I85PREP
⌘ K
CP-C study materials
CP-C study resources

CP-C practice questions

One question at a time. Build your CP-C understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Domain 1 (unverified placeholder - source returned no content)

Which property of the CIA triad ensures that data is disclosed only to authorized individuals?

  1. Non-repudiation
  2. Integrity
  3. Confidentiality Correct answer.
  4. Availability

Explanation

The CIA triad describes three core security goals. Confidentiality limits information access to authorized parties, while integrity addresses unauthorized change and availability addresses timely access.

Question 2Domain 1 (unverified placeholder - source returned no content)

Which pairing constitutes multi-factor authentication?

  1. A password plus a security question answered from memory
  2. A username plus a password entered on the same screen
  3. A password followed by a second, different password
  4. A password plus a one-time code from an authenticator app Correct answer.

Explanation

Multi-factor authentication requires factors from at least two different categories, such as something you know plus something you have. A password and a code generated by a device combine a knowledge factor with a possession factor.

Question 3Domain 1 (unverified placeholder - source returned no content)

Which description best characterizes phishing?

  1. Guessing passwords repeatedly until one is accepted
  2. Flooding a network with traffic until it stops responding
  3. Intercepting traffic on a local network segment
  4. Deceiving users into revealing credentials through fraudulent messages Correct answer.

Explanation

Phishing is a social engineering technique that relies on deceptive communications, often email or text, that impersonate a trusted party. The goal is typically to obtain credentials, payment, or malware execution from the recipient.

Question 4Domain 1 (unverified placeholder - source returned no content)

Which practice best reflects the principle of least privilege?

  1. Giving users only the access required to perform their assigned tasks Correct answer.
  2. Requiring two approvers for every access request
  3. Granting every user full administrative rights to avoid support tickets
  4. Rotating administrative passwords on a fixed schedule

Explanation

Least privilege means each account receives the minimum access necessary for its function, and no more. This limits the damage that a compromised or misused account can cause.

Question 5Domain 1 (unverified placeholder - source returned no content)

How does symmetric encryption protect data?

  1. It uses a public key to encrypt and a private key to decrypt
  2. It uses a single shared key for both encryption and decryption Correct answer.
  3. It uses a hash of the plaintext as the decryption key
  4. It generates two unrelated keys independently for each message

Explanation

Symmetric algorithms such as AES use the same secret key for encryption and decryption, so both parties must already share that key securely. This makes symmetric ciphers fast but creates a key distribution problem.

Question 6Domain 1 (unverified placeholder - source returned no content)

What is the purpose of adding a unique salt to each stored password hash?

  1. To encrypt the password so it can be recovered if forgotten
  2. To shorten the hash output so it fits in a database column
  3. To increase the length of the password the user must type
  4. To ensure identical passwords produce different stored hash values Correct answer.

Explanation

A salt is random data combined with the password before hashing, so two users with the same password store different digests. This defeats precomputed lookup tables and prevents attackers from cracking many accounts with one computation.

Question 7Domain 1 (unverified placeholder - source returned no content)

Which statement describes the 3-2-1 backup rule?

  1. Three administrators, two approvals, one backup performed monthly
  2. Three copies of data, on two media types, with one copy stored off-site Correct answer.
  3. Three restore tests, two audits, and one annual policy review
  4. Three copies in one data center protected by two separate encryption keys

Explanation

The 3-2-1 rule keeps three copies of data, stores them on two different media types, and keeps one copy off-site. This reduces the chance that a single failure, theft, or site disaster destroys every copy.

Question 8Domain 1 (unverified placeholder - source returned no content)

In the NIST incident response lifecycle, which phase comes first?

  1. Lessons learned
  2. Recovery
  3. Preparation Correct answer.
  4. Eradication

Explanation

The lifecycle begins with preparation, in which policies, tooling, training, and communication paths are established before an event occurs. Detection and analysis, containment, eradication, recovery, and post-incident activity follow.

Question 9Domain 1 (unverified placeholder - source returned no content)

How is risk best expressed in security risk management?

  1. The total number of vulnerabilities reported by a scanner
  2. The combination of the likelihood of a threat event and its impact Correct answer.
  3. Any weakness in a system that could be exploited by an attacker
  4. The cost of the security controls currently deployed

Explanation

Risk combines how likely a threat event is with the harm it would cause, often expressed as likelihood multiplied by impact. Reducing either element reduces the overall risk.

Question 10Domain 1 (unverified placeholder - source returned no content)

What does a defense-in-depth strategy require?

  1. Layering multiple independent controls so one failure is not fatal Correct answer.
  2. Relying on a single, highly rated perimeter firewall
  3. Encrypting every file with the same organization-wide key
  4. Restricting all security decisions to the executive team

Explanation

Defense in depth places overlapping controls at multiple layers, such as network, host, application, and identity. If one control fails or is bypassed, others still reduce the likelihood or impact of compromise.

Question 11Domain 1 (unverified placeholder - source returned no content)

An access control model that decides each request using attributes of the user, the resource, and the environment is called what?

  1. Discretionary access control
  2. Attribute-based access control Correct answer.
  3. Mandatory access control
  4. Role-based access control

Explanation

Attribute-based access control evaluates policies against attributes such as department, clearance, device posture, time, and location. This allows fine-grained, context-aware decisions rather than static role assignments.

Question 12Domain 1 (unverified placeholder - source returned no content)

What security properties does a digital signature provide to a recipient?

  1. Reduction in size of large attachments
  2. Confidentiality of the message contents in transit
  3. Proof of origin and detection of modification Correct answer.
  4. Guaranteed delivery of the message to the recipient

Explanation

A signature generated with a private key can be verified by anyone holding the corresponding public key. Verification confirms who signed and reveals whether the content changed, supporting non-repudiation.

Question 13Domain 1 (unverified placeholder - source returned no content)

What does TLS protect when a user connects to a website over HTTPS?

  1. Data stored on the server's disk at rest
  2. The server against SQL injection attacks
  3. Data in transit between the browser and the server Correct answer.
  4. User passwords from being reused on other sites

Explanation

TLS establishes an encrypted, integrity-protected channel between client and server, shielding data in transit from eavesdropping and tampering. It does not govern how data is stored or how the application handles input.

Question 14Domain 1 (unverified placeholder - source returned no content)

Which statement captures the core idea of zero trust architecture?

  1. Trusting all devices connected to the corporate network
  2. Verifying every request as though it came from an untrusted network Correct answer.
  3. Removing authentication to reduce friction for users
  4. Relying on a single VPN concentrator for all remote access

Explanation

Zero trust removes implicit trust based on network location and requires each request to be authenticated and authorized based on policy. Access decisions are continuously evaluated rather than granted once at the perimeter.

Question 15Domain 1 (unverified placeholder - source returned no content)

How does a threat differ from a vulnerability?

  1. The two terms are synonyms and are used interchangeably in risk registers
  2. A threat could cause harm, while a vulnerability is a weakness it exploits Correct answer.
  3. A threat is always accidental, while a vulnerability is always deliberate
  4. A threat is an internal weakness, while a vulnerability is an external malicious actor

Explanation

A threat is anything with the potential to cause harm, such as an attacker or a flood. A vulnerability is a flaw or gap that a threat could use to cause that harm.

Question 16Domain 1 (unverified placeholder - source returned no content)

A team cannot patch every system at once. Which approach best prioritizes remediation?

  1. Patch in alphabetical order of the vendor's company name
  2. Prioritize internet-facing systems with known exploited flaws Correct answer.
  3. Patch the systems with the most users first regardless of severity
  4. Patch only after a breach has already been confirmed

Explanation

Prioritization should weigh exposure and exploitability alongside severity, so internet-facing assets with actively exploited vulnerabilities come first. This reduces the window in which the most reachable and most dangerous flaws can be used.

Question 17Domain 1 (unverified placeholder - source returned no content)

Which property is expected of a cryptographic hash function?

  1. It always produces output longer than the input message
  2. It is computationally infeasible to reverse the digest to the input Correct answer.
  3. It can be decrypted with the sender's private key
  4. It produces a different digest each time the same input is hashed

Explanation

Hash functions are one-way: deriving the original input from the digest should be impractical, while the same input always yields the same digest. These properties make hashes useful for integrity checks and password storage.

Question 18Domain 1 (unverified placeholder - source returned no content)

What does a recovery time objective (RTO) specify?

  1. The interval between scheduled backups of the database
  2. The maximum acceptable time to restore a service after disruption Correct answer.
  3. The time required to complete an annual risk assessment
  4. The maximum period of data loss the business can tolerate

Explanation

The RTO sets the target elapsed time within which a service must be restored after an outage. It drives recovery design and is distinct from the recovery point objective, which concerns acceptable data loss.

Question 19Domain 1 (unverified placeholder - source returned no content)

An attacker calls the help desk posing as a vendor engineer and asks for a password reset. Which technique is this?

  1. Physically following an employee into a secured door
  2. Sending bulk email to many recipients hoping some respond
  3. Inventing a scenario to persuade a target to disclose information Correct answer.
  4. Installing malware through a compromised software update

Explanation

Pretexting uses a fabricated scenario and assumed identity to convince a target to comply with a request. The invented story provides the credibility the attacker needs to obtain information or an action.

Question 20Domain 1 (unverified placeholder - source returned no content)

Why does an organization classify its data into sensitivity tiers?

  1. To determine which employees receive a salary increase
  2. To match handling controls to the sensitivity of the data Correct answer.
  3. To assign legal ownership of the data to the IT department
  4. To reduce the storage cost of archived records

Explanation

Classification drives proportionate handling rules such as encryption, retention, and sharing restrictions. Higher tiers receive stricter controls, which keeps effort aligned with the harm that disclosure would cause.

Question 21Domain 1 (unverified placeholder - source returned no content)

In a public key infrastructure, how is a server certificate normally validated?

  1. The server signs the root certificate before each session begins
  2. The client generates the server's private key during the handshake
  3. A trusted root signs an intermediate CA, which signs the server certificate Correct answer.
  4. Each certificate is self-signed and no authority is involved

Explanation

Validation walks a chain from the server certificate up through one or more intermediate authorities to a root the client already trusts. Each certificate in the chain carries a signature from the level above it.

Question 22Domain 1 (unverified placeholder - source returned no content)

Using a key derivation function with a random salt and a high iteration count mainly defends stored passwords against which attack?

  1. Offline brute-force and precomputed rainbow table attacks Correct answer.
  2. Network eavesdropping on the login form
  3. Session fixation in the web application
  4. SQL injection in the login database query

Explanation

Salting defeats precomputed tables, and a high work factor makes each guess expensive once an attacker has the hash file. Together they slow offline cracking even when the database is stolen.

Question 23Domain 1 (unverified placeholder - source returned no content)

Why does TLS use hybrid encryption for a session?

  1. Both parties must share the same long-term secret key before the session starts
  2. The session data is encrypted only with the server's long-term RSA private key
  3. Asymmetric crypto exchanges a key used for symmetric session encryption Correct answer.
  4. Hashing replaces encryption for all application data

Explanation

Public key operations solve the key distribution problem, while symmetric ciphers handle bulk data far more efficiently. The handshake uses asymmetric cryptography to agree on a shared session key that then protects the traffic.

Question 24Domain 1 (unverified placeholder - source returned no content)

An organization buys a cyber insurance policy to cover breach costs. Which risk treatment is this?

  1. Risk transference Correct answer.
  2. Risk avoidance
  3. Risk mitigation
  4. Risk acceptance

Explanation

Risk transference shifts the financial consequence of a risk to another party, commonly through insurance or contractual terms. The underlying risk still exists; only the cost burden moves.

Question 25Domain 1 (unverified placeholder - source returned no content)

When collecting digital evidence from a running system, which order of volatility should guide collection?

  1. Printed backups before anything held in memory
  2. CPU registers and cache memory before disk storage Correct answer.
  3. Archived tape media before active network connections
  4. Remote log servers before the local RAM contents

Explanation

Evidence should be captured from the most perishable sources first, since memory and processor state change or vanish quickly. Persistent media such as disks and archives can be imaged later with less risk of loss.

Question 26Domain 1 (unverified placeholder - source returned no content)

Which security property is primarily concerned with preventing unauthorized modification of data?

  1. Non-repudiation
  2. Confidentiality
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity ensures that data remains accurate and complete and has not been altered by unauthorized parties. Confidentiality limits disclosure, availability ensures timely access, and non-repudiation prevents denial of an action.

Question 27Domain 1 (unverified placeholder - source returned no content)

Which combination of authentication factors qualifies as multifactor authentication?

  1. A username followed by a four-digit personal identification number
  2. A password entered twice on the same login screen
  3. Two different passwords used on the same user account
  4. A password plus a one-time code from a token Correct answer.

Explanation

Multifactor authentication requires factors from different categories, such as knowledge, possession, and inherence. A password plus a one-time code from a token combines knowledge with possession.

Question 28Domain 1 (unverified placeholder - source returned no content)

The principle of least privilege requires that an account is granted:

  1. Only the permissions needed to perform assigned tasks Correct answer.
  2. Access to all resources after a single company-wide login
  3. Permissions granted at the discretion of the resource owner
  4. Full administrative rights for every user for convenience

Explanation

Least privilege limits access rights to the minimum necessary for assigned duties, reducing the impact of a compromised account. It does not grant broad or discretionary access by default.

Question 29Domain 1 (unverified placeholder - source returned no content)

A user receives an email that appears to come from the IT department and asks them to click a link to reset their password. Which attack type is this?

  1. Privilege escalation
  2. SQL injection
  3. Denial of service
  4. Phishing Correct answer.

Explanation

Phishing uses fraudulent messages that impersonate a trusted party to trick recipients into revealing credentials or clicking malicious links. The IT impersonation and password reset request are typical phishing indicators.

Question 30Domain 1 (unverified placeholder - source returned no content)

Encryption of data at rest primarily protects against:

  1. Unauthorized reading of data on a compromised disk Correct answer.
  2. Denial-of-service attacks that exhaust a web server's capacity
  3. Tampering with network packets while they are in transit
  4. Weak password policies applied to user accounts

Explanation

At-rest encryption protects stored data from disclosure when disks, backups, or databases are accessed without authorization. Protecting traffic in transit requires transport encryption rather than at-rest encryption.

Question 31Domain 1 (unverified placeholder - source returned no content)

Which password policy most effectively increases resistance to offline cracking?

  1. Requiring at least one uppercase letter in each password
  2. Requiring every user to change passwords every 30 days
  3. A long minimum length with random passwords Correct answer.
  4. Limiting all passwords to a maximum of 12 characters

Explanation

Long, random passwords increase the search space and make offline cracking infeasible. Composition rules alone have limited effect, and frequent forced rotation can reduce password quality.

Question 32Domain 1 (unverified placeholder - source returned no content)

What is the primary function of a network firewall?

  1. Detect malicious code inside email attachments
  2. Filter traffic between network zones by rule Correct answer.
  3. Provide backup power to network devices
  4. Encrypt every file that is stored on a server

Explanation

A firewall filters traffic based on rules such as source, destination, port, and protocol. It does not encrypt stored files, scan email content by itself, or supply power.

Question 33Domain 1 (unverified placeholder - source returned no content)

Why should an organization periodically test restoring backups?

  1. To confirm backups can be restored as required Correct answer.
  2. To satisfy the organization's password complexity requirements
  3. To increase the speed of the production network
  4. To reduce the cost of storing backup media

Explanation

A backup is only useful if it can actually be restored. Testing validates backup integrity, recovery procedures, and the ability to meet recovery time objectives.

Question 34Domain 1 (unverified placeholder - source returned no content)

In role-based access control (RBAC), permissions are assigned to:

  1. Individual users directly
  2. Resource owners, who decide access
  3. Attributes evaluated at request time
  4. Roles that users are assigned to Correct answer.

Explanation

RBAC groups permissions into roles and assigns users to those roles, which simplifies administration. Direct per-user assignment does not scale well, and request-time attributes describe attribute-based access control.

Question 35Domain 1 (unverified placeholder - source returned no content)

Which statement correctly distinguishes symmetric from asymmetric encryption?

  1. Asymmetric encryption cannot be used for exchanging keys
  2. Asymmetric encryption is always faster than symmetric encryption in practice
  3. Symmetric encryption uses one shared secret key Correct answer.
  4. Symmetric encryption uses a public and private key pair for each message

Explanation

Symmetric algorithms use one shared secret key for encryption and decryption, while asymmetric algorithms use a key pair. Symmetric encryption is generally faster and is often used for bulk data.

Question 36Domain 1 (unverified placeholder - source returned no content)

A digital certificate primarily binds:

  1. A hash value to the plaintext message it represents
  2. A public key to an identity, signed by a CA Correct answer.
  3. A private key to the password that protects it
  4. A session key to the firewall rule that permits it

Explanation

A certificate associates a public key with a subject and is signed by a certificate authority to establish trust. Private keys are not placed in certificates.

Question 37Domain 1 (unverified placeholder - source returned no content)

How does a vulnerability scan differ from a penetration test?

  1. A scan lists potential weaknesses, while a pen test attempts exploitation Correct answer.
  2. A vulnerability scan exploits flaws, while a penetration test only lists them
  3. A penetration test is performed only by automated software
  4. A vulnerability scan requires no tools, while a penetration test always uses tools

Explanation

Vulnerability scans enumerate known weaknesses and are broad and automated. Penetration tests simulate an attacker and attempt to exploit vulnerabilities to demonstrate real impact.

Question 38Domain 1 (unverified placeholder - source returned no content)

What is the main security benefit of network segmentation?

  1. It eliminates the need for user authentication
  2. It automatically encrypts all network traffic
  3. It removes the need for perimeter firewalls
  4. It limits lateral movement of attackers Correct answer.

Explanation

Segmentation divides a network into zones so an attacker who compromises one host cannot freely reach other systems. It complements authentication and firewalls rather than replacing them.

Question 39Domain 1 (unverified placeholder - source returned no content)

An intrusion detection system (IDS) differs from an intrusion prevention system (IPS) mainly because an IDS:

  1. Encrypts traffic before forwarding it
  2. Replaces the need for logging
  3. Detects suspicious traffic and alerts without blocking it Correct answer.
  4. Always blocks malicious traffic before it reaches its target

Explanation

An IDS monitors traffic and generates alerts, while an IPS is deployed inline and can drop malicious traffic. Both depend on detection logic and logging.

Question 40Domain 1 (unverified placeholder - source returned no content)

What is the primary purpose of a security information and event management (SIEM) system?

  1. To correlate logs from many sources for detection Correct answer.
  2. To assign and manage user roles in an identity provider
  3. To store backups of production databases
  4. To encrypt the hard drives of every endpoint device

Explanation

A SIEM collects and correlates logs and events from multiple sources to detect incidents and support investigation. It is not a backup, disk encryption, or identity management tool.

Question 41Domain 1 (unverified placeholder - source returned no content)

How does a business continuity plan (BCP) differ from a disaster recovery plan (DRP)?

  1. A BCP is used only after a disaster, while a DRP is used before
  2. A DRP is a subset of the BCP that covers only backups
  3. A BCP sustains business operations; a DRP restores IT systems Correct answer.
  4. A BCP focuses only on IT systems, while a DRP covers all business units

Explanation

A BCP is broader and addresses keeping critical business functions operating during disruption. A DRP is the IT-focused component that restores infrastructure and systems.

Question 42Domain 1 (unverified placeholder - source returned no content)

What is the main goal of a tabletop exercise in incident response?

  1. To scan the production network for vulnerabilities
  2. To test the speed of backup restoration under a production load
  3. To discuss a simulated scenario and evaluate plans and roles Correct answer.
  4. To replace the need for an incident response plan

Explanation

Tabletop exercises are discussion-based walkthroughs that validate decision-making, communication, and plan gaps without requiring live systems. They complement rather than replace the incident response plan.

Question 43Domain 1 (unverified placeholder - source returned no content)

Chain of custody for digital evidence is important because it:

  1. Guarantees that all evidence remains encrypted at all times
  2. Allows evidence to be modified so that it is easier to read
  3. Records who handled evidence and when, supporting admissibility Correct answer.
  4. Replaces the need to compute a hash of the evidence

Explanation

Chain of custody is an unbroken record of who controlled evidence, when, and how. It helps demonstrate integrity and supports admissibility in legal proceedings.

Question 44Domain 1 (unverified placeholder - source returned no content)

Static application security testing (SAST) analyzes:

  1. A running application from the outside
  2. Source code or binaries without running the app Correct answer.
  3. Employee security awareness records
  4. Live network traffic between the application tiers

Explanation

SAST examines source code or compiled artifacts for insecure patterns before the application runs. Dynamic testing examines a running application instead.

Question 45Domain 1 (unverified placeholder - source returned no content)

Under the cloud shared responsibility model, the customer is generally responsible for:

  1. Patching the cloud provider's hypervisor layer
  2. Operating the cloud provider's global network backbone
  3. Physical security of the cloud provider's data center
  4. Managing identities, access, and data configuration Correct answer.

Explanation

Providers secure the underlying cloud infrastructure, while customers secure what they place in the cloud, including identity, access, and data configuration. Physical security and hypervisor patching are typically provider responsibilities.

Question 46Domain 1 (unverified placeholder - source returned no content)

Why do modern protocols use ephemeral Diffie-Hellman key exchange?

  1. It eliminates the need for server certificates during the handshake
  2. It guarantees message integrity without any message authentication code
  3. It gives forward secrecy, protecting past sessions if long-term keys leak Correct answer.
  4. It makes symmetric encryption unnecessary for bulk data

Explanation

Ephemeral keys are discarded after a session, so compromise of a long-term key does not reveal past session keys. Certificates are still used to authenticate the endpoint.

Question 47Domain 1 (unverified placeholder - source returned no content)

An organization wants to reduce its attack surface. Which action best accomplishes that?

  1. Storing backups on the same server as production data
  2. Granting all users local administrator rights
  3. Adding more internet-facing web applications
  4. Disabling unused services and closing unused ports Correct answer.

Explanation

Attack surface is the set of reachable entry points; removing unused services and ports reduces it. Adding exposure or excessive privileges increases the attack surface.

Question 48Domain 1 (unverified placeholder - source returned no content)

After an incident is contained, what is the main purpose of a root cause analysis?

  1. To assign blame to an individual
  2. To delete evidence of the incident
  3. To calculate the exact financial loss from the incident
  4. To find root causes and prevent recurrence Correct answer.

Explanation

Root cause analysis identifies underlying and contributing factors so controls can be improved and the incident does not recur. Assigning blame is not the objective, and evidence must be preserved.

Question 49Domain 1 (unverified placeholder - source returned no content)

A risk is rated high before controls are applied but medium after controls. These two ratings are called:

  1. Qualitative and quantitative risk
  2. Likelihood and impact
  3. Threat and vulnerability
  4. Inherent risk and residual risk Correct answer.

Explanation

Inherent risk is the level before controls are applied, and residual risk is what remains after controls. Likelihood and impact are components used to calculate risk, not the before-and-after ratings.

Question 50Domain 1 (unverified placeholder - source returned no content)

In SAML single sign-on, what does the identity provider send to the service provider after authenticating a user?

  1. A copy of the user's private key
  2. A firewall rule that permits the user's IP address
  3. The user's plaintext password
  4. A signed assertion of identity and attributes Correct answer.

Explanation

SAML assertions are signed statements of authentication and user attributes that the service provider trusts. Passwords and private keys are not shared through SAML assertions.