I85PREP
⌘ K
ISC Engineer study materials
ISC Engineer study resources

ISC Engineer practice questions

One question at a time. Build your ISC Engineer understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts and Fundamentals

Which principle of information security states that data should be accessible only to those who have a legitimate need to access it?

  1. Confidentiality Correct answer.
  2. Non-repudiation
  3. Availability
  4. Integrity

Explanation

Confidentiality restricts access to information to authorized parties only, preventing unauthorized disclosure. It is one of the three core pillars of the CIA triad.

Question 2Security Concepts and Fundamentals

A file server is protected by a hash check that detects any unauthorized modification of stored documents. Which security property does this control primarily provide?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Availability
  4. Anonymity

Explanation

Integrity ensures data has not been altered in an unauthorized way, and cryptographic hashes are a standard mechanism for detecting modification. The control does not hide the data or guarantee uptime.

Question 3Security Concepts and Fundamentals

Which of the following best describes a threat actor known as a 'script kiddie'?

  1. A security researcher performing authorized penetration testing
  2. A low-skilled individual using existing tools and scripts Correct answer.
  3. An insider with legitimate administrative privileges
  4. A state-sponsored operative conducting long-term espionage

Explanation

Script kiddies are unskilled attackers who rely on pre-built tools and scripts rather than developing their own exploits. Their limited expertise distinguishes them from advanced or authorized actors.

Question 4Security Concepts and Fundamentals

Which type of malware self-replicates across networks without requiring a host file or user action?

  1. Rootkit
  2. Worm Correct answer.
  3. Logic bomb
  4. Trojan

Explanation

A worm is standalone malware that propagates itself across networks automatically. It does not need to attach to a host program or rely on user execution to spread.

Question 5Security Concepts and Fundamentals

An organization wants to ensure that only approved software can execute on employee workstations. Which control type is this?

  1. Compensating
  2. Detective
  3. Preventive Correct answer.
  4. Corrective

Explanation

Application allow-listing stops unapproved software from running, which is a preventive control because it blocks the event before it occurs. Detective controls identify events after the fact.

Question 6Security Concepts and Fundamentals

Which authentication factor category does a fingerprint scanner represent?

  1. Something you are Correct answer.
  2. Something you know
  3. Somewhere you are
  4. Something you have

Explanation

Biometric characteristics such as fingerprints fall under 'something you are,' an inherence factor. Knowledge and possession factors cover passwords and tokens respectively.

Question 7Security Concepts and Fundamentals

Which of the following is the primary purpose of hashing a password before storing it?

  1. To make the stored value irreversible so the plaintext cannot be easily derived Correct answer.
  2. To compress the password to save storage space
  3. To encrypt the password so it can be decrypted for verification
  4. To allow the password to be recovered if forgotten

Explanation

Cryptographic hashing is a one-way function, so storing the hash prevents an attacker who obtains the database from directly reading passwords. Verification is done by hashing the supplied password and comparing results.

Question 8Security Concepts and Fundamentals

Which term describes the assurance that a party cannot later deny having performed a specific action, such as signing a transaction?

  1. Defense in depth
  2. Availability
  3. Non-repudiation Correct answer.
  4. Least privilege

Explanation

Non-repudiation provides proof of the origin and integrity of an action so that the actor cannot credibly deny it, often achieved with digital signatures. The other terms describe access, uptime, or layered protection.

Question 9Security Concepts and Fundamentals

An attacker intercepts traffic between two parties and relays it while remaining in the middle, reading and altering messages. Which attack is this?

  1. On-path (man-in-the-middle) attack Correct answer.
  2. Denial of service
  3. Privilege escalation
  4. SQL injection

Explanation

An on-path attack places the adversary between two communicating parties to intercept or modify traffic. Because each party believes it is talking directly to the other, the interception can go unnoticed without strong encryption.

Question 10Security Concepts and Fundamentals

Which symmetric encryption mode both encrypts data and produces an authentication tag to detect tampering?

  1. Galois/Counter Mode (GCM) Correct answer.
  2. Cipher Block Chaining (CBC)
  3. Output Feedback (OFB)
  4. Electronic Codebook (ECB)

Explanation

GCM is an authenticated encryption mode that combines counter-mode encryption with a Galois-based message authentication code. This provides both confidentiality and integrity in a single operation.

Question 11Security Concepts and Fundamentals

In a public key infrastructure, what is the primary role of a certificate authority?

  1. To generate symmetric session keys for every connection
  2. To store private keys on behalf of all users
  3. To encrypt all traffic between clients and servers
  4. To issue and sign digital certificates that bind a public key to an identity Correct answer.

Explanation

A certificate authority validates identities and signs certificates, vouching that a given public key belongs to a named entity. Relying parties trust the CA's signature to accept the binding.

Question 12Security Concepts and Fundamentals

What is the key difference between a vulnerability and a risk?

  1. A vulnerability applies only to networks, while risk applies only to data
  2. A vulnerability is a weakness, while risk is the potential for loss when a threat exploits it Correct answer.
  3. A risk is a software bug, while a vulnerability is a business impact
  4. A vulnerability is always exploitable, while risk is only theoretical

Explanation

A vulnerability is a weakness in a system, whereas risk combines the likelihood and impact of a threat exploiting that weakness. A vulnerability may exist without meaningful risk if no credible threat can reach it.

Question 13Security Concepts and Fundamentals

A company classifies data and applies the strictest handling rules to records containing personal health details. Which data classification level does this typically represent?

  1. Confidential or restricted Correct answer.
  2. Internal
  3. Declassified
  4. Public

Explanation

Sensitive personal data such as health information is usually placed at the highest classification, often called confidential or restricted, requiring the strongest controls. Public and internal levels apply to less sensitive data.

Question 14Security Concepts and Fundamentals

Which access control model assigns permissions based on a user's job role rather than individual identity?

  1. Discretionary access control (DAC)
  2. Role-based access control (RBAC) Correct answer.
  3. Mandatory access control (MAC)
  4. Rule-based access control

Explanation

RBAC grants access according to roles, and users are assigned to roles that carry the needed permissions. This simplifies administration and supports least privilege at scale.

Question 15Security Concepts and Fundamentals

Which cryptographic property makes it computationally infeasible to derive the private key from the public key in asymmetric systems?

  1. The length of the plaintext message
  2. The use of a shared secret
  3. The use of a fixed initialization vector
  4. The mathematical one-way relationship between the keys Correct answer.

Explanation

Asymmetric algorithms rely on mathematical problems that are easy in one direction but hard to reverse, such as factoring or discrete logarithms. This one-way relationship protects the private key even though the public key is widely distributed.

Question 16Security Concepts and Fundamentals

What distinguishes a digital signature from a simple message hash?

  1. A signature encrypts the whole message for confidentiality
  2. A signature can only be created by the recipient
  3. A signature uses the sender's private key so recipients can verify origin and integrity Correct answer.
  4. A signature is reversible to recover the original message

Explanation

A digital signature applies the sender's private key to a hash of the message, letting anyone with the public key verify both integrity and origin. A bare hash proves integrity only if the hash itself is trusted.

Question 17Security Concepts and Fundamentals

An employee receives an email that appears to come from the CEO asking for an urgent wire transfer. Which attack does this most likely represent?

  1. Phishing via business email compromise Correct answer.
  2. Cross-site scripting
  3. ARP spoofing
  4. Brute force

Explanation

Business email compromise is a social engineering attack in which a spoofed or compromised executive account is used to trick staff into transferring funds. It exploits authority and urgency rather than technical flaws.

Question 18Security Concepts and Fundamentals

Why should encryption keys be stored separately from the encrypted data?

  1. To allow the data to be readable without decryption
  2. To reduce the size of the encrypted files
  3. To make the ciphertext compressible
  4. To ensure compromise of the data store does not automatically expose the keys Correct answer.

Explanation

Separating keys from ciphertext enforces a separation of duties so that an attacker who gains access to stored data still lacks the key material. This limits the blast radius of a single breach.

Question 19Security Concepts and Fundamentals

Which of the following is an example of a physical security control?

  1. An intrusion detection system monitoring packets
  2. A firewall rule blocking inbound traffic
  3. A badge reader controlling entry to a data center Correct answer.
  4. A password complexity policy

Explanation

Physical controls protect facilities and hardware, and a badge reader restricts physical entry to a sensitive area. Firewalls, IDS, and password policies are logical or administrative controls.

Question 20Security Concepts and Fundamentals

What is the purpose of salting passwords before hashing?

  1. To shorten the hash output for storage efficiency
  2. To allow the hash to be reversed for verification
  3. To make each stored hash unique even for identical passwords, defeating precomputed tables Correct answer.
  4. To encrypt the password with a symmetric key

Explanation

A salt is a unique random value added to each password before hashing, so identical passwords produce different hashes. This prevents attackers from using precomputed rainbow tables across accounts.

Question 21Security Concepts and Fundamentals

An organization separates duties so that the person who requests a payment cannot also approve it. Which security principle does this enforce?

  1. Defense in depth
  2. Implicit deny
  3. Security through obscurity
  4. Separation of duties Correct answer.

Explanation

Separation of duties splits critical tasks among multiple people so no single individual can complete a sensitive transaction alone. This reduces the risk of fraud or error by requiring collusion to abuse the process.

Question 22Security Concepts and Fundamentals

Which property of a cryptographic hash function ensures that two different inputs will not produce the same output?

  1. Preimage resistance
  2. Salting
  3. Collision resistance Correct answer.
  4. Key length

Explanation

Collision resistance means it is computationally infeasible to find two distinct inputs that hash to the same value. Preimage resistance addresses finding any input for a given output, which is a different property.

Question 23Security Concepts and Fundamentals

A system uses AES-256 in GCM mode with a unique key per session but reuses the same nonce across two messages under one key. What is the primary security consequence?

  1. Confidentiality and integrity protections are weakened for those messages Correct answer.
  2. The key length is effectively reduced to 128 bits automatically
  3. The authentication tag becomes longer than the message
  4. The ciphertext becomes unreadable to the recipient

Explanation

In GCM, nonce reuse under the same key allows an attacker to recover the keystream and XOR it against ciphertexts, undermining confidentiality and enabling forgery of the authentication tag. Unique nonces per key are essential for security.

Question 24Security Concepts and Fundamentals

An attacker with physical access to a powered-off laptop extracts its disk and reads the data. Which control would most directly have prevented disclosure?

  1. Antivirus software scanning the disk
  2. A network firewall at the perimeter
  3. A host-based intrusion detection system
  4. Full-disk encryption with keys protected by a TPM and strong pre-boot authentication Correct answer.

Explanation

Full-disk encryption renders the data unreadable without the key, and binding the key to a TPM with pre-boot authentication prevents simple extraction attacks. Perimeter and host monitoring controls do not protect data at rest on a removed disk.

Question 25Security Concepts and Fundamentals

In a MAC model such as Bell-LaPadula, which rule prevents a subject with a lower clearance from reading data at a higher classification?

  1. The tranquility principle
  2. The star property (no write down)
  3. The least privilege principle
  4. The simple security property (no read up) Correct answer.

Explanation

Bell-LaPadula's simple security property forbids a subject from reading objects at a higher classification than its clearance, protecting confidentiality. The star property separately restricts writing to lower levels.

Question 26Security Concepts and Fundamentals

Which principle states that a user should be granted only the minimum access rights needed to perform their job and nothing more?

  1. Separation of duties
  2. Defense in depth
  3. Need-to-know clearance
  4. Least privilege Correct answer.

Explanation

Least privilege limits each account to the minimum permissions required for its function, reducing the blast radius of misuse or compromise. Separation of duties divides a task among multiple people, and defense in depth layers controls, but neither restricts the scope of a single user's permissions.

Question 27Security Concepts and Fundamentals

Which type of control is a security awareness training program for employees?

  1. Administrative control Correct answer.
  2. Technical control
  3. Physical control
  4. Detective control

Explanation

Administrative (managerial) controls are policies, procedures, and people-focused measures such as training, background checks, and acceptable-use policies. Technical controls are enforced by systems, and physical controls protect facilities and hardware.

Question 28Security Concepts and Fundamentals

A security team needs to ensure that data at rest on a stolen laptop remains unreadable even if the drive is removed and attached to another machine. Which control best meets this requirement?

  1. File integrity monitoring on the host
  2. A host-based intrusion detection system
  3. Full-disk encryption tied to a TPM Correct answer.
  4. Mandatory access control labels on files

Explanation

Full-disk encryption renders the stored data unreadable without the key, and binding the key to a TPM helps prevent decryption when the drive is moved to different hardware. The other options detect or restrict access on a running system but do not protect offline data once the disk is removed.

Question 29Security Concepts and Fundamentals

An organization wants a single sign-on experience for employees across multiple SaaS applications while keeping authentication centralized and enforcing multifactor authentication at one point. Which technology best fits this goal?

  1. A hardware security module for key storage
  2. A federated identity provider using SAML or OpenID Connect Correct answer.
  3. A password vault shared by each department
  4. A VPN concentrator for remote workers

Explanation

A federated identity provider authenticates the user once and issues assertions or tokens that relying applications trust, centralizing authentication and MFA enforcement. Password vaults, VPNs, and HSMs address credential storage, network access, or key management rather than federated single sign-on.

Question 30Security Concepts and Fundamentals

A hash function is used to protect the integrity of a large software download. An attacker who can modify both the file and the published hash value on the same server replaces both. Which change most directly restores assurance that the downloaded file is authentic?

  1. Switch from SHA-256 to a longer hash output
  2. Compute the hash twice and compare the two results
  3. Compress the file before hashing it
  4. Publish the hash through a separately trusted channel or sign it with a private key Correct answer.

Explanation

A hash only proves integrity relative to a trusted reference value; if the attacker controls both the file and the reference, the check is meaningless. Signing the hash with a private key, or distributing it over an independent trusted channel, lets the recipient verify authenticity against a value the attacker cannot forge.

Question 31Access Control and Identity Management

Which access control model grants permissions based on a user's job function rather than on individual identity?

  1. Rule-based access control
  2. Discretionary access control
  3. Mandatory access control
  4. Role-based access control Correct answer.

Explanation

Role-based access control (RBAC) assigns permissions to roles, and users receive permissions by being placed into roles tied to their job function. This decouples authorization from the individual account.

Question 32Access Control and Identity Management

In the identity lifecycle, which activity immediately follows the approval of a new hire's access request?

  1. Privilege revocation
  2. Periodic recertification
  3. Access reconciliation
  4. Account provisioning Correct answer.

Explanation

Provisioning creates the account and assigns the approved entitlements once access has been authorized. Recertification, revocation, and reconciliation occur later in the lifecycle.

Question 33Access Control and Identity Management

Which authentication factor category does a hardware token that generates a one-time code represent?

  1. Somewhere you are
  2. Something you are
  3. Something you have Correct answer.
  4. Something you know

Explanation

A physical token is a possession factor, categorized as 'something you have.' Knowledge factors are memorized secrets, and inherence factors are biometric traits.

Question 34Access Control and Identity Management

What is the primary purpose of the principle of least privilege?

  1. To log every action a user performs
  2. To limit access rights to the minimum needed for a task Correct answer.
  3. To encrypt data at rest by default
  4. To require two independent authentication factors

Explanation

Least privilege restricts each identity to only the permissions required to perform its function, reducing the blast radius of misuse or compromise. It is about minimizing rights, not about logging, MFA, or encryption.

Question 35Access Control and Identity Management

Which protocol is designed to let an application delegate authentication to a trusted identity provider without sharing the user's password?

  1. SAML Correct answer.
  2. SNMP
  3. LDAP
  4. RADIUS

Explanation

SAML is a federation standard that lets an identity provider assert a user's identity to a service provider without exposing credentials. This enables single sign-on across trust domains.

Question 36Access Control and Identity Management

A security team wants a single sign-on experience across multiple cloud applications from different vendors. Which concept best describes the trust arrangement that enables this?

  1. Account lockout
  2. Session fixation
  3. Password vaulting
  4. Identity federation Correct answer.

Explanation

Federation establishes trust between identity providers and service providers so a user authenticated once can access multiple applications. It relies on shared trust and assertions rather than shared credentials.

Question 37Access Control and Identity Management

Which access control model relies on security labels assigned to objects and clearances assigned to subjects, with the system enforcing the rules?

  1. Role-based access control
  2. Discretionary access control
  3. Attribute-based access control
  4. Mandatory access control Correct answer.

Explanation

Mandatory access control enforces access decisions through system-managed labels and clearances; users cannot override them. This contrasts with discretionary models where owners set permissions.

Question 38Access Control and Identity Management

An administrator configures a policy so that users can log in only between 08:00 and 18:00. Which access control approach does this illustrate?

  1. Role-based access control
  2. Discretionary access control
  3. Mandatory access control
  4. Rule-based access control Correct answer.

Explanation

Rule-based access control applies conditional rules such as time-of-day or network location to decide access. The decision depends on environmental conditions rather than on roles or owner discretion.

Question 39Access Control and Identity Management

During a review, an analyst finds a former contractor's account still active 30 days after departure. Which control failure does this most directly represent?

  1. Inadequate password complexity
  2. Weak encryption strength
  3. Missing network segmentation
  4. Failed deprovisioning Correct answer.

Explanation

Deprovisioning removes access when an identity no longer needs it; a lingering active account after departure is a deprovisioning failure. This is a lifecycle governance gap.

Question 40Access Control and Identity Management

Which practice best mitigates the risk of privilege creep for long-tenured employees?

  1. Enabling account lockout thresholds
  2. Increasing password length requirements
  3. Rotating encryption keys
  4. Periodic access recertification Correct answer.

Explanation

Privilege creep occurs when accumulated access exceeds current job needs; periodic recertification reviews and removes excess entitlements. It directly addresses rights that were valid historically but no longer are.

Question 41Access Control and Identity Management

A system enforces separation of duties by preventing the same user from both creating a vendor and approving payment to that vendor. Which risk is primarily being reduced?

  1. Password spraying
  2. Denial of service
  3. Fraud through unchecked authority Correct answer.
  4. Data remanence

Explanation

Separation of duties splits critical tasks so no single identity can complete a sensitive transaction alone, reducing fraud and error. Requiring two parties provides a compensating check on authority.

Question 42Access Control and Identity Management

Which statement accurately describes the difference between authentication and authorization?

  1. Authorization occurs only after a session has expired
  2. Authentication determines permitted actions; authorization verifies identity
  3. Both terms describe the same process applied at different layers
  4. Authentication verifies identity; authorization determines permitted actions Correct answer.

Explanation

Authentication establishes who a subject is, while authorization decides what that subject may do. Authorization typically depends on a prior successful authentication.

Question 43Access Control and Identity Management

An organization wants to enforce multi-factor authentication for remote access. Which combination satisfies the requirement?

  1. A username plus a password
  2. A password plus a fingerprint scan Correct answer.
  3. Two passwords stored in different vaults
  4. A PIN plus a security question

Explanation

MFA requires factors from different categories; a password (knowledge) plus a fingerprint (inherence) qualifies. Combining two secrets from the same category does not provide independent factors.

Question 44Access Control and Identity Management

Which characteristic makes a biometric factor weaker as a standalone authenticator?

  1. It changes with every login
  2. It requires no enrollment process
  3. It cannot be revoked if compromised Correct answer.
  4. It is always shared across users

Explanation

Biometric traits are permanently bound to a person and cannot be reissued like a password if compromised. This makes them best used alongside other factors rather than alone.

Question 45Access Control and Identity Management

A directory service uses a hierarchical structure of organizational units to organize users and groups. Which technology does this most likely describe?

  1. LDAP directory Correct answer.
  2. OAuth token
  3. Kerberos ticket
  4. SAML assertion

Explanation

LDAP organizes directory entries in a hierarchical tree of organizational units and is widely used for identity stores. The hierarchy is a defining structural feature of LDAP directories.

Question 46Access Control and Identity Management

An attacker reuses a stolen session cookie to impersonate a logged-in user. Which control most directly mitigates this?

  1. Longer password minimums
  2. Disabling audit logging
  3. Short session timeouts with secure cookie attributes Correct answer.
  4. Increased account lockout duration

Explanation

Session hijacking is mitigated by limiting session lifetime and protecting cookies with attributes such as Secure and HttpOnly. These reduce the window and exposure for stolen session tokens.

Question 47Access Control and Identity Management

Which OAuth 2.0 concept describes the component that issues access tokens after authenticating the resource owner?

  1. Client application
  2. Authorization server Correct answer.
  3. Resource server
  4. Scope registry

Explanation

The authorization server authenticates the resource owner and issues access tokens to clients. The resource server then accepts those tokens to serve protected resources.

Question 48Access Control and Identity Management

A company wants to grant temporary, narrowly scoped access to a cloud resource for a third-party auditor. Which approach best follows least privilege?

  1. Adding the auditor to a broad all-access group
  2. Creating a permanent admin account for the auditor
  3. Issuing a time-limited role with only the required read permissions Correct answer.
  4. Sharing a general staff account with the auditor

Explanation

A time-limited role scoped to required read permissions gives only the access needed for the task and expires automatically. This limits both the breadth and duration of exposure.

Question 49Access Control and Identity Management

Which identity governance activity compares granted entitlements against what each user actually needs, often using role definitions as a baseline?

  1. Access reconciliation Correct answer.
  2. Penetration testing
  3. Packet filtering
  4. Key escrow

Explanation

Access reconciliation detects mismatches between assigned entitlements and the intended baseline, flagging excess or missing access. It supports governance by surfacing drift for correction.

Question 50Access Control and Identity Management

An organization uses a federated identity model. Which entity is responsible for authenticating the user and asserting identity to the application?

  1. The certificate authority
  2. The relying party
  3. The network firewall
  4. The identity provider Correct answer.

Explanation

In federation, the identity provider authenticates the user and issues assertions that the relying party trusts. The relying party consumes assertions rather than performing primary authentication.