

Explanation

Policies are management statements of intent and direction and sit at the top of the document hierarchy. Standards, procedures, and guidelines flow downward from policy to add specificity, steps, and recommendations.

Question 2Cyber Policy Fundamentals and Governance

A security team writes a document that says 'all laptops must use full-disk encryption with AES-256.' Which type of document is this?

  1. A procedure
  2. A guideline
  3. A charter
  4. A standard Correct answer.

Explanation

A standard specifies mandatory, measurable requirements that support a policy, such as a specific cryptographic algorithm. It is not advisory like a guideline, nor step-by-step like a procedure.

Question 3Cyber Policy Fundamentals and Governance

Which principle holds that a user should be granted only the access necessary to perform their job and nothing more?

  1. Defense in depth
  2. Separation of duties
  3. Need-to-know
  4. Least privilege Correct answer.

Explanation

Least privilege limits access rights to the minimum required for a role. Separation of duties divides tasks to prevent fraud, while defense in depth layers controls.

Question 4Cyber Policy Fundamentals and Governance

Who within an organization is ultimately accountable for the information security program?

  1. The IT help desk manager
  2. The firewall administrator
  3. The external auditor
  4. The senior executive leadership or board Correct answer.

Explanation

Ultimate accountability for security governance rests with senior leadership or the board, who set risk appetite and direction. Operational staff implement controls but do not own the program at the governance level.

Question 5Cyber Policy Fundamentals and Governance

Which concept describes the level of risk an organization is willing to accept in pursuit of its objectives?

  1. Risk appetite Correct answer.
  2. Residual risk
  3. Risk transfer
  4. Inherent risk

Explanation

Risk appetite is the amount and type of risk an organization is willing to accept. Residual risk is what remains after controls, and inherent risk exists before controls.

Question 6Cyber Policy Fundamentals and Governance

Which term describes the risk that remains after security controls have been implemented?

  1. Risk avoidance
  2. Residual risk Correct answer.
  3. Inherent risk
  4. Risk appetite

Explanation

Residual risk is what is left over once controls reduce the inherent risk. Management must decide whether that remaining level is acceptable.

Question 7Cyber Policy Fundamentals and Governance

Which type of control is a security awareness training program for employees?

  1. Detective technical control
  2. Preventive technical control
  3. Physical control
  4. Administrative control Correct answer.

Explanation

Training is an administrative (management) control because it relies on people and processes rather than technology or physical barriers. It aims to reduce risk by improving behavior.

Question 8Cyber Policy Fundamentals and Governance

Which law is a comprehensive European Union regulation governing the protection of personal data and its transfer outside the EU?

  1. PCI DSS
  2. HIPAA
  3. GDPR Correct answer.
  4. SOX

Explanation

The General Data Protection Regulation (GDPR) governs personal data protection across the EU and restricts transfers to other jurisdictions. HIPAA and SOX are US laws, and PCI DSS is an industry standard.

Question 9Cyber Policy Fundamentals and Governance

A company decides to purchase cyber insurance to cover potential breach costs. Which risk treatment strategy does this represent?

  1. Risk avoidance
  2. Risk mitigation
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Risk transfer shifts the financial consequences of a risk to a third party, such as an insurer. Mitigation reduces likelihood or impact, avoidance eliminates the activity, and acceptance retains the risk.

Question 10Cyber Policy Fundamentals and Governance

Which governance body is typically responsible for approving an organization's information security policy?

  1. The network engineering group
  2. Executive management or the board Correct answer.
  3. The security operations center analysts
  4. The internal audit team

Explanation

Policies require approval at the executive or board level to carry organizational authority. Operational teams draft and implement but do not formally approve enterprise policy.

Question 11Cyber Policy Fundamentals and Governance

An organization defines roles so that the person who creates a payment cannot also approve it. Which principle does this illustrate?

  1. Availability
  2. Separation of duties Correct answer.
  3. Least privilege
  4. Defense in depth

Explanation

Separation of duties divides a sensitive process among multiple people so no single individual controls it end to end. This reduces the potential for error or fraud.

Question 12Cyber Policy Fundamentals and Governance

A data classification scheme labels information as public, internal, confidential, and restricted. What is the primary purpose of such a scheme?

  1. To reduce the cost of storage infrastructure
  2. To satisfy software licensing requirements
  3. To determine which users may access data and how it must be protected Correct answer.
  4. To speed up network throughput

Explanation

Classification assigns sensitivity levels so that handling, access, and protection controls match the value of the data. It is the basis for applying appropriate safeguards.

Question 13Cyber Policy Fundamentals and Governance

Which element of the CIA triad is most directly affected when a ransomware attack encrypts files and makes them unavailable?

  1. Integrity
  2. Non-repudiation
  3. Confidentiality
  4. Availability Correct answer.

Explanation

Ransomware denying access to data primarily harms availability, since legitimate users cannot reach the information. Integrity and confidentiality may also be affected, but unavailability is the defining impact.

Question 14Cyber Policy Fundamentals and Governance

Which of the following best describes a 'standard' in a security governance framework?

  1. A mandatory requirement that supports policy and specifies measurable criteria Correct answer.
  2. A step-by-step instruction for completing a task
  3. A recommendation that staff may follow at their discretion
  4. A high-level statement of management intent

Explanation

Standards translate policy into mandatory, measurable requirements. They are binding, unlike guidelines, and less granular than procedures.

Question 15Cyber Policy Fundamentals and Governance

An organization's policy requires annual review, but no one has reviewed it in three years. Which governance weakness does this most directly represent?

  1. Lack of policy enforcement and maintenance Correct answer.
  2. Insufficient network bandwidth
  3. Overuse of multi-factor authentication
  4. Excessive encryption strength

Explanation

Failing to review policy on schedule reflects weak policy lifecycle management and enforcement. Governance requires periodic review to keep documents current and relevant.

Question 16Cyber Policy Fundamentals and Governance

Which framework is widely used by organizations to structure and assess their information security management system?

  1. COBIT 2019
  2. ITIL 4
  3. ISO/IEC 27001 Correct answer.
  4. NIST CSF

Explanation

ISO/IEC 27001 specifies requirements for establishing, implementing, and maintaining an information security management system (ISMS). COBIT focuses on IT governance broadly, NIST CSF on cybersecurity outcomes, and ITIL on service management.

Question 17Cyber Policy Fundamentals and Governance

Under the GDPR, which role is responsible for determining the purposes and means of processing personal data?

  1. The supervisory authority
  2. The data processor
  3. The data subject
  4. The data controller Correct answer.

Explanation

The controller decides why and how personal data is processed. Processors act on the controller's behalf, subjects are the individuals, and supervisory authorities regulate.

Question 18Cyber Policy Fundamentals and Governance

Which governance document is most appropriate for describing the specific sequence of steps an administrator follows to onboard a new employee into the identity system?

  1. A charter
  2. A procedure Correct answer.
  3. A policy
  4. A standard

Explanation

Procedures provide detailed, sequential steps for executing a task consistently. Policies state intent, standards set requirements, and charters authorize bodies or projects.

Question 19Cyber Policy Fundamentals and Governance

An organization formally documents which risks it will accept and which it will mitigate after a risk assessment. What is this output called?

  1. A business impact analysis
  2. A risk treatment plan Correct answer.
  3. A vulnerability scan report
  4. An asset inventory

Explanation

A risk treatment plan records the chosen response to each identified risk, including acceptance, mitigation, transfer, or avoidance. It documents management decisions following assessment.

Question 20Cyber Policy Fundamentals and Governance

Which concept requires that multiple independent controls protect an asset so that failure of one does not expose it entirely?

  1. Zero trust
  2. Defense in depth Correct answer.
  3. Least privilege
  4. Single sign-on

Explanation

Defense in depth layers controls so that a single failure does not lead to compromise. Least privilege limits access scope, and zero trust assumes no implicit trust based on location.

Question 21Cyber Policy Fundamentals and Governance

A multinational firm must decide how to handle personal data flows between its EU and US entities. Which governance consideration is most directly relevant?

  1. The physical size of the data center
  2. The number of help desk tickets
  3. The brand of the firewall appliance
  4. Cross-border data transfer rules and adequacy decisions Correct answer.

Explanation

Cross-border transfers of personal data are governed by legal mechanisms such as adequacy decisions or standard contractual clauses. These rules determine whether and how data may leave a jurisdiction.

Question 22Cyber Policy Fundamentals and Governance

An organization's risk appetite is low, yet a business unit wants to adopt a new cloud service with unproven controls. Which governance response best reflects the risk appetite?

  1. Delegate the decision entirely to the vendor
  2. Require a risk assessment and additional controls before approval Correct answer.
  3. Approve the service immediately to gain competitive advantage
  4. Ignore the risk because cloud services are inherently secure

Explanation

When risk appetite is low, new initiatives should undergo assessment and have compensating controls before acceptance. This aligns decisions with the stated tolerance for risk.

Question 23Cyber Policy Fundamentals and Governance

A board wants assurance that security controls operate as intended across business units. Which governance mechanism most directly provides this?

  1. Independent internal audit and control testing Correct answer.
  2. Increasing the number of firewall rules
  3. Purchasing additional endpoint licenses
  4. Extending password length requirements

Explanation

Independent audit and control testing provide objective evidence that controls are designed and operating effectively. Technical changes alone do not give leadership assurance.

Question 24Cyber Policy Fundamentals and Governance

Which situation best illustrates a conflict between regulatory compliance and an organization's own security policy?

  1. A guideline recommends patching monthly and the regulation requires quarterly patching
  2. A policy requires encryption and the regulation is silent on encryption
  3. A regulation requires retaining logs for one year while internal policy mandates deletion after 90 days Correct answer.
  4. A standard requires multi-factor authentication and the regulation permits it

Explanation

A conflict arises when a legal retention requirement contradicts an internal deletion rule, forcing reconciliation. Where the regulation is silent or permissive, policy can set stricter requirements without conflict.

Question 25Cyber Policy Fundamentals and Governance

Which approach best integrates security governance into an organization's overall enterprise risk management?

  1. Reviewing security only after an incident occurs
  2. Treating security risk as a standalone technical issue handled only by IT
  3. Outsourcing all security decisions to a third-party vendor
  4. Aligning security risk registers and reporting with the enterprise risk framework Correct answer.

Explanation

Integrating security risk into the enterprise risk framework ensures consistent reporting, prioritization, and decision-making at the leadership level. Treating it as isolated or reactive undermines governance.

Question 26Cyber Policy Fundamentals and Governance

Which term describes the formal decision by management to accept a specific risk and proceed with an activity, often documented with a justification and an expiration date?

  1. Risk avoidance
  2. Risk mitigation
  3. Risk transfer
  4. Risk acceptance Correct answer.

Explanation

Risk acceptance is the formal acknowledgment of a risk without implementing additional controls, typically documented with a rationale and a review date. It differs from avoidance (eliminating the activity), transfer (shifting financial impact, e.g., insurance), and mitigation (applying controls to reduce the risk).

Question 27Cyber Policy Fundamentals and Governance

In a typical three-lines-of-defense model, which group provides independent oversight and assurance over the effectiveness of security controls?

  1. The IT operations team
  2. The board of directors
  3. Internal audit Correct answer.
  4. The risk management function

Explanation

The three-lines-of-defense model assigns operational management as the first line, a risk and compliance function as the second line, and internal audit as the third line providing independent assurance. Internal audit reports objectively on control effectiveness to the board or audit committee.

Question 28Cyber Policy Fundamentals and Governance

A security policy states that all laptops must use full-disk encryption, but a legacy application cannot run on encrypted disks. The security team grants a documented exception with a compensating control and a review date. Which governance process does this illustrate?

  1. Policy exception management Correct answer.
  2. Business continuity planning
  3. Incident response
  4. Change management

Explanation

Policy exception management is the formal process for approving and documenting deviations from a policy when business or technical constraints exist, including compensating controls and a review date. It ensures the deviation is risk-assessed and time-bound rather than an uncontrolled violation.

Question 29Cyber Policy Fundamentals and Governance

An organization wants to demonstrate to customers that its information security management system meets internationally recognized requirements. Which type of audit is most appropriate?

  1. A penetration test
  2. A first-party internal audit
  3. A third-party certification audit Correct answer.
  4. A vulnerability assessment

Explanation

A third-party certification audit, performed by an independent accredited body, provides formal attestation that the ISMS conforms to a standard such as ISO/IEC 27001, which can be shared with customers. Internal audits are for management review, while penetration tests and vulnerability assessments are technical tests, not certification of the management system.

Question 30Cyber Policy Fundamentals and Governance

A company's security policy requires multi-factor authentication for all remote access, but a new regulation in a key market mandates a specific authentication technology that the company's current MFA solution does not support. Which action best aligns with governance best practice?

  1. Request a permanent exception from the regulator without changing controls
  2. Immediately disable remote access until a compliant solution is found
  3. Continue using the current MFA solution and document the regulatory gap as a known risk
  4. Update the policy to require the mandated technology and plan a migration with risk-based prioritization Correct answer.

Explanation

Governance best practice is to align policy with legal and regulatory obligations, then manage the transition through a planned, risk-based migration. This keeps policy authoritative and addresses the compliance requirement while allowing the organization to manage operational impact.

Question 31Cybersecurity Risk Management and Frameworks

Which risk treatment strategy involves accepting the potential loss and continuing operations without additional controls?

  1. Risk transfer
  2. Risk avoidance
  3. Risk mitigation
  4. Risk acceptance Correct answer.

Explanation

Risk acceptance means an organization acknowledges a risk and chooses to bear it, often because the cost of control exceeds the potential loss or the risk is within tolerance. The other strategies change, shift, or eliminate the risk rather than retaining it.

Question 32Cybersecurity Risk Management and Frameworks

What is the primary purpose of a risk register?

  1. To record employee security awareness training completion
  2. To list all hardware assets connected to the network
  3. To document identified risks along with their owners, ratings, and status Correct answer.
  4. To store cryptographic keys used for data encryption

Explanation

A risk register is the central record of identified risks, capturing attributes such as likelihood, impact, owner, and treatment status so risks can be tracked and managed over time. The other options describe functions of different systems or records.

Question 33Cybersecurity Risk Management and Frameworks

Which concept describes the level of risk an organization is willing to tolerate in pursuit of its objectives?

  1. Inherent risk
  2. Risk appetite Correct answer.
  3. Risk capacity
  4. Residual risk

Explanation

Risk appetite is the amount and type of risk an organization is willing to accept to achieve its goals. Residual and inherent risk describe measured risk levels, while capacity is the maximum risk an entity can bear.

Question 34Cybersecurity Risk Management and Frameworks

In a quantitative risk assessment, what does the annualized loss expectancy (ALE) represent?

  1. The expected monetary loss from a risk over one year Correct answer.
  2. The total cost of all security controls implemented in a year
  3. The maximum single loss an asset can suffer
  4. The number of incidents expected in a year

Explanation

ALE is calculated as single loss expectancy multiplied by annualized rate of occurrence, giving the expected yearly monetary loss from a given risk. It is used to justify controls by comparing expected loss reduction against control cost.

Question 35Cybersecurity Risk Management and Frameworks

Which type of control is a security awareness training program?

  1. Detective
  2. Preventive Correct answer.
  3. Compensating
  4. Corrective

Explanation

Awareness training is preventive because it reduces the likelihood that users will make mistakes or fall for attacks before an incident occurs. Detective controls identify events, corrective controls restore operations, and compensating controls substitute for another control.

Question 36Cybersecurity Risk Management and Frameworks

What is the main difference between a policy and a standard?

  1. Policies apply only to executives while standards apply to staff
  2. Policies are optional while standards are mandatory
  3. Policies are technical while standards are administrative
  4. Policies state management intent while standards specify mandatory requirements Correct answer.

Explanation

A policy communicates management's intent and direction at a high level, while a standard provides specific, mandatory requirements that support the policy. Procedures then describe how to meet those standards step by step.

Question 37Cybersecurity Risk Management and Frameworks

Which framework is most closely associated with identifying, assessing, and managing information security risk through a six-step lifecycle?

  1. COBIT
  2. PCI DSS
  3. NIST SP 800-30 Correct answer.
  4. NIST Cybersecurity Framework

Explanation

NIST SP 800-30 provides guidance for conducting risk assessments and describes a risk management process including framing, assessing, responding, and monitoring risk. The other frameworks address broader program structure or specific compliance requirements.

Question 38Cybersecurity Risk Management and Frameworks

What does the 'likelihood' component of a risk assessment estimate?

  1. The number of controls needed to reduce risk
  2. The financial value of the affected asset
  3. The time required to recover from an incident
  4. The probability that a threat will exploit a vulnerability Correct answer.

Explanation

Likelihood estimates the probability that a threat event will occur by exploiting a vulnerability, and it combines with impact to determine overall risk level. Asset value, recovery time, and control count are separate considerations.

Question 39Cybersecurity Risk Management and Frameworks

An organization's single loss expectancy for a ransomware event is $200,000 and the annualized rate of occurrence is 0.25. What is the annualized loss expectancy?

  1. $800,000
  2. $25,000
  3. $50,000 Correct answer.
  4. $80,000

Explanation

ALE equals SLE multiplied by ARO, so $200,000 × 0.25 = $50,000. This expected annual loss can be compared with the cost of controls to justify investment.

Question 40Cybersecurity Risk Management and Frameworks

After implementing new access controls, an organization recalculates the risk for a database. The remaining exposure is called what?

  1. Residual risk Correct answer.
  2. Inherent risk
  3. Risk appetite
  4. Risk transfer

Explanation

Residual risk is the risk that remains after controls have been applied, and it should be compared against the organization's risk appetite. Inherent risk is the level before controls, while appetite and transfer are different concepts.

Question 41Cybersecurity Risk Management and Frameworks

A company purchases cyber insurance to cover potential breach costs. Which risk treatment strategy is this?

  1. Risk acceptance
  2. Risk mitigation
  3. Risk transfer Correct answer.
  4. Risk avoidance

Explanation

Transferring risk means shifting the financial consequences to another party, commonly through insurance or contractual agreements. The risk event still occurs, but the financial burden is shared with the insurer.

Question 42Cybersecurity Risk Management and Frameworks

Which statement best describes a gap assessment against a chosen framework?

  1. It tests the technical exploitability of each vulnerability
  2. It compares current controls to framework requirements to identify shortfalls Correct answer.
  3. It certifies the organization as fully compliant
  4. It calculates the annualized loss expectancy for each asset

Explanation

A gap assessment measures current practices against a framework's requirements and identifies where controls are missing or insufficient. It produces a roadmap for remediation rather than a certification or exploit test.

Question 43Cybersecurity Risk Management and Frameworks

Which risk assessment approach relies primarily on expert judgment and qualitative scales such as high, medium, and low?

  1. Qualitative assessment Correct answer.
  2. Quantitative assessment
  3. Monte Carlo simulation
  4. Fault tree analysis

Explanation

Qualitative assessments use descriptive scales and expert judgment to rank risks when precise monetary data is unavailable. Quantitative methods use numeric values, while simulation and fault tree analysis are specific analytical techniques.

Question 44Cybersecurity Risk Management and Frameworks

What role does a risk owner play in risk management?

  1. They are accountable for managing an assigned risk and its treatment Correct answer.
  2. They maintain the network firewall rules
  3. They perform the technical penetration tests
  4. They approve the organization's annual budget

Explanation

A risk owner is the individual accountable for overseeing a specific risk, ensuring treatment is applied, and monitoring changes to exposure. Technical tasks and budgeting are separate responsibilities.

Question 45Cybersecurity Risk Management and Frameworks

Which of the following is a key characteristic of a Key Risk Indicator (KRI)?

  1. It records the audit trail of user logins
  2. It lists all vulnerabilities found in a scan
  3. It documents the steps to recover from an outage
  4. It provides an early warning that risk exposure is increasing Correct answer.

Explanation

A KRI is a metric that provides early warning of rising risk exposure so management can act before a loss occurs. Vulnerability lists, recovery procedures, and audit logs serve different purposes.

Question 46Cybersecurity Risk Management and Frameworks

An organization decides to stop offering a legacy service because its security risk cannot be adequately controlled. Which treatment strategy is this?

  1. Risk mitigation
  2. Risk avoidance Correct answer.
  3. Risk transfer
  4. Risk acceptance

Explanation

Avoidance eliminates the risk by discontinuing the activity that creates it. Here the service is removed entirely rather than controlled, insured, or retained.

Question 47Cybersecurity Risk Management and Frameworks

Which document typically describes step-by-step instructions for performing a specific security task?

  1. Guideline
  2. Standard
  3. Policy
  4. Procedure Correct answer.

Explanation

Procedures provide detailed, sequential instructions for carrying out tasks that satisfy policies and standards. Policies set intent, standards set mandatory requirements, and guidelines offer recommended practices.

Question 48Cybersecurity Risk Management and Frameworks

A risk has a low likelihood but a very high impact. How should this typically be prioritized relative to a high-likelihood, low-impact risk of similar computed score?

  1. It may warrant attention because catastrophic impact can be unacceptable even at low likelihood Correct answer.
  2. It should be reclassified as an opportunity
  3. It should always be ignored because likelihood is low
  4. It can be transferred only through avoidance

Explanation

Low-likelihood, high-impact risks can be unacceptable because a single event could be catastrophic, so they often require contingency planning and monitoring even when their computed score is moderate. Likelihood alone does not determine priority.

Question 49Cybersecurity Risk Management and Frameworks

What is the purpose of a business impact analysis (BIA) in risk management?

  1. To identify critical business functions and the impact of their disruption Correct answer.
  2. To define the encryption algorithms used for data at rest
  3. To enumerate all open network ports on servers
  4. To calculate the annualized rate of occurrence for threats

Explanation

A BIA identifies critical business processes and quantifies the operational and financial impact if they are disrupted, informing recovery priorities and continuity planning. Port scanning, ARO calculation, and encryption selection are unrelated activities.

Question 50Cybersecurity Risk Management and Frameworks

Which statement best captures the relationship between threats, vulnerabilities, and risk?

  1. Risk arises when a threat can exploit a vulnerability and cause impact Correct answer.
  2. Risk exists only when a vulnerability has already been exploited
  3. Risk is eliminated whenever a vulnerability is documented
  4. Threats and vulnerabilities are the same concept

Explanation

Risk emerges from the interaction of a threat source, a vulnerability, and the resulting impact on an asset. Documenting a vulnerability does not eliminate risk, and threats and vulnerabilities are distinct concepts.