I85PREP
⌘ K
NCCSI study materials
NCCSI study resources

NCCSI practice questions

One question at a time. Build your NCCSI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Principles and Governance

Which principle states that a subject should be granted only the minimum access rights necessary to perform its assigned tasks?

  1. Defense in depth
  2. Separation of duties
  3. Need-to-know
  4. Least privilege Correct answer.

Explanation

Least privilege limits each subject to the minimum permissions required for its assigned function, reducing the blast radius of misuse or compromise. Need-to-know is narrower and applies specifically to information access rather than general system rights. Separation of duties and defense in depth address different control objectives.

Question 2Security Principles and Governance

An organization requires two employees to jointly approve any wire transfer above a threshold. Which security principle does this control primarily implement?

  1. Least privilege
  2. Separation of duties Correct answer.
  3. Availability
  4. Non-repudiation

Explanation

Separation of duties ensures that a single individual cannot complete a sensitive transaction alone, forcing collusion to commit fraud. The dual-approval threshold is a classic implementation of that principle. Least privilege concerns permission scope, while non-repudiation and availability address different security goals.

Question 3Security Principles and Governance

In the CIA triad, which property is directly compromised when an attacker alters records in a financial database without authorization?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Authenticity
  4. Availability

Explanation

Integrity refers to the accuracy and completeness of data and systems, so unauthorized modification of records is an integrity violation. Confidentiality concerns disclosure and availability concerns access to resources. Authenticity is related but is not one of the three CIA properties.

Question 4Security Principles and Governance

Which statement best describes the purpose of a security policy within a governance framework?

  1. It records the results of a single vulnerability scan
  2. It documents the detailed command syntax used to configure a firewall
  3. It lists the individual steps for handling a phishing report
  4. It states management's mandatory direction and requirements for protecting information Correct answer.

Explanation

Policies express management intent and mandatory high-level requirements that govern how information is protected. Procedures and standards then translate policy into specific steps and technical specifications. Scan results and firewall commands are operational artifacts, not policy.

Question 5Security Principles and Governance

What is the primary difference between a standard and a procedure in a typical security governance hierarchy?

  1. A standard applies only to executives, while a procedure applies only to technicians
  2. A standard is optional guidance, while a procedure is legally binding
  3. A standard is reviewed annually, while a procedure is never revised
  4. A standard defines mandatory technical requirements, while a procedure gives step-by-step instructions Correct answer.

Explanation

Standards specify mandatory, measurable requirements such as approved algorithms or configurations, whereas procedures describe the sequential steps used to carry out a task. Both sit under policy and are generally mandatory. Audience and review cadence are not the defining distinction.

Question 6Security Principles and Governance

A risk assessment rates a threat as high likelihood and high impact. Which risk treatment option involves accepting the risk with no additional controls?

  1. Risk transfer
  2. Risk acceptance Correct answer.
  3. Risk avoidance
  4. Risk mitigation

Explanation

Risk acceptance means the organization acknowledges the risk and chooses to bear it, often because the cost of treatment exceeds the potential loss or the risk is within tolerance. Avoidance eliminates the activity, transfer shifts financial impact such as through insurance, and mitigation reduces likelihood or impact with controls.

Question 7Security Principles and Governance

Which element of the CIA triad is most directly supported by maintaining tested, geographically separate backups of critical systems?

  1. Non-repudiation
  2. Confidentiality
  3. Integrity
  4. Availability Correct answer.

Explanation

Tested, geographically separate backups allow restoration of services after disruption, which directly supports availability. Backups can also aid integrity and confidentiality if encrypted, but their primary governance purpose is to sustain access to systems and data. Non-repudiation is unrelated to backup strategy.

Question 8Security Principles and Governance

What does the concept of due care require of an organization's leadership?

  1. Exercising reasonable diligence in identifying and addressing risks to the organization Correct answer.
  2. Delegating all security decisions to the IT department
  3. Purchasing cyber insurance for every identified risk
  4. Publishing internal security policies to the public

Explanation

Due care is the ongoing duty to act reasonably and prudently, which includes identifying risks and taking appropriate steps to address them. It is a governance obligation of leadership, not a delegation to a single team. Insurance is one possible treatment and public disclosure is not a requirement.

Question 9Security Principles and Governance

A hospital must ensure that clinicians can access patient records during a network outage. Which control objective does this requirement most directly reflect?

  1. Integrity
  2. Privacy
  3. Confidentiality
  4. Availability Correct answer.

Explanation

Ensuring continued access during an outage is a requirement for availability, which calls for redundancy and resilience controls. Confidentiality and integrity address disclosure and accuracy respectively. Privacy governs appropriate use of personal data but does not by itself mandate uptime.

Question 10Security Principles and Governance

An organization classifies data as Public, Internal, Confidential, and Restricted. Which governance artifact should define the handling requirements for each label?

  1. A vulnerability management report
  2. A firewall rule set
  3. A data classification policy with associated handling standards Correct answer.
  4. A business continuity plan

Explanation

Classification labels only have effect when a policy defines them and standards specify handling requirements such as storage, transmission, and retention for each level. Firewall rules, continuity plans, and scan reports are operational artifacts that may reference labels but do not define them.

Question 11Security Principles and Governance

Which action best demonstrates the principle of accountability in an access governance program?

  1. Sharing administrative credentials among the operations team
  2. Granting administrators permanent standing access
  3. Disabling logging to improve system performance
  4. Retaining attributable logs of privileged actions and reviewing them regularly Correct answer.

Explanation

Accountability requires that actions can be attributed to a specific identity and that those records are reviewed. Attributable logs provide that traceability and support investigation and oversight. Shared credentials, standing access, and disabled logging all undermine attribution.

Question 12Security Principles and Governance

What is the role of a risk owner in an enterprise risk management program?

  1. To perform every technical control implementation personally
  2. To audit the organization independently of management
  3. To approve the annual IT budget
  4. To make decisions about treating a specific risk and accept accountability for it Correct answer.

Explanation

A risk owner is the accountable individual with authority to decide how a given risk will be treated and to accept residual risk. Implementation may be delegated and independent audit is a separate function. Budget approval is not the defining role of a risk owner.

Question 13Security Principles and Governance

An organization's risk appetite statement says it will not tolerate risks that could cause a regulatory violation. A proposed system would store regulated data without required encryption. What is the most appropriate governance response?

  1. Defer the decision to the system vendor
  2. Transfer the risk by purchasing insurance
  3. Reject the design until controls meet the regulatory requirement Correct answer.
  4. Accept the risk because encryption reduces performance

Explanation

When a risk falls outside the stated appetite, the proposed design must be changed or rejected rather than accepted. Insurance transfers financial loss but does not cure a regulatory violation. Vendors cannot assume the organization's compliance accountability.

Question 14Security Principles and Governance

Which control type is a security awareness training program for all staff?

  1. Preventive Correct answer.
  2. Compensating
  3. Corrective
  4. Detective

Explanation

Awareness training is preventive because it aims to stop incidents before they occur by improving user behavior. Detective controls identify events after they happen, corrective controls restore conditions after an incident, and compensating controls substitute for another control.

Question 15Security Principles and Governance

A governance team wants assurance that a critical control operates as designed over time. Which activity provides that assurance?

  1. Periodic control testing with documented results Correct answer.
  2. Verbal confirmation from the control owner
  3. A one-time design review at project kickoff
  4. Inclusion of the control in the project charter

Explanation

Operating effectiveness is demonstrated through periodic testing that produces documented evidence over time. A design review only confirms intent, and verbal confirmation or charter language provides no evidence of actual operation.

Question 16Security Principles and Governance

What distinguishes a vulnerability from a risk in security governance terminology?

  1. A vulnerability is always exploitable, while risk is always theoretical
  2. A vulnerability is a weakness, while risk combines threat, vulnerability, and potential impact Correct answer.
  3. A vulnerability applies only to software, while risk applies only to people
  4. A vulnerability is a financial measure, while risk is a technical measure

Explanation

A vulnerability is a weakness in a system or process, whereas risk expresses the potential for loss when a threat exploits a vulnerability and produces impact. Not every vulnerability is exploitable in context, and neither term is limited to software or finance.

Question 17Security Principles and Governance

An employee with approval authority for vendor payments also approves the same vendors' invoices. Which governance weakness does this represent?

  1. Inadequate backup frequency
  2. Insufficient network segmentation
  3. Excessive data retention
  4. Incompatible duties assigned to one person Correct answer.

Explanation

Approving both the vendor relationship and the resulting invoices concentrates control in one person, which is a conflict of duties that enables fraud. Retaining both roles violates separation of duties. Retention, segmentation, and backup frequency are unrelated to this conflict.

Question 18Security Principles and Governance

Which statement correctly describes the relationship between policies and guidelines?

  1. Policies are mandatory, while guidelines are recommended practices Correct answer.
  2. Both are mandatory and legally binding
  3. Policies are optional, while guidelines are mandatory
  4. Both are optional and advisory

Explanation

Policies set mandatory requirements, while guidelines offer recommended approaches that allow discretion. This distinction lets organizations enforce policy while still giving practitioners flexibility. Treating both as optional or both as mandatory erases that difference.

Question 19Security Principles and Governance

An organization adopts a framework that maps controls to multiple regulatory requirements. What is the primary governance benefit of this mapping?

  1. It reduces duplicated effort by showing where one control satisfies several obligations Correct answer.
  2. It removes the need for a risk assessment
  3. It eliminates the need for any control testing
  4. It guarantees full compliance with every regulation

Explanation

Control mapping lets an organization see where a single control can satisfy several requirements, reducing duplication and gaps. It does not remove the need for testing, risk assessment, or regulatory judgment, nor can it guarantee compliance on its own.

Question 20Security Principles and Governance

A security manager wants to reduce the likelihood of successful phishing attacks. Which combination best reflects a layered governance approach?

  1. A single annual awareness email
  2. Awareness training, email filtering, and phishing simulation exercises Correct answer.
  3. Relying only on antivirus software
  4. Disabling email for all staff

Explanation

Layering preventive filtering, user education, and realistic simulation exercises addresses both technical and human factors, consistent with defense in depth. A single email or a single technical control leaves significant gaps, and disabling email is not a viable control.

Question 21Security Principles and Governance

Which practice best supports the principle of privacy by design in a new customer portal?

  1. Retaining records indefinitely to support future analytics
  2. Collecting only data needed for defined purposes and minimizing retention Correct answer.
  3. Collecting all available data in case it becomes useful later
  4. Publishing customer data to improve transparency

Explanation

Privacy by design calls for limiting collection to specified purposes and retaining data only as long as needed. Collecting everything, retaining indefinitely, or publishing personal data all conflict with data minimization and purpose limitation.

Question 22Security Principles and Governance

An organization discovers that a cloud provider's subcontractor processes regulated data in a country not permitted by policy. Which governance gap is most directly exposed?

  1. Incomplete asset inventory of office printers
  2. Inadequate supply chain and third-party oversight Correct answer.
  3. Insufficient password complexity
  4. Weak physical access controls at headquarters

Explanation

The issue is that data location obligations were not enforced through vendor and subcontractor oversight, which is a supply chain governance gap. Password rules, headquarters access, and printer inventory do not address where a subcontractor processes regulated data.

Question 23Security Principles and Governance

A board asks how residual risk should be reported after controls are implemented. Which approach is most defensible?

  1. Report residual risk against the approved appetite with explicit acceptance by the accountable owner Correct answer.
  2. Report only the raw vulnerability count from scans
  3. Report residual risk as zero once controls exist
  4. Report only the number of controls implemented

Explanation

Residual risk is what remains after controls, and governance requires comparing it to the approved appetite and having the accountable owner formally accept it. Counting controls or vulnerabilities does not convey residual exposure, and controls never reduce risk to zero.

Question 24Security Principles and Governance

Two business units interpret the same access control policy differently, producing inconsistent enforcement. Which governance action most directly resolves this?

  1. Migrate the affected systems to a new data center
  2. Publish an authoritative standard that defines the specific access requirements Correct answer.
  3. Add more approvers to the exception process
  4. Increase the frequency of penetration testing

Explanation

Inconsistent interpretation of a high-level policy is resolved by issuing a standard that specifies concrete, measurable requirements everyone must follow. Testing, extra approvers, and relocation do not remove ambiguity in the requirement itself.

Question 25Security Principles and Governance

A regulator requires evidence that access reviews occur and that inappropriate access is removed. Which evidence set best satisfies this requirement?

  1. A screenshot of the access management tool's login page
  2. An org chart showing the security team structure
  3. A statement in the security policy that reviews happen quarterly
  4. Dated review records showing reviewer decisions and remediation tickets for removed access Correct answer.

Explanation

Assurance requires evidence of both the review activity and the resulting remediation, linked and dated. A policy statement or tool screenshot shows intent or capability but not that reviews occurred and access was corrected. An org chart is irrelevant to the control's operation.

Question 26Security Principles and Governance

Which statement best describes the purpose of a data retention schedule within a security governance program?

  1. It lists the encryption algorithms approved for protecting stored records.
  2. It specifies how long each data category is kept and when it must be securely disposed of. Correct answer.
  3. It records which employees have been granted access to each repository.
  4. It defines the escalation path for reporting suspected data breaches.

Explanation

A retention schedule is a governance artifact that assigns a defined lifespan to each category of information and prescribes lawful, secure disposal once that period ends. It limits unnecessary data accumulation, which reduces both storage exposure and legal discovery burden. Access records, cryptographic standards, and incident escalation belong to other governance documents.

Question 27Security Principles and Governance

A security team wants to confirm that a new payroll system enforces segregation of duties before it goes live. Which governance activity most directly provides this confirmation?

  1. Publishing the acceptable use policy to all payroll staff.
  2. Adding the payroll system to the annual penetration testing calendar.
  3. Recording the payroll system in the IT asset inventory.
  4. Reviewing the system's role design against the segregation-of-duties matrix during pre-implementation testing. Correct answer.

Explanation

Segregation of duties is a design-level control, so it is verified by comparing configured roles and permissions with the approved duties matrix before the system is deployed. Penetration testing probes technical exploitable weaknesses rather than conflicting business duties. Policy publication and asset registration support governance but do not test role conflicts.

Question 28Security Principles and Governance

An organization's security policy states that all production changes require approval, but the change management procedure allows emergency changes to be approved after implementation. How should a security governance professional interpret this situation?

  1. The procedure is acceptable because procedures may freely override policy when operational pressure exists.
  2. The procedure conflicts with the policy and should be revised to define narrow emergency criteria with retrospective review. Correct answer.
  3. The policy should be deleted because procedures are always the authoritative governance document.
  4. The situation is acceptable because emergency changes are rare and therefore low risk.

Explanation

Policy sets mandatory management intent, and subordinate procedures must implement that intent rather than contradict it. A defensible emergency path still exists, but it must be explicitly bounded, documented, and subject to post-implementation review so the exception is governed rather than informal. Rarity of an event does not justify an uncontrolled deviation from policy.

Question 29Security Principles and Governance

Which term describes the management-level decision to reduce risk to a level that is tolerable and aligned with the organization's objectives?

  1. Risk appetite
  2. Risk register
  3. Risk identification
  4. Risk treatment Correct answer.

Explanation

Risk treatment is the process of selecting and applying options such as mitigation, transfer, avoidance, or acceptance to bring risk within tolerable limits. Risk identification merely discovers and documents exposures, while the risk register is the record that tracks them. Risk appetite is the amount of risk leadership is willing to pursue, which informs treatment rather than being the treatment itself.

Question 30Security Principles and Governance

A multinational firm must reconcile a global security policy with conflicting local privacy statutes that restrict cross-border transfers. Which governance approach is most defensible?

  1. Apply the global policy uniformly everywhere and treat local statutory conflicts as operational risks to be absorbed.
  2. Delegate all privacy decisions to local business managers without a common baseline or oversight.
  3. Suspend the global policy entirely until every jurisdiction adopts identical requirements.
  4. Maintain the global policy as the baseline and document jurisdiction-specific control exceptions with legal review and compensating measures. Correct answer.

Explanation

Effective governance keeps a common baseline for consistency while allowing documented, legally reviewed exceptions where local law demands stricter handling. This preserves accountability through a controlled exception process and compensating controls. Uniform application that ignores statutory limits creates legal exposure, and abandoning the baseline forfeits enterprise-wide consistency.

Question 31Access Control and Identity Management

Which access control model determines permissions by comparing the clearance of a subject with the classification of an object?

  1. Mandatory Access Control (MAC) Correct answer.
  2. Discretionary Access Control (DAC)
  3. Role-Based Access Control (RBAC)
  4. Rule-Based Access Control (RuBAC)

Explanation

MAC enforces access decisions from system-assigned labels: a subject's clearance is compared against the object's classification, and the owner cannot override the result. This label comparison is the defining mechanism of mandatory control.

Question 32Access Control and Identity Management

In a Discretionary Access Control (DAC) environment, who ultimately decides which users may read a file?

  1. The owner of the file through assigned permissions Correct answer.
  2. The data custodian through classification levels
  3. The security kernel through a fixed policy matrix
  4. The system administrator through mandatory labels

Explanation

DAC places the access decision with the resource owner, who grants or revokes permissions at their discretion. Administrators may assist, but ownership authority is the core principle.

Question 33Access Control and Identity Management

Which principle requires that a user be granted only the access necessary to perform assigned job duties?

  1. Need-to-know
  2. Defense in depth
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum rights required for its tasks, reducing the impact of misuse or compromise. It applies to permissions broadly, not only to information access.

Question 34Access Control and Identity Management

An organization wants each employee to hold exactly one active account that follows them across roles. Which identity lifecycle practice does this describe?

  1. Privilege creep
  2. Federated provisioning
  3. Identity proofing
  4. Account aggregation Correct answer.

Explanation

Account aggregation consolidates multiple accounts and entitlements under a single identity so that access follows the person. It reduces orphaned accounts and simplifies review.

Question 35Access Control and Identity Management

Which authentication factor category is a hardware token that generates a time-based one-time code?

  1. Something you know
  2. Somewhere you are
  3. Something you have Correct answer.
  4. Something you are

Explanation

A hardware token is a physical possession, so it belongs to the something-you-have factor. Time-based codes change the verification data but the factor category remains possession.

Question 36Access Control and Identity Management

What is the primary purpose of Single Sign-On (SSO)?

  1. To store all passwords in a shared spreadsheet
  2. To eliminate the need for any authentication
  3. To replace authorization with authentication
  4. To let one authentication grant access to multiple applications Correct answer.

Explanation

SSO authenticates a user once and then issues assertions or tokens that other applications trust, reducing repeated logins. Authentication still occurs and authorization decisions still apply per resource.

Question 37Access Control and Identity Management

Which protocol is most commonly used to carry federated authentication assertions between an identity provider and a service provider in enterprise web SSO?

  1. SMTP
  2. SAML Correct answer.
  3. SFTP
  4. SNMP

Explanation

SAML is an XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider. The other listed protocols serve file transfer, network management, and mail.

Question 38Access Control and Identity Management

Which access control approach grants permissions based on attributes such as department, time of day, and device posture?

  1. Discretionary Access Control
  2. Attribute-Based Access Control Correct answer.
  3. Role-Based Access Control
  4. Mandatory Access Control

Explanation

ABAC evaluates attributes of the subject, resource, action, and environment to reach an access decision. This contextual evaluation distinguishes it from static role assignments or label comparisons.

Question 39Access Control and Identity Management

A departing employee's account remains active for 30 days after termination. Which control failure does this most directly represent?

  1. Inadequate account deprovisioning Correct answer.
  2. Insufficient network segmentation
  3. Weak password complexity
  4. Missing encryption at rest

Explanation

Deprovisioning should disable or remove accounts promptly when employment ends. A lingering active account is an orphaned credential that can be misused and indicates a lifecycle process failure.

Question 40Access Control and Identity Management

An administrator periodically reviews each user's entitlements against current job duties. Which process is being performed?

  1. Access recertification Correct answer.
  2. Key rotation
  3. Penetration testing
  4. Log correlation

Explanation

Access recertification, also called access review, confirms that existing entitlements remain justified by current responsibilities. Reviewers approve or revoke rights, which curbs privilege creep.

Question 41Access Control and Identity Management

A user authenticates with a password and then must also provide a fingerprint before access is granted. Which concept does this illustrate?

  1. Role mining
  2. Single-factor authentication
  3. Multifactor authentication Correct answer.
  4. Federated identity

Explanation

Multifactor authentication requires factors from different categories, here something you know plus something you are. Combining independent factors raises assurance beyond either factor alone.

Question 42Access Control and Identity Management

Why should a privileged administrative account be separate from a user's daily-use account?

  1. To simplify password reuse across systems
  2. To remove the need for logging administrator actions
  3. To allow shared credentials among administrators
  4. To reduce exposure of high-risk rights during routine tasks Correct answer.

Explanation

Separating privileged accounts limits the blast radius of compromise, since routine browsing and email run without elevated rights. Administrative credentials are used only when needed, supporting least privilege and accountability.

Question 43Access Control and Identity Management

An organization implements a policy where a payment over a threshold requires approval by two different managers. Which control is this?

  1. Implicit deny
  2. Separation of duties Correct answer.
  3. Single sign-on
  4. Least privilege

Explanation

Separation of duties divides a sensitive transaction so that no single person can complete it alone. Requiring two independent approvals is a classic implementation of this control.

Question 44Access Control and Identity Management

Which OAuth 2.0 role is responsible for issuing access tokens after authenticating the resource owner?

  1. Client
  2. Authorization server Correct answer.
  3. Resource owner
  4. Resource server

Explanation

The authorization server authenticates the resource owner and issues access tokens to the client. The resource server hosts protected resources and validates the tokens it receives.

Question 45Access Control and Identity Management

A web application stores session identifiers in a cookie. Which attribute best limits the cookie from being read by client-side scripts?

  1. HttpOnly Correct answer.
  2. SameSite=Strict
  3. Secure
  4. Domain

Explanation

The HttpOnly attribute prevents JavaScript from reading the cookie, reducing the impact of cross-site scripting. The Secure attribute instead restricts transmission to HTTPS.

Question 46Access Control and Identity Management

What is the main security benefit of short-lived access tokens combined with refresh tokens?

  1. They make authorization decisions unnecessary
  2. They allow tokens to be shared among users
  3. They limit the window in which a stolen access token is useful Correct answer.
  4. They eliminate the need to authenticate users

Explanation

Short token lifetimes reduce the exposure window if a token leaks, while refresh tokens allow continued sessions without repeated logins. Revoking the refresh token then ends the session.

Question 47Access Control and Identity Management

Which practice best mitigates the risk of credential stuffing against a login portal?

  1. Increasing the maximum password length
  2. Publishing password complexity rules
  3. Disabling account lockout to avoid denial of service
  4. Rate limiting and anomaly detection on authentication attempts Correct answer.

Explanation

Credential stuffing replays breached username and password pairs at scale, so throttling and detecting suspicious patterns blunts automated attempts. These controls slow attackers without relying solely on password strength.

Question 48Access Control and Identity Management

In an RBAC system, which element connects a role to the permissions it grants?

  1. The session
  2. The user-role assignment
  3. The role-permission assignment Correct answer.
  4. The object classification

Explanation

RBAC links users to roles and roles to permissions; the role-permission assignment defines what a role may do. Users then inherit those permissions through their role membership.

Question 49Access Control and Identity Management

A system grants access only when the request originates from the corporate network and during business hours. Which access control type is this?

  1. Discretionary access control
  2. Role-based access control
  3. Mandatory access control
  4. Rule-based access control Correct answer.

Explanation

Rule-based access control applies configured conditions such as source network or time of day to permit or deny requests. The decision depends on explicit rules rather than role or owner discretion.

Question 50Access Control and Identity Management

Which control most directly prevents a terminated employee from reusing cached credentials to access a SaaS application?

  1. Rotating the application's TLS certificate
  2. Increasing the password history depth
  3. Enabling verbose debug logging
  4. Revoking the identity provider session and disabling the federated account Correct answer.

Explanation

Disabling the federated account and revoking active sessions at the identity provider stops further token issuance and invalidates existing sessions. This closes the path a departed user would otherwise exploit.