I85PREP
⌘ K
CCSE study materials
CCSE study resources

CCSE (CrowdStrike Certifications) practice questions

One question at a time. Build your CCSE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Management

In a security management program, what is the primary purpose of a risk assessment?

  1. To certify that all systems comply with a chosen technical standard
  2. To document disciplinary actions taken against employees who violate policy
  3. To schedule penetration tests for the coming fiscal year
  4. To identify assets, threats, and vulnerabilities and estimate the resulting level of risk Correct answer.

Explanation

Risk assessment is the analytical process of identifying assets and the threats and vulnerabilities that affect them, then estimating likelihood and impact to determine risk levels. Its output feeds prioritization and treatment decisions, not disciplinary or scheduling activities.

Question 2Security Management

Which statement best describes the concept of defense in depth?

  1. Relying on a single strong perimeter firewall to block all threats
  2. Layering multiple independent controls so that failure of one does not expose the asset Correct answer.
  3. Encrypting every file on every endpoint as the sole security measure
  4. Outsourcing all security operations to a third-party provider

Explanation

Defense in depth places multiple, ideally independent, controls across people, process, and technology so that a single failure or bypass does not lead to compromise. The layers compensate for one another rather than depending on one control.

Question 3Security Management

What does the principle of least privilege require?

  1. Giving users only the access necessary to perform their assigned duties Correct answer.
  2. Granting each user the broadest access needed for any task they might perform
  3. Requiring two approvers for every access request
  4. Rotating administrator passwords on a fixed schedule

Explanation

Least privilege limits rights to the minimum necessary for a user's assigned work, reducing the blast radius of misuse or compromise. Broader access, even if convenient, violates the principle.

Question 4Security Management

Which element is typically considered the most critical input when classifying information assets?

  1. The number of employees who have requested access to it
  2. The business value and sensitivity of the information to the organization Correct answer.
  3. The physical size of the storage media holding the asset
  4. The vendor that manufactured the server hosting it

Explanation

Classification is driven by the value and sensitivity of information to the organization, since that determines the protection required. Media size, access requests, and hardware vendor are not determinants of sensitivity.

Question 5Security Management

A security manager is drafting an acceptable use policy. Which content belongs in that policy?

  1. The organizational chart of the security team
  2. The vendor contract terms for cloud hosting
  3. The rules governing how employees may use organizational systems and data Correct answer.
  4. The detailed steps for restoring servers after a ransomware event

Explanation

An acceptable use policy defines permitted and prohibited use of organizational systems, data, and devices by users. Recovery procedures belong in a disaster recovery plan, and the other items are unrelated to user conduct.

Question 6Security Management

What is the main objective of a business impact analysis (BIA)?

  1. To test the technical skill of the security operations team
  2. To determine the criticality of business functions and their recovery requirements Correct answer.
  3. To calculate the annual budget for security tooling
  4. To enumerate every known software vulnerability in the environment

Explanation

A BIA identifies critical business functions and establishes recovery time and recovery point objectives by assessing the impact of disruption. It informs continuity planning rather than vulnerability scanning or budgeting.

Question 7Security Management

Which of the following is an example of a preventive security control?

  1. A badge reader that restricts entry to a data center Correct answer.
  2. A backup restored after a disk failure
  3. A forensic report produced after an intrusion
  4. A log review performed weekly by analysts

Explanation

Preventive controls stop or deter an event before it occurs; a badge reader restricts access and thus prevents unauthorized entry. Log reviews are detective, backups are corrective, and forensic reports are reactive.

Question 8Security Management

What distinguishes a vulnerability from a threat in security risk terminology?

  1. A vulnerability is always human-caused, while a threat is always environmental
  2. A vulnerability is a realized incident, while a threat is an unconfirmed rumor
  3. A vulnerability exists only in software, while a threat exists only in networks
  4. A vulnerability is a weakness that can be exploited, while a threat is a potential cause of harm Correct answer.

Explanation

A vulnerability is a weakness in an asset or control that could be exploited, whereas a threat is any potential source or cause of harm that might exploit it. The two are distinct concepts that combine to produce risk.

Question 9Security Management

An organization wants to reduce the likelihood that a departing employee retains access to systems. Which control most directly addresses this?

  1. Requiring departing staff to sign a new acceptable use policy
  2. Running a full vulnerability scan on the day of departure
  3. Increasing password complexity requirements for all staff
  4. Executing a documented access revocation step in the offboarding process Correct answer.

Explanation

Timely revocation of accounts and credentials during offboarding directly removes the departing employee's access. Password complexity and scanning do not remove existing accounts, and a new policy signature does not revoke access.

Question 10Security Management

A company must comply with a regulation requiring encryption of personal data at rest. Which action best demonstrates this control is operating effectively?

  1. Purchasing encryption software licenses for the year
  2. Documenting the encryption standard in the security policy
  3. Assigning an owner to the encryption project
  4. Reviewing configuration evidence showing encryption is enabled on in-scope data stores Correct answer.

Explanation

Operating effectiveness is shown by evidence that the control actually functions, such as configuration data confirming encryption is enabled on in-scope stores. Documentation, ownership, and licensing support the control but do not prove it works.

Question 11Security Management

A risk has an estimated annualized loss expectancy of 200,000 and a control would reduce it to 50,000 at an annual cost of 40,000. How should the security manager justify the control?

  1. Defer it because loss expectancy figures are always unreliable
  2. Approve it because the expected risk reduction of 150,000 exceeds the 40,000 cost Correct answer.
  3. Reject it because the control cost exceeds the residual risk
  4. Approve it only if the control cost equals the residual risk

Explanation

The control reduces expected annual loss from 200,000 to 50,000, a benefit of 150,000 against a 40,000 cost, so it is economically justified. Cost-benefit comparison, not equality or rejection on absolute cost, drives the decision.

Question 12Security Management

During an incident, which activity is part of the containment phase?

  1. Isolating affected hosts to prevent further spread of the compromise Correct answer.
  2. Determining the root cause through detailed forensic analysis
  3. Notifying regulators of the breach
  4. Updating the risk register with the incident's lessons learned

Explanation

Containment focuses on limiting the scope and spread of an incident, for example by isolating affected hosts. Root-cause analysis, register updates, and notifications occur in later phases.

Question 13Security Management

Why should security roles and responsibilities be documented in a security program?

  1. To eliminate the need for management oversight
  2. To replace the need for written security policies
  3. To ensure accountability and clarify who performs each control Correct answer.
  4. To satisfy the requirement that every employee be an administrator

Explanation

Documenting roles establishes accountability and makes clear who is responsible for each control, which supports governance and effective operation. It does not grant universal admin rights or remove oversight and policy needs.

Question 14Security Management

A third-party vendor will process sensitive customer data. Which action is most appropriate before signing the contract?

  1. Deferring all security review until after the first data breach
  2. Assuming the vendor complies because it is a large company
  3. Performing a security due-diligence assessment of the vendor's controls Correct answer.
  4. Relying on the vendor's marketing materials as proof of security

Explanation

Due diligence evaluates whether a vendor's controls adequately protect the data before contractual commitment. Marketing claims, company size, and post-breach review are insufficient or too late.

Question 15Security Management

Which metric best indicates whether a patch management process is working?

  1. The number of security staff assigned to the patching team
  2. The total count of servers in the data center
  3. The percentage of critical patches applied within the defined remediation window Correct answer.
  4. The number of vulnerabilities published in the vendor's advisory feed

Explanation

An effective metric measures performance against the process goal, such as the percentage of critical patches applied within the agreed window. External advisories, inventory counts, and staffing levels do not measure process effectiveness.

Question 16Security Management

An employee reports a suspicious email to the security team. From a security awareness perspective, what does this behavior most likely indicate?

  1. The employee has administrator privileges
  2. The email gateway has failed completely
  3. The awareness program is successfully encouraging reporting Correct answer.
  4. The organization has no incident response process

Explanation

Reporting suspicious messages is a desired outcome of awareness training, showing that staff recognize and escalate potential threats. It does not imply privileges, gateway failure, or the absence of a response process.

Question 17Security Management

What is the purpose of segregating duties in a security-sensitive process such as change management?

  1. To increase the number of people required for routine tasks
  2. To eliminate the need for audit logging
  3. To prevent one individual from controlling all aspects of a transaction or change Correct answer.
  4. To allow one person to approve and implement changes quickly

Explanation

Segregation of duties divides responsibilities so no single person can both initiate and approve a sensitive action, reducing fraud and error risk. It intentionally slows single-person control rather than speeding it, and it does not remove logging needs.

Question 18Security Management

A security manager must choose how to treat a risk that exceeds the organization's tolerance and cannot be mitigated cost-effectively. Which treatment option avoids retaining the risk?

  1. Ignoring the risk until the next annual review
  2. Lowering the risk threshold so the risk appears acceptable
  3. Accepting the risk and documenting the decision
  4. Transferring the risk through insurance or contractual means Correct answer.

Explanation

When mitigation is not cost-effective, transferring risk via insurance or contracts shifts the financial consequence. Acceptance retains the risk, ignoring it is negligent, and manipulating thresholds does not change the underlying exposure.

Question 19Security Management

Which practice best supports the integrity of security logs used in investigations?

  1. Deleting logs after 30 days to save storage
  2. Applying access controls and tamper-evident storage to log data Correct answer.
  3. Allowing administrators to edit logs freely to correct errors
  4. Storing logs on the same system they monitor without protection

Explanation

Log integrity depends on restricting who can modify logs and using tamper-evident mechanisms so records can be trusted as evidence. Free editing, co-location without protection, and rapid deletion undermine integrity.

Question 20Security Management

An organization adopts a formal risk register. What is its main function in security management?

  1. To list all software licenses owned by the company
  2. To document the network topology diagram
  3. To record identified risks, their owners, ratings, and treatment status Correct answer.
  4. To store employee performance reviews

Explanation

A risk register is the central record of identified risks along with owners, assessed ratings, and treatment decisions, enabling tracking and accountability. It is not a repository for HR, licensing, or topology data.

Question 21Security Management

A security manager is aligning the program with a recognized framework to structure controls. Which benefit most directly results from this alignment?

  1. Guaranteed elimination of all security incidents
  2. A structured, comparable basis for selecting and assessing controls Correct answer.
  3. Automatic legal immunity from regulatory penalties
  4. Removal of the need for internal audits

Explanation

Frameworks provide a structured and comparable catalog of controls that supports selection, assessment, and communication of the security program. They do not guarantee zero incidents, confer legal immunity, or remove audit needs.

Question 22Security Management

An organization discovers that a critical supplier has suffered a breach affecting shared data. Which sequence best reflects sound third-party incident coordination?

  1. Assess exposure, invoke contractual notification terms, and coordinate containment with the supplier Correct answer.
  2. Assume the shared data was unaffected because the supplier has not called
  3. Wait for the supplier to publish a public statement before taking any internal action
  4. Immediately terminate the contract without assessing data exposure

Explanation

Sound coordination means assessing which shared data and systems are exposed, invoking the contractual notification and cooperation clauses, and working with the supplier on containment. Passivity, unilateral termination, and assumptions of safety are poor responses.

Question 23Security Management

A control was designed well but testing shows it operates inconsistently across business units. Which conclusion is most accurate?

  1. Testing results should be disregarded because design matters more than operation
  2. The control design is flawed and must be redesigned from scratch
  3. The control design may be sound, but operating effectiveness is deficient and needs remediation Correct answer.
  4. The control is fully effective because the design is correct

Explanation

Design and operating effectiveness are assessed separately; a sound design that performs inconsistently indicates an operating deficiency requiring remediation. It does not necessarily mean the design is flawed, nor that the control is effective.

Question 24Security Management

Leadership asks why security metrics should be tied to business objectives rather than counting raw events. Which rationale is strongest?

  1. Business-aligned metrics show how security affects organizational risk and value, enabling better decisions Correct answer.
  2. Raw event counts are always inaccurate and should never be collected
  3. Counting events requires more storage than leadership will approve
  4. Business objectives are unrelated to security performance

Explanation

Metrics linked to business objectives translate security activity into terms of risk and value, which supports informed leadership decisions. Raw counts may be accurate but lack context, and business objectives are directly relevant to security.

Question 25Security Management

An auditor finds that risk acceptance decisions are made informally by individual engineers. Which governance change best addresses this finding?

  1. Prohibit any risk acceptance and require full mitigation of every risk
  2. Delegate all risk acceptance to the engineering team to speed decisions
  3. Remove the risk register to avoid recording accepted risks
  4. Establish a formal risk acceptance process with defined authority levels and documented approval Correct answer.

Explanation

Formal risk acceptance requires defined authority levels, documented rationale, and approval by accountable parties, which addresses informal decisions. Delegating broadly, prohibiting acceptance entirely, or removing records does not establish proper governance.

Question 26Security Management

Which document typically defines the security team's authority, scope, and reporting lines within the organization?

  1. The vendor onboarding checklist
  2. The disaster recovery runbook
  3. The asset inventory register
  4. The information security charter or policy Correct answer.

Explanation

A security charter or top-level policy establishes mandate, scope, and reporting authority for the security function. Runbooks, inventories, and checklists are operational artifacts that depend on that mandate rather than defining it.

Question 27Security Management

In security management, what does the principle of least privilege require?

  1. All administrators share a single privileged account
  2. Every employee receives read access to all systems
  3. Access rights are granted permanently to reduce tickets
  4. Users receive only the access needed for their current duties Correct answer.

Explanation

Least privilege means granting the minimum rights necessary to perform assigned tasks, for the minimum time needed. This limits the blast radius of misuse or compromise. Shared accounts and broad default access directly contradict the principle.

Question 28Security Management

Which element of the CIA triad is most directly affected when an attacker alters a financial transaction record?

  1. Availability
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Confidentiality

Explanation

Integrity concerns the accuracy and completeness of data, so unauthorized modification of a transaction record is an integrity failure. Availability concerns access to systems, confidentiality concerns disclosure, and non-repudiation is a related assurance property rather than a CIA pillar.

Question 29Security Management

What is the primary purpose of a security awareness program?

  1. To replace technical controls with user vigilance
  2. To satisfy auditors without changing behavior
  3. To shape employee behavior so risks are recognized and reported Correct answer.
  4. To certify staff as security engineers

Explanation

Awareness programs aim to build lasting behavior change so employees recognize threats and respond appropriately, such as reporting phishing. They complement technical controls rather than substitute for them, and they are not professional certification paths.

Question 30Security Management

Which classification label best applies to data whose unauthorized disclosure would cause severe harm to the organization or its customers?

  1. Confidential or restricted Correct answer.
  2. Public
  3. Internal-only
  4. Declassified

Explanation

Classification schemes place the most sensitive data in a restricted or confidential tier that carries the strictest handling rules. Public and internal-only tiers apply to data with low or moderate disclosure impact. Declassified is not a standard corporate sensitivity tier.

Question 31Security Management

What is the main role of an incident response plan?

  1. To document firewall rule changes
  2. To define roles, steps, and communication paths before an incident occurs Correct answer.
  3. To list every possible malware variant
  4. To replace the business continuity plan

Explanation

An incident response plan predefines roles, escalation paths, and phase-by-phase actions so the team can respond consistently under pressure. It is not a threat encyclopedia, a continuity substitute, or a change log.

Question 32Security Management

Which activity belongs to the recovery phase of an incident rather than containment?

  1. Restoring systems from validated backups and confirming normal operation Correct answer.
  2. Resetting compromised credentials
  3. Isolating an infected host from the network
  4. Blocking a malicious IP at the perimeter

Explanation

Recovery focuses on restoring affected services to normal operation from trusted backups and verifying integrity. Isolation, perimeter blocking, and credential resets are containment actions that stop the spread before recovery begins.

Question 33Security Management

Why does security management require asset owners to be identified for critical information systems?

  1. Owners personally perform all security testing
  2. Owners set the organization's overall risk appetite
  3. Owners are accountable for classification, access approval, and risk decisions Correct answer.
  4. Owners eliminate the need for a security team

Explanation

Assigning ownership creates clear accountability for classifying data, approving access, and accepting or escalating risk for a system. Owners do not personally conduct all testing, nor do they replace the security function or set enterprise risk appetite.

Question 34Security Management

An organization wants to ensure that a terminated contractor's access is revoked within one hour. Which mechanism most reliably enforces this?

  1. A quarterly access recertification campaign
  2. An annual reminder email to managers
  3. A manual ticket raised by the contractor's colleague
  4. Automated deprovisioning triggered by the HR termination record Correct answer.

Explanation

Automated deprovisioning tied to the authoritative HR record enforces a timely, repeatable revocation without relying on memory. Periodic recertification and manual tickets introduce delay and human error that cannot meet a one-hour requirement.

Question 35Security Management

A security team must demonstrate that access to a regulated system is limited to approved staff. Which evidence most directly supports this during an audit?

  1. The number of security incidents closed last year
  2. Current access lists reconciled to approved requests and role definitions Correct answer.
  3. The vendor's product datasheet
  4. The system's uptime report for the quarter

Explanation

Auditors look for reconciliation between who has access and who is authorized, backed by approval records and role definitions. Uptime, incident counts, and vendor materials do not demonstrate that access is appropriately restricted.

Question 36Security Management

A security policy states that all laptops must use full-disk encryption. Which artifact best translates this policy into an enforceable standard?

  1. A training slide deck on phishing
  2. A technical specification naming approved encryption algorithms and configuration settings Correct answer.
  3. A memo reminding staff to be careful with laptops
  4. A list of laptop serial numbers

Explanation

Standards convert policy intent into specific, measurable requirements such as approved algorithms and configuration baselines. Reminders, asset lists, and phishing training do not specify how encryption must be implemented or verified.

Question 37Security Management

During a tabletop exercise, participants discover that no one knows who is authorized to notify regulators after a breach. Which gap does this most directly reveal?

  1. Undefined incident communication roles and escalation paths Correct answer.
  2. Inadequate backup retention
  3. Weak encryption key management
  4. Insufficient network segmentation

Explanation

Not knowing who notifies regulators points to missing communication roles and escalation procedures in the response plan. Segmentation, key management, and backup retention are technical controls unrelated to notification authority.

Question 38Security Management

A company operates in a jurisdiction requiring breach notification within 72 hours. Which capability is most important to support this obligation?

  1. Quarterly phishing simulations
  2. Rapid detection and triage to confirm scope within the deadline Correct answer.
  3. A five-year log retention policy
  4. Annual penetration testing of all applications

Explanation

Meeting a 72-hour notification deadline depends on detecting and triaging incidents quickly enough to determine scope and whether notification is required. Pentesting, retention, and simulations are valuable but do not directly enable timely breach assessment.

Question 39Security Management

What distinguishes a security standard from a security procedure?

  1. A standard applies only to vendors, while a procedure applies to staff
  2. A standard is optional guidance, while a procedure is mandatory
  3. A standard is technical, while a procedure is always legal
  4. A standard states mandatory requirements, while a procedure gives step-by-step instructions Correct answer.

Explanation

Standards define what must be done and the mandatory requirements, whereas procedures describe how tasks are performed step by step. Standards are not optional, vendor-only, or inherently non-technical.

Question 40Security Management

A security manager needs to prioritize remediation across many findings. Which approach best aligns remediation with organizational risk?

  1. Fix findings in the order they were discovered
  2. Prioritize the findings that are easiest to fix
  3. Rank findings by likelihood and impact against business-critical assets Correct answer.
  4. Address only findings flagged by external auditors

Explanation

Risk-based prioritization weighs likelihood and business impact so effort targets the exposures that matter most. Discovery order, ease of fix, and auditor flags do not reflect actual risk to critical assets.

Question 41Security Management

Which control type is a security camera recording in a data center lobby?

  1. Preventive
  2. Corrective
  3. Detective Correct answer.
  4. Compensating

Explanation

Cameras record activity to identify and investigate events after or during occurrence, which is detective. They do not physically stop an intruder, restore anything, or stand in for another control.

Question 42Security Management

An organization wants assurance that a cloud provider's security controls remain effective over time. Which arrangement best provides ongoing assurance?

  1. Verbal assurances from the sales representative
  2. A one-time questionnaire completed before signing
  3. The provider's marketing brochure
  4. Contractual right to audit plus periodic independent attestation reports Correct answer.

Explanation

Ongoing assurance comes from a contractual audit right combined with recurring independent attestations such as SOC reports. A one-time questionnaire, brochure, or verbal statement provides no continuing evidence.

Question 43Security Management

Why should security exceptions be time-bound and formally approved?

  1. To ensure the residual risk is accepted knowingly and revisited before expiry Correct answer.
  2. To avoid documenting the exception
  3. To permanently exempt teams from all controls
  4. To shift liability to the vendor

Explanation

Time-bound exceptions with formal approval ensure that residual risk is consciously accepted by an accountable party and reviewed before it persists indefinitely. Exceptions are not permanent blanket waivers, should be documented, and do not transfer liability.

Question 44Security Management

A security team wants to measure whether vulnerability remediation is timely. Which metric is most appropriate?

  1. Number of security staff employed
  2. Count of firewall rules configured
  3. Median time from vulnerability detection to remediation by severity Correct answer.
  4. Total number of vulnerabilities ever recorded

Explanation

Time-to-remediate segmented by severity shows whether critical flaws are fixed promptly, which reflects process effectiveness. Raw lifetime counts, staffing levels, and rule counts do not measure remediation timeliness.

Question 45Security Management

What is the purpose of a data retention schedule in security management?

  1. To classify users by department
  2. To define how long data is kept and when it is securely destroyed Correct answer.
  3. To guarantee data is never deleted
  4. To increase storage capacity

Explanation

A retention schedule specifies minimum and maximum retention periods and the secure destruction method once the period ends, reducing legal and exposure risk. It does not forbid deletion, address capacity, or classify users.

Question 46Security Management

A business unit requests a new SaaS tool that will store customer records. Which security step should occur before approval?

  1. A risk assessment covering data sensitivity, vendor controls, and contractual safeguards Correct answer.
  2. Deployment followed by a retrospective review
  3. A penetration test of the vendor performed by the requester
  4. Immediate approval to avoid delaying the business

Explanation

A pre-approval risk assessment evaluates data sensitivity, the vendor's controls, and required contractual protections so risk is understood before data is entrusted. Rubber-stamping, requester-led testing, and post-deployment review expose data before safeguards are confirmed.

Question 47Security Management

A security manager finds that incident logs are stored on the same server they monitor, and an attacker with root access could alter them. Which change most improves investigative integrity?

  1. Increase the local log file size limit
  2. Restrict log review to a single analyst
  3. Forward logs in near real time to a hardened, access-controlled central system Correct answer.
  4. Encrypt the local log file with a key stored on the same server

Explanation

Centralizing logs on a separate, hardened system with strict access limits an attacker's ability to tamper with evidence on a compromised host. Larger local files, single-analyst review, and keys stored alongside the data do not prevent alteration by a root-level attacker.

Question 48Security Management

An organization's risk appetite statement permits only low residual risk for payment systems. A proposed architecture leaves medium residual risk after controls. What is the most appropriate governance action?

  1. Lower the risk rating without new evidence
  2. Silently proceed because controls were applied
  3. Escalate to the accountable executive for a documented decision to accept, add controls, or reject Correct answer.
  4. Delegate the decision to the vendor

Explanation

When residual risk exceeds the stated appetite, it must be escalated to the accountable executive for a documented accept, mitigate, or reject decision. Proceeding silently, re-rating without evidence, or delegating to a vendor bypasses governance.

Question 49Security Management

A security program reports high patch compliance but a recent breach exploited an unpatched internet-facing service. Which analysis is most useful?

  1. Examine whether patch reporting covers all internet-facing assets and critical exceptions Correct answer.
  2. Remove internet-facing services from the compliance metric
  3. Increase the reporting frequency without changing scope
  4. Conclude the metric is accurate and the breach was unavoidable

Explanation

A compliance figure that misses exposed assets or critical exceptions can look healthy while real risk persists, so scope and exception coverage should be examined. Concluding the metric is accurate, merely reporting more often, or excluding exposed systems would hide the gap.

Question 50Security Management

During a crisis, executives receive conflicting status updates from security and operations. Which governance mechanism best resolves this?

  1. Suspending all updates until the incident closes
  2. Additional parallel communication channels for each team
  3. A predefined incident communication structure with a single coordinating authority Correct answer.
  4. A rule that only executives may speak to staff

Explanation

A defined communication structure with one coordinating authority ensures consistent, authoritative updates and clear escalation. Adding parallel channels, restricting speech, or halting updates worsens confusion during a crisis.