I85PREP
⌘ K
CC study materials
CC study resources

CC practice questions

One question at a time. Build your CC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Principles

Which element of the CIA triad is concerned with protecting data from unauthorized modification?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Confidentiality
  4. Availability

Explanation

Integrity ensures that data is accurate, complete and has not been changed by anyone who is not authorized to change it. Mechanisms such as hashing, checksums and version control are used to detect and prevent undesired alteration.

Question 2Security Principles

Encrypting a database file so that only authorized users can read its contents primarily supports which security goal?

  1. Confidentiality Correct answer.
  2. Integrity
  3. Accountability
  4. Availability

Explanation

Encryption makes data unreadable to anyone who lacks the decryption key, which directly protects against unauthorized disclosure. Confidentiality is the goal of keeping information from being read by the wrong parties.

Question 3Security Principles

A system prompts a user for a password and validates it before granting access. What does this step perform?

  1. Accounting
  2. Auditing
  3. Authorization
  4. Authentication Correct answer.

Explanation

Authentication is the process of verifying that a subject is who it claims to be, and a password check is a classic authentication step. Authorization happens after authentication and determines what resources the verified subject may use.

Question 4Security Principles

Giving an employee only the access required to perform their current job reflects which principle?

  1. Defense in depth
  2. Separation of duties
  3. Mandatory access control
  4. Least privilege Correct answer.

Explanation

Least privilege means granting a subject the minimum rights needed to perform its function, and no more, for the shortest time necessary. This limits the damage that a compromised or careless account can cause.

Question 5Security Principles

Which concept ensures that a person who performed an action cannot later credibly deny having done it?

  1. Confidentiality
  2. Least privilege
  3. Availability
  4. Non-repudiation Correct answer.

Explanation

Non-repudiation provides proof of the origin and integrity of an action or message, so the actor cannot successfully deny involvement. Digital signatures and tamper-evident audit logs are common ways to achieve it.

Question 6Security Principles

A firewall that blocks unauthorized network traffic before it reaches a server is which type of control?

  1. Detective
  2. Corrective
  3. Preventive Correct answer.
  4. Compensating

Explanation

A preventive control stops an event from occurring, and a firewall that drops unwanted traffic acts before any harm is done. Detective controls would only notice the traffic after the fact.

Question 7Security Principles

What is the primary purpose of labeling data as public, internal or confidential?

  1. To encrypt all data at rest automatically
  2. To match protection to its sensitivity Correct answer.
  3. To decide which employee may be promoted
  4. To reduce the storage cost of the data

Explanation

Classification assigns a sensitivity level so that handling rules, access controls and retention practices can be applied consistently and proportionately. Higher labels attract stricter safeguards than lower ones.

Question 8Security Principles

Which term describes an individual's right to control how their personal information is collected and used?

  1. Availability
  2. Privacy Correct answer.
  3. Confidentiality
  4. Integrity

Explanation

Privacy is the right of an individual to control the collection, use, retention and sharing of their personal data. Confidentiality is a related but narrower security goal of preventing unauthorized disclosure.

Question 9Security Principles

An organization buys a cyber insurance policy to cover potential breach costs. Which risk treatment strategy is this?

  1. Risk mitigation
  2. Risk avoidance
  3. Risk transfer Correct answer.
  4. Risk acceptance

Explanation

Risk transfer shifts the financial consequence of a risk to a third party, such as an insurer, while the organization retains the operational impact. The risk itself still exists; only the cost exposure is shared.

Question 10Security Principles

Why does an organization require two people to approve a large financial payment?

  1. To increase availability of the payment system
  2. To classify the payment data correctly
  3. To provide non-repudiation of the payment
  4. To stop one person concealing their own fraud Correct answer.

Explanation

Separation of duties divides a sensitive transaction among different people so that no single individual can both commit and hide an error or a fraudulent act. It is a deterrent and preventive administrative control rather than a technical one.

Question 11Security Principles

Deploying endpoint antivirus, perimeter firewalls and data center monitoring together is an example of which principle?

  1. Zero trust
  2. Least privilege
  3. Separation of duties
  4. Defense in depth Correct answer.

Explanation

Defense in depth layers multiple independent controls so that the failure of one layer does not expose the whole environment. Each layer addresses the same or related threats from a different position.

Question 12Security Principles

A security team regularly reviews its policies and performs audits to confirm that controls operate as intended. This ongoing verification demonstrates which concept?

  1. Due care
  2. Due process
  3. Due diligence Correct answer.
  4. Risk transfer

Explanation

Due diligence is the continuing effort to identify, assess and verify that safeguards remain effective, such as through audits and reviews. Due care is the actual implementation of the safeguards that diligence identifies as necessary.

Question 13Security Principles

Which statement best describes the relationship between a threat and a vulnerability?

  1. They are synonyms describing the same weakness
  2. A vulnerability exploits a threat to cause harm
  3. A threat is a weakness and a vulnerability is an attacker
  4. A threat exploits a vulnerability to cause harm Correct answer.

Explanation

A threat is any potential cause of harm, such as an attacker or a natural event, while a vulnerability is a weakness that the threat can act upon. Risk arises where a threat has a realistic path to a vulnerability.

Question 14Security Principles

Which activity is an example of a detective control?

  1. A bollard blocking vehicle access
  2. Reviewing logs for repeated failed logins Correct answer.
  3. A policy requiring long passwords
  4. A backup generator restoring power

Explanation

Detective controls discover and report activity or conditions after they occur, and log review is a typical example. They do not stop the event; they shorten the time before it is noticed.

Question 15Security Principles

The need-to-know principle restricts access to information based on which criterion?

  1. The user's seniority in the organization
  2. The classification label of the storage device
  3. The time of day the access is requested
  4. Whether the user needs the data for their work Correct answer.

Explanation

Need-to-know grants access only to subjects who require specific information to perform their assigned duties, independent of rank. Combined with least privilege, it keeps sensitive data limited to the smallest practical audience.

Question 16Security Principles

Which statement correctly distinguishes a policy from a procedure?

  1. A policy gives the steps; a procedure states the intent
  2. A policy is technical; a procedure is always physical
  3. A policy is optional guidance; a procedure is mandatory
  4. A policy states intent; a procedure lists steps Correct answer.

Explanation

A policy is management's high-level statement of intent and mandatory direction, while a procedure documents the step-by-step actions used to carry it out. Standards and guidelines sit between these levels, specifying requirements and advice respectively.

Question 17Security Principles

What is the first phase of the incident response lifecycle?

  1. Detection and analysis
  2. Containment
  3. Preparation Correct answer.
  4. Eradication

Explanation

Preparation establishes the plans, roles, tools and training needed before an incident occurs, so it comes first in the lifecycle. Detection and analysis, containment, eradication, recovery and post-incident review follow it.

Question 18Security Principles

Which statement best distinguishes a business continuity plan from a disaster recovery plan?

  1. A BCP sustains business functions; a DRP restores IT Correct answer.
  2. A BCP restores IT systems while a DRP protects people
  3. A BCP is used only after a disaster has ended
  4. A BCP covers data while a DRP covers facilities

Explanation

Business continuity focuses on keeping critical business functions operating during and after a disruption, while disaster recovery focuses on restoring the technology and data that support those functions. The two plans are complementary and usually reference each other.

Question 19Security Principles

Which idea is central to a zero trust architecture?

  1. Verifying every request regardless of network location Correct answer.
  2. Requiring a VPN for all remote access
  3. Removing authentication to improve user experience
  4. Trusting everything inside the corporate perimeter

Explanation

Zero trust assumes no implicit trust based on network position and evaluates every access request against policy before granting it. Verification typically draws on identity, device health and context rather than location alone.

Question 20Security Principles

A legacy system cannot enforce multi-factor authentication, so the team adds network segmentation and close monitoring around it. The added protection is best described as what?

  1. A preventive control
  2. A corrective control
  3. A compensating control Correct answer.
  4. A deterrent control

Explanation

A compensating control is an alternative safeguard used when the preferred or required control cannot be applied to a system. It reduces risk to an acceptable level even though it does not satisfy the original requirement in the same way.

Question 21Security Principles

A system carries an annualized loss expectancy of 500,000 before any controls. After new controls the expected annual loss falls to 80,000. What is the residual risk?

  1. 500,000
  2. 580,000
  3. 420,000
  4. 80,000 Correct answer.

Explanation

Residual risk is the risk that remains after controls have been applied, so it equals the post-control expected loss of 80,000. The 500,000 figure is the inherent risk and 420,000 is the amount of risk reduced by the controls.

Question 22Security Principles

Which formula expresses annualized loss expectancy?

  1. ALE = annualized rate of occurrence / SLE
  2. ALE = SLE x annualized rate of occurrence Correct answer.
  3. ALE = asset value x exposure factor
  4. ALE = asset value - single loss expectancy

Explanation

Single loss expectancy is the cost of one incident after applying the exposure factor, and multiplying it by the expected number of incidents per year gives the annualized loss expectancy. This figure supports cost-benefit comparison of proposed controls.

Question 23Security Principles

An application demands a full home address and telephone number to sign a user up for an email newsletter. Which privacy principle is being violated?

  1. Right of access
  2. Data minimization Correct answer.
  3. Data retention
  4. Breach notification

Explanation

Data minimization requires collecting only the personal data that is adequate and necessary for the stated purpose, which an email address satisfies for a newsletter. Collecting extra fields increases exposure without a legitimate need.

Question 24Security Principles

A user signs in and then deletes a record; the system logs the user ID, action and timestamp. Which part of the AAA model does the logging represent?

  1. Authorization
  2. Accounting Correct answer.
  3. Authentication
  4. Attestation

Explanation

Accounting, sometimes called auditing, tracks what an authenticated subject did so that actions can be reviewed and attributed. Authentication establishes identity and authorization determines permitted actions; accounting records the outcome.

Question 25Security Principles

How is an organization's risk appetite best described?

  1. The amount of risk leaders accept to meet objectives Correct answer.
  2. The level of encryption required for data at rest
  3. The total number of unpatched vulnerabilities found in an audit
  4. The maximum data loss a backup can restore

Explanation

Risk appetite is the level of risk senior leadership is willing to accept in pursuit of the organization's objectives, and it sets the boundary for risk treatment decisions. It is a governance decision rather than a measurement produced by scanning or testing.

Question 26Security Principles

A ransomware attack encrypts a hospital's patient-record system, and clinicians cannot retrieve needed records. Which element of the CIA triad is most directly affected?

  1. Confidentiality
  2. Integrity
  3. Availability Correct answer.
  4. Non-repudiation

Explanation

Availability ensures that systems and data are accessible to authorized users when needed. Ransomware denies access to records, so availability is directly harmed. Confidentiality concerns unauthorized disclosure, and integrity concerns unauthorized alteration.

Question 27Security Principles

A locked door with a badge reader at the entrance to a data center is best classified as which type of control?

  1. Physical control Correct answer.
  2. Administrative control
  3. Detective control
  4. Technical control

Explanation

Physical controls use tangible barriers and safeguards, such as locks, doors, fences and guards. A locked door with a badge reader restricts physical access to the facility. Administrative controls are policies and procedures, while technical controls are implemented within systems.

Question 28Security Principles

Which security service ensures that a sender cannot later deny having sent a message?

  1. Encryption
  2. Hashing
  3. Availability
  4. Non-repudiation Correct answer.

Explanation

Non-repudiation provides proof of origin and integrity so that a party cannot credibly deny an action. Digital signatures are a common mechanism for achieving it. Encryption protects confidentiality, and hashing alone does not prove who created a message.

Question 29Security Principles

What is the primary purpose of a security awareness program?

  1. To help staff recognize and report threats Correct answer.
  2. To replace technical controls
  3. To certify the organization to a standard
  4. To discipline staff who violate policy

Explanation

Awareness programs build knowledge so employees can identify suspicious activity, avoid common attacks and report incidents promptly. They complement technical and administrative controls rather than substitute for them. Certification against a standard is a separate governance activity.

Question 30Security Principles

An organization discontinues a product line because the data it collects creates legal exposure the company is unwilling to bear. Which risk treatment strategy is this?

  1. Risk mitigation
  2. Risk transfer
  3. Risk acceptance
  4. Risk avoidance Correct answer.

Explanation

Risk avoidance eliminates the activity or asset that creates the risk. Ending the product line removes the exposure rather than reducing or sharing it. Transfer shifts financial impact, mitigation reduces likelihood or impact, and acceptance retains the risk.

Question 31Security Principles

Which risk analysis approach uses descriptive ratings such as high, medium and low instead of monetary values?

  1. Annualized loss expectancy
  2. Business impact analysis
  3. Qualitative analysis Correct answer.
  4. Quantitative analysis

Explanation

Qualitative analysis ranks risk using relative or descriptive scales rather than precise monetary figures. Quantitative analysis assigns monetary values and often uses formulas. Annualized loss expectancy is a quantitative metric, and business impact analysis focuses on critical functions and recovery needs.

Question 32Security Principles

After an intrusion is contained, a team restores affected servers from known-good backups. Which type of control does this restoration represent?

  1. Corrective control Correct answer.
  2. Compensating control
  3. Detective control
  4. Preventive control

Explanation

Corrective controls restore normal operations after an incident has occurred. Restoring from backups repairs the damage caused by the intrusion. Preventive controls stop events, detective controls identify them, and compensating controls provide an alternative safeguard.

Question 33Security Principles

Which role is responsible for implementing and maintaining technical safeguards for data, such as backups and access permissions?

  1. Data custodian Correct answer.
  2. Data owner
  3. Data subject
  4. External auditor

Explanation

The data custodian handles the day-to-day operational protection of data, including backups, permissions and storage controls. The data owner decides classification and access rules, while the data subject is the individual the data describes. An external auditor provides independent assurance.

Question 34Security Principles

During an incident, a responder disconnects an infected workstation from the network to stop the spread of malware. Which incident response phase does this best represent?

  1. Detection and analysis
  2. Preparation
  3. Lessons learned
  4. Containment Correct answer.

Explanation

Containment limits the scope and spread of an incident, and isolating an infected host is a classic containment action. Preparation builds capability before incidents, detection and analysis identify and assess events, and lessons learned occurs after recovery.

Question 35Security Principles

An online store collects customer email addresses at checkout for order confirmation but later uses the same list to send unrelated marketing. Which privacy principle is being violated?

  1. Storage limitation
  2. Accuracy
  3. Purpose limitation Correct answer.
  4. Data minimization

Explanation

Purpose limitation restricts personal data to the purposes stated when it was collected. Using order-confirmation addresses for unrelated marketing exceeds that purpose. Data minimization limits the amount collected, storage limitation limits retention time, and accuracy requires correct data.

Question 36Security Principles

Which body typically provides senior-level oversight of an organization's security program and approves its strategy and budget?

  1. A steering committee Correct answer.
  2. The data custodians
  3. The incident response team
  4. The help desk

Explanation

A security steering committee brings together senior leaders to align security with business objectives, set priorities and approve resources. Operational teams carry out the resulting work. Data custodians implement controls rather than set overall strategy.

Question 37Security Principles

Why should changes to production systems pass through a formal change management approval process?

  1. To eliminate the need for backups
  2. To assess risk and control changes Correct answer.
  3. To transfer risk to a third party
  4. To guarantee that no vulnerabilities exist

Explanation

Change management evaluates the risk and impact of a proposed change, requires approval and testing, and provides a way to roll back if needed. It does not guarantee that systems are free of vulnerabilities. Backups and risk transfer are separate practices.

Question 38Security Principles

A system can tolerate losing at most 15 minutes of transaction data if it fails. Which metric does this describe?

  1. Recovery time objective (RTO)
  2. Mean time to repair (MTTR)
  3. Service level agreement (SLA)
  4. Recovery point objective (RPO) Correct answer.

Explanation

The recovery point objective defines the maximum acceptable amount of data loss, expressed as a period of time. A 15-minute RPO means backups or replication must capture data at least that often. RTO describes acceptable downtime, not data loss.

Question 39Security Principles

Which activity systematically identifies potential threats and weaknesses in a proposed system design before it is built?

  1. Penetration testing
  2. Vulnerability scanning
  3. Threat modeling Correct answer.
  4. Incident response

Explanation

Threat modeling is a structured, design-time analysis that examines how a system could be attacked and where weaknesses may exist. It allows architects to address issues before implementation. Penetration testing and vulnerability scanning assess systems that already exist.

Question 40Security Principles

According to the (ISC)² Code of Ethics, which canon has the highest priority?

  1. Provide diligent and competent service to principals
  2. Advance and protect the profession
  3. Act honorably, honestly, justly, responsibly and legally
  4. Protect society, the common good, and the infrastructure Correct answer.

Explanation

The canons of the (ISC)² Code of Ethics are ordered, and protecting society, the common good and the infrastructure comes first. Obligations to principals and to the profession follow in priority. When duties conflict, the earlier canon takes precedence.

Question 41Security Governance

What is the primary purpose of information security governance?

  1. To select the technical specifications of firewalls
  2. To perform the daily configuration of security devices
  3. To align security activities with business objectives Correct answer.
  4. To remove every identified risk from the environment

Explanation

Governance sets direction, assigns accountability, and ensures security investment supports the organization's goals and obligations. It operates at the strategic and oversight level, with implementation left to management.

Question 42Security Governance

Which document expresses management's intent and overall direction for information security?

  1. Policy Correct answer.
  2. Procedure
  3. Guideline
  4. Standard

Explanation

A policy is a high-level statement of management intent that mandates direction and assigns responsibility. Standards, procedures, and guidelines support a policy at increasing levels of detail.

Question 43Security Governance

Which document type provides step-by-step instructions for performing a specific task?

  1. Standard
  2. Guideline
  3. Policy
  4. Procedure Correct answer.

Explanation

Procedures are detailed, sequential instructions that tell staff how to carry out an activity consistently. They sit beneath policies and standards, which state what must be done rather than how to do it.

Question 44Security Governance

Which document type contains recommended practices that are advisable but not mandatory?

  1. Policy
  2. Standard
  3. Procedure
  4. Guideline Correct answer.

Explanation

Guidelines are advisory and offer recommended approaches, so staff may exercise judgment in applying them. Policies and standards are mandatory, and procedures prescribe specific steps.

Question 45Security Governance

Who is ultimately accountable for an organization's information security program?

  1. Senior management and the board of directors Correct answer.
  2. Individual data custodians
  3. The service desk team leads
  4. External audit firms

Explanation

Accountability for security rests with senior leadership, which sets direction, approves risk decisions, and provides resources. Operational duties can be delegated, but accountability cannot.

Question 46Security Governance

Which statement best describes due care in security governance?

  1. Purchasing insurance to transfer losses
  2. Recording every change to production
  3. Taking reasonable care to protect assets Correct answer.
  4. Formally assigning an owner to each asset

Explanation

Due care is the standard of reasonable, prudent behavior expected of an organization in protecting its assets. Due diligence is the ongoing activity of identifying and verifying what must be protected.

Question 47Security Governance

Why does an organization run a security awareness program?

  1. To make sure cyber attacks never succeed
  2. To help staff recognize and report threats Correct answer.
  3. To document the penalties for non-compliance
  4. To lower the cost of purchasing security tools

Explanation

Awareness programs build knowledge so employees can recognize and report suspicious activity, which is an important detective layer of defense. They reduce human-related risk but cannot make attacks impossible.

Question 48Security Governance

What is the primary objective of business continuity planning?

  1. To define the disciplinary process for violations
  2. To keep critical business functions running Correct answer.
  3. To list the technical specifications of backup servers
  4. To record the forensic details of an intrusion

Explanation

Business continuity planning identifies critical functions and defines how they will continue during and after a disruption. Restoring technology is only one supporting element of that broader objective.

Question 49Security Governance

Who decides the classification of a data set and approves who may access it?

  1. The system administrator
  2. The data owner Correct answer.
  3. The data custodian
  4. The data subject

Explanation

The data owner is a business role accountable for a data set, which includes setting its classification and authorizing access. Custodians and administrators implement and maintain controls according to the owner's decisions.

Question 50Security Governance

A company buys a cyber insurance policy to cover breach costs. Which risk treatment option does this represent?

  1. Risk transfer Correct answer.
  2. Risk acceptance
  3. Risk mitigation
  4. Risk avoidance

Explanation

Transferring risk shifts the financial consequence to another party, typically through insurance or contractual terms. The organization still owns the underlying risk and must continue to manage it.