ISC2 Certified in Cybersecurity (CC) — Questions and Answers

Question 1: A zero trust security model is based on which core principle?

Never trust, always verify every access request (Correct answer)
Trust all internal network traffic by default
Disable authentication inside the firewall
Allow unrestricted admin access

Correct answer: Never trust, always verify every access request

Zero trust assumes no implicit trust and verifies every request regardless of location.

Question 2: What is the purpose of a Business Continuity Plan (BCP)?

Audit financial statements
Encrypt all email traffic
Keep critical operations running during a disruption (Correct answer)
Train new sales staff

Correct answer: Keep critical operations running during a disruption

A BCP ensures essential business functions continue during and after a disruption.

Question 3: What of the following best describes cybersecurity?

Preventing illegal access to or publication of information
Addressing risks to information by protecting information assets is handled, saved, or transferred across the internet systems (Correct answer)
The safeguarding of written materials, digital data, and literary and communication that is verbal or visual
The method a company uses to mitigate cybersecurity risk to an adequate level

Correct answer: Addressing risks to information by protecting information assets is handled, saved, or transferred across the internet systems

Cybersecurity encompasses the practices, technologies, and processes designed to protect information assets from digital attacks, damage, or unauthorized access. It involves addressing risks to data, systems, and networks, ensuring the confidentiality, integrity, and availability of information. This protection applies to data whether it is handled, saved, or transferred across internet systems.

Question 4: What does 'data minimization' mean as a compliance principle?

Delete all data after 30 days
Collect only the personal data strictly necessary for the specified purpose (Correct answer)
Encrypt data to reduce its storage footprint
Compress log files to minimize disk usage

Correct answer: Collect only the personal data strictly necessary for the specified purpose

Data minimization requires organizations to collect, store, and process only the minimum personal data necessary for a specific, legitimate purpose.

Question 5: A vendor with network access is breached, exposing your systems. What kind of risk is this?

Supply chain / third-party risk (Correct answer)
Physical theft risk
Power outage risk
Hardware failure risk

Correct answer: Supply chain / third-party risk

Third-party or supply chain risk arises when trusted partners are compromised.

Question 6: What is the risk of leaving software running with unnecessary open ports?

It improves encryption
It expands the attack surface (Correct answer)
It speeds up patching
It reduces memory usage

Correct answer: It expands the attack surface

Open, unused ports give attackers additional entry points.

Question 7: An IDS differs from an IPS primarily in that an IDS:

Encrypts files
Manages users
Only detects and alerts on threats (Correct answer)
Blocks traffic automatically

Correct answer: Only detects and alerts on threats

An IDS detects and alerts on suspicious activity, while an IPS can actively block it.

Question 8: Which of the following cybersecurity positions is responsible for addressing issues and implementing corrective measures?

Cybersecurity Management (Correct answer)
Cybersecurity Specialist
Executive Committee
Board of Directors

Correct answer: Cybersecurity Management

Cybersecurity Management is responsible for overseeing the overall security posture of an organization. This role involves developing and implementing security policies, managing risks, and ensuring that security incidents are properly addressed. They are tasked with identifying issues, coordinating corrective measures, and continuously improving the organization's defenses.

Question 9: What is a honeypot in network security?

A network load balancer
A tool to speed up hash cracking
A decoy system designed to attract and detect attackers (Correct answer)
A type of SSL certificate

Correct answer: A decoy system designed to attract and detect attackers

A honeypot is a fake system deliberately left exposed to lure attackers, allowing defenders to study their tactics and detect intrusions early.

Question 10: What is cross-site scripting (XSS) and why do pentesters look for it?

A method of bypassing SSL certificates
A network packet manipulation attack
Injecting malicious scripts into web pages viewed by other users; exploitable for session hijacking (Correct answer)
A technique for bypassing firewalls

Correct answer: Injecting malicious scripts into web pages viewed by other users; exploitable for session hijacking

XSS allows attackers to inject client-side scripts into web pages, potentially stealing session cookies, redirecting users, or defacing sites, making it a critical web app finding.

Question 11: What is a 'zero-knowledge proof' in cryptography?

A proof that a cryptographic key has never been used
A protocol for conducting anonymous financial transactions
A method that proves knowledge of a secret without revealing the secret itself (Correct answer)
An encryption method that requires no secret keys

Correct answer: A method that proves knowledge of a secret without revealing the secret itself

A zero-knowledge proof allows one party (the prover) to convince another (the verifier) that they know a value, without conveying any information about the value itself.

Question 12: What does the principle of least privilege require?

Disabling all user accounts
Giving all users admin rights
Granting users only the access needed for their job (Correct answer)
Sharing one account among staff

Correct answer: Granting users only the access needed for their job

Least privilege limits each user's access to only what their role requires.

Question 13: PCI DSS compliance is required for organizations that:

Manage federal tax records
Run electric utilities
Handle payment card data (Correct answer)
Operate public schools

Correct answer: Handle payment card data

PCI DSS applies to any organization that stores, processes, or transmits cardholder data.

Question 14: Which file artifact is most useful for determining what programs were recently executed on a Windows system?

Prefetch files (Correct answer)
BIOS settings
Registry backup
DNS cache

Correct answer: Prefetch files

Windows Prefetch files record recently executed programs including execution timestamps and file paths, making them valuable in forensic investigations.

Question 15: What is the primary goal of the 'containment' phase in incident response?

Restore systems to normal operations
Prevent the incident from spreading to additional systems (Correct answer)
Document lessons learned
Identify the root cause of the attack

Correct answer: Prevent the incident from spreading to additional systems

Containment stops an active incident from spreading further while preserving evidence and maintaining critical business functions.

Question 16: Why are regular internal security audits important for an organization?

They increase sales revenue directly
They eliminate the need for backups
They replace the legal department
They verify controls are working and find gaps before attackers do (Correct answer)

Correct answer: They verify controls are working and find gaps before attackers do

Internal audits validate control effectiveness and surface weaknesses proactively.

Question 17: What is the purpose of a risk assessment in a compliance program?

Verify software license compliance
Test employee phishing awareness
Identify, analyze, and prioritize risks to determine appropriate security controls (Correct answer)
Enumerate all open network ports

Correct answer: Identify, analyze, and prioritize risks to determine appropriate security controls

Risk assessments identify potential threats, analyze their likelihood and impact, and help organizations prioritize which controls to implement first.

Question 18: For a company's public servers, VPN termination, and modem pools, the _______ serves as a constrained, segregated network.

Wireless Protected Area
Local Area Network
Virtual Private Network
Demilitarized zone (Correct answer)

Correct answer: Demilitarized zone

A Demilitarized Zone (DMZ) is a perimeter network that acts as a buffer between an organization's internal network and an untrusted external network, such as the internet. It hosts public-facing services like web servers, email servers, and VPN termination points. This segregation limits the impact of potential attacks on public services from reaching the more secure internal network.

Question 19: What is steganography in the context of information security?

The practice of hiding secret data within ordinary, non-secret files or messages (Correct answer)
A method of symmetric key encryption for bulk data
A digital signature algorithm based on elliptic curves
A protocol for securely exchanging cryptographic keys

Correct answer: The practice of hiding secret data within ordinary, non-secret files or messages

Steganography conceals the existence of a message by embedding it inside another file (such as an image or audio file), unlike cryptography which obscures the message content.

Question 20: A company encrypts laptops with full-disk encryption. This primarily protects against:

Software bugs
Slow boot times
Network outages
Data exposure if a device is lost or stolen (Correct answer)

Correct answer: Data exposure if a device is lost or stolen

Full-disk encryption keeps data unreadable if the physical device is lost or stolen.

Question 21: An attacker injects malicious script into a web form that runs in other users' browsers. What attack is this?

Phishing
DNS spoofing
Brute force
Cross-site scripting (XSS) (Correct answer)

Correct answer: Cross-site scripting (XSS)

XSS injects malicious scripts that execute in victims' browsers.

Question 22: What does the 'principle of defense in depth' mean?

Trusting all internal users
Encrypting only one server
Using multiple layered security controls (Correct answer)
Relying on a single strong firewall

Correct answer: Using multiple layered security controls

Defense in depth layers controls so one failure does not expose everything.

Question 23: What does PKI stand for in the context of digital certificates and encryption?

Private Key Interface
Protected Knowledge Index
Public Knowledge Integration
Public Key Infrastructure (Correct answer)

Correct answer: Public Key Infrastructure

PKI (Public Key Infrastructure) is the framework of hardware, software, policies, and procedures used to create, manage, and revoke digital certificates.

Question 24: What is the main goal of a security awareness training program?

Reduce human-error-based incidents like phishing (Correct answer)
Eliminate the need for firewalls
Increase server uptime
Replace antivirus software

Correct answer: Reduce human-error-based incidents like phishing

Awareness training targets human behavior, the cause of most phishing and social-engineering incidents.

Question 25: An attacker tries one common password against many accounts. What is this technique called?

Dictionary cracking
Keylogging
Rainbow table
Password spraying (Correct answer)

Correct answer: Password spraying

Password spraying tests a few common passwords across many accounts to avoid lockouts.

Question 26: What is the main goal of network segmentation software and tools?

Compress images
Limit lateral movement of attackers (Correct answer)
Increase monitor brightness
Speed up typing

Correct answer: Limit lateral movement of attackers

Segmentation restricts attacker movement by isolating network zones.

Question 27: What is the purpose of an XDR platform?

Manage spreadsheets
Render animations
Host websites
Unify detection and response across endpoints, network, and cloud (Correct answer)

Correct answer: Unify detection and response across endpoints, network, and cloud

XDR (Extended Detection and Response) correlates telemetry across multiple security layers for unified response.

Question 28: Which tool would an analyst use to scan open ports and discover services on a network?

Blender
Audacity
Nmap (Correct answer)
WinRAR

Correct answer: Nmap

Nmap is the standard tool for port scanning and network service discovery.

Question 29: What is a runbook in incident response?

A documented step-by-step procedure for responding to specific incident types (Correct answer)
A database of known malware hashes
A physical notebook used by on-call engineers
A log of all network packets captured

Correct answer: A documented step-by-step procedure for responding to specific incident types

A runbook provides pre-written, step-by-step instructions for handling specific incident types, enabling faster and more consistent response.

Question 30: Which tool category inspects and controls traffic between network segments based on rules?

Media player
Word processor
Email client
Firewall (Correct answer)

Correct answer: Firewall

Firewalls enforce rules to allow or block traffic between network zones.

Question 31: An organization adopts a 'defense in depth' strategy. This means:

Relying on a single strong firewall
Outsourcing all security decisions
Using only physical locks
Layering multiple security controls so one failure isn't catastrophic (Correct answer)

Correct answer: Layering multiple security controls so one failure isn't catastrophic

Defense in depth uses overlapping layers so no single control failure is fatal.

Question 32: Which of the following best sums up the use of firewalls?

To stop incoming transmissions from being used for unauthorized access. (Correct answer)
To make data download from websites simple.
To find and remove infections that are already on a computer.
To guard against a computer being destroyed in a fire.

Correct answer: To stop incoming transmissions from being used for unauthorized access.

Firewalls act as a barrier between a trusted internal network and untrusted external networks, like the internet. Their primary function is to monitor and control incoming and outgoing network traffic based on predefined security rules. This prevents unauthorized access attempts and blocks malicious data transmissions from reaching internal systems.

Question 33: Which metric helps measure how long it takes a security team to identify an incident?

Return on investment
Customer churn rate
Net promoter score
Mean Time to Detect (MTTD) (Correct answer)

Correct answer: Mean Time to Detect (MTTD)

MTTD measures the average time to detect a security incident.

Question 34: What is the purpose of a penetration test report?

Archive exploit code for future use
Bill the client for testing hours
Submit vulnerabilities to CVE directly
Document findings, severity ratings, evidence, and remediation recommendations for the client (Correct answer)

Correct answer: Document findings, severity ratings, evidence, and remediation recommendations for the client

A pentest report communicates discovered vulnerabilities with evidence, CVSS severity scores, and actionable remediation steps to help the client fix identified weaknesses.

Question 35: A vendor will process your customer data. What document defines their security obligations?

Marketing brochure
Data Processing Agreement / contract with security clauses (Correct answer)
Public press release
Employee handbook

Correct answer: Data Processing Agreement / contract with security clauses

A data processing agreement contractually binds third parties to required security obligations.

Question 36: A USB drive is found in the parking lot and plugged into a work PC. What risk does this create?

Malware execution via baiting (Correct answer)
Improved encryption
Reduced network latency
Faster file transfer

Correct answer: Malware execution via baiting

Baiting uses tempting physical media to deliver malware when connected.

Question 37: What does IOC stand for in threat investigation?

Index of Controls
Internal Operations Center
Internet Outage Condition
Indicator of Compromise (Correct answer)

Correct answer: Indicator of Compromise

An IOC (Indicator of Compromise) is a piece of forensic data such as a file hash, IP address, or domain that indicates a system may have been breached.

Question 38: What is passive reconnaissance in ethical hacking?

Scanning the target's network ports without authentication
Reading the target's internal documentation
Running vulnerability scans during off-peak hours
Gathering information without directly interacting with the target, such as using OSINT (Correct answer)

Correct answer: Gathering information without directly interacting with the target, such as using OSINT

Passive reconnaissance collects target information using publicly available sources (OSINT) without making any direct contact that could be detected or logged.

Question 39: Which US regulation requires healthcare organizations to protect patient health information (PHI)?

PCI DSS
GDPR
SOX
HIPAA (Correct answer)

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) mandates security and privacy protections for Protected Health Information in the US healthcare sector.

Question 40: What does chain of custody mean in digital forensics?

A method for encrypting forensic disk images
A sequence of firewall rules
Documented record tracking who handled evidence and when (Correct answer)
A blockchain-based authentication protocol

Correct answer: Documented record tracking who handled evidence and when

Chain of custody is the documented, unbroken record of who collected, handled, and transferred digital evidence, essential for legal admissibility.

Question 41: What is a security audit?

An automated malware scan
A real-time network traffic analysis
A penetration test that uses real exploits
A systematic evaluation of an organization's security posture against a defined standard (Correct answer)

Correct answer: A systematic evaluation of an organization's security posture against a defined standard

A security audit formally assesses an organization's policies, procedures, and controls against a standard (like ISO 27001 or NIST) to identify gaps.

Question 42: Virtual "listening in" on data exchanged over a WiFi network that is not secure (not encrypted).

WPA2 Handshake Vulnerabilities
Spyware
Wi-Fi Eavesdropping (Correct answer)
Wl-Fl Master

Correct answer: Wi-Fi Eavesdropping

Wi-Fi Eavesdropping refers to the act of intercepting and monitoring data transmitted over an unsecured (unencrypted) Wi-Fi network. Attackers can 'listen in' on network traffic, capturing sensitive information like login credentials, personal messages, or financial data as it travels wirelessly. Using encrypted Wi-Fi protocols like WPA2/WPA3 helps prevent this.

Question 43: Separation of duties is primarily intended to reduce which risk?

Hardware failure
Slow internet speeds
Software licensing costs
Fraud or error by a single individual (Correct answer)

Correct answer: Fraud or error by a single individual

Splitting critical tasks among people prevents any one person from committing or hiding fraud.

Question 44: Which open-source tool is most associated with network packet capture and analysis?

Tableau
Photoshop
Jenkins
Wireshark (Correct answer)

Correct answer: Wireshark

Wireshark is the industry-standard tool for capturing and inspecting network packets.

Question 45: What is the primary purpose of an access control review (recertification)?

Replace expired SSL certificates
Speed up the network
Confirm users still need their current access rights (Correct answer)
Update antivirus signatures

Correct answer: Confirm users still need their current access rights

Periodic recertification verifies that access rights still match each user's job needs.

Question 46: What is the purpose of NAT (Network Address Translation) in a firewall?

Scans files for malware before download
Maps private internal IP addresses to a public IP, hiding internal structure (Correct answer)
Blocks all incoming UDP traffic
Encrypts all outbound email messages

Correct answer: Maps private internal IP addresses to a public IP, hiding internal structure

NAT translates private internal IP addresses to a public-facing IP, masking the internal network topology from outside observers.

Question 47: What is the main goal of a third-party (vendor) risk management program?

Increase advertising reach
Assess and reduce risk introduced by suppliers and partners (Correct answer)
Improve product packaging
Lower the company tax rate

Correct answer: Assess and reduce risk introduced by suppliers and partners

Vendor risk management evaluates and mitigates security risks from external suppliers.

Question 48: A user receives an email appearing to be from the IT department asking them to confirm their password via a link. What attack is this?

SQL injection
Phishing (Correct answer)
DDoS
Buffer overflow

Correct answer: Phishing

Phishing uses deceptive messages impersonating trusted entities to steal credentials.

Question 49: What does a virtual private network (VPN) primarily provide?

Stronger physical locks
Free unlimited storage
An encrypted tunnel for secure remote connections (Correct answer)
Automatic malware removal

Correct answer: An encrypted tunnel for secure remote connections

A VPN encrypts traffic, protecting data over untrusted networks.

Question 50: Which soft skill is repeatedly ranked as critical for cyber security leadership roles?

Memorizing every CVE number
Ability to communicate technical risks to non-technical executives (Correct answer)
Physical endurance testing
Speed-typing proficiency

Correct answer: Ability to communicate technical risks to non-technical executives

Translating complex technical risks into business language for executives is consistently ranked as the top soft skill for cyber security leaders.

Question 51: Which control type is a security camera that records activity for later review?

Detective control (Correct answer)
Compensating control
Preventive control
Corrective control

Correct answer: Detective control

A camera detects and records events but does not stop them, making it a detective control.

Question 52: Which of the following justifies requiring a username and password for login?

To make it simple to download data from websites.
To stop incoming transmissions from being used without permission. (Correct answer)
To find and remove infections from computers.
To avoid a computer being destroyed in the event of a fire.

Correct answer: To stop incoming transmissions from being used without permission.

Requiring a username and password for login is a fundamental component of access control. This security measure ensures that only authorized individuals, who possess the correct credentials, can gain entry to a system or network. By verifying user identity, it prevents unauthorized access and protects sensitive data and resources from misuse.

Question 53: Which type of compliance role is responsible for ensuring an organization meets all applicable laws and regulations?

Chief Technology Officer (CTO)
Chief Marketing Officer (CMO)
Chief Compliance Officer (CCO) (Correct answer)
Chief Financial Officer (CFO)

Correct answer: Chief Compliance Officer (CCO)

The CCO (Chief Compliance Officer) is responsible for overseeing and managing the organization's compliance with legal and regulatory requirements, including cybersecurity laws.

Question 54: Which control most effectively limits damage if a single user account is compromised?

Sharing admin accounts
Longer session timeouts
Principle of least privilege (Correct answer)
Disabling the firewall

Correct answer: Principle of least privilege

Least privilege restricts accounts to only the access they need, limiting an attacker's reach.

Question 55: What is the purpose of a post-incident review (PIR)?

Document lessons learned to improve future incident response (Correct answer)
Notify all users to change passwords immediately
Terminate employees involved in the incident
Reformat all affected hard drives

Correct answer: Document lessons learned to improve future incident response

A PIR identifies what worked, what failed, and what improvements should be made to prevent recurrence and strengthen the incident response process.

Question 56: Which protocol is used to securely transfer files over a network, replacing plain FTP?

HTTP
SFTP (Correct answer)
Telnet
SNMP

Correct answer: SFTP

SFTP (SSH File Transfer Protocol) encrypts both commands and data, making it the secure replacement for legacy FTP.

Question 57: What is network segmentation and why is it important?

Combining all servers into one large network for simplicity
Disabling firewalls for internal traffic
Dividing a network into subnetworks to limit the spread of breaches (Correct answer)
Removing encryption to improve performance

Correct answer: Dividing a network into subnetworks to limit the spread of breaches

Network segmentation isolates parts of a network so a breach in one segment cannot easily spread to others, limiting attacker lateral movement.

Question 58: What does PCI DSS govern?

Rules for government contractor cybersecurity
Environmental regulations for data centers
Security standards for organizations that process credit card payments (Correct answer)
US export controls for encryption software

Correct answer: Security standards for organizations that process credit card payments

PCI DSS (Payment Card Industry Data Security Standard) sets security requirements for any organization that stores, processes, or transmits cardholder data.

Question 59: What is the main goal of a zero-trust security model?

Verify every access request regardless of location (Correct answer)
Eliminate all passwords
Allow unrestricted admin access
Trust all internal traffic by default

Correct answer: Verify every access request regardless of location

Zero-trust assumes no implicit trust and verifies every request continuously.

Question 60: What is a VPN primarily used for in a corporate environment?

Blocking social media websites
Generating digital certificates
Encrypting remote connections to protect data in transit (Correct answer)
Speeding up internet browsing

Correct answer: Encrypting remote connections to protect data in transit

A VPN (Virtual Private Network) creates an encrypted tunnel for remote users to securely access corporate resources.

Question 61: Which skill is increasingly listed as 'required' in US cloud security job postings?

Experience with AWS, Azure, or GCP (Correct answer)
Knowledge of physical lock mechanisms
Expertise in analog telephony
Proficiency in COBOL programming

Correct answer: Experience with AWS, Azure, or GCP

Cloud platform experience (AWS, Azure, or GCP) is now a standard requirement in US cloud security roles.

Question 62: Which OSI layer does a WAF (Web Application Firewall) operate on?

Layer 3 (Network)
Layer 1 (Physical)
Layer 7 (Application) (Correct answer)
Layer 4 (Transport)

Correct answer: Layer 7 (Application)

A WAF operates at OSI Layer 7, inspecting HTTP/HTTPS traffic to block application-layer attacks like SQL injection and XSS.

Question 63: An employee leaves the company. Which offboarding step is most critical for security?

Returning their parking pass
Updating the org chart
Promptly revoking all system access (Correct answer)
Scheduling an exit lunch

Correct answer: Promptly revoking all system access

Immediately revoking access prevents former employees from misusing accounts.

Question 64: Which software helps analysts visualize and investigate relationships during incident response?

Clock app
Calculator
Link-analysis/graph tool (Correct answer)
Weather app

Correct answer: Link-analysis/graph tool

Link-analysis tools map relationships between entities to support investigations.

Question 65: Which of the following offers the strongest wireless signal encryption?

WEP
WAP
WIPS
WPA (Correct answer)

Correct answer: WPA

WPA (Wi-Fi Protected Access) was developed as an interim solution to address the serious security flaws found in the older WEP protocol. WPA introduced stronger encryption (TKIP) and improved authentication methods, making it significantly more secure than WEP. While WPA2 and WPA3 offer even greater security, WPA was a crucial step forward in wireless encryption among the given options.

Question 66: Which industry sector employs the most cyber security professionals in the United States?

Finance and Banking (Correct answer)
Retail Apparel
Entertainment
Agriculture

Correct answer: Finance and Banking

The finance and banking sector employs the most cyber security professionals due to strict regulations and high-value data assets.

Question 67: Which of the following protect a computer against the possibility of harmful software?

Anti-spyware software.
PC diagnostic software. (Correct answer)
Web tracking software.
Anti-spam software.

Correct answer: PC diagnostic software.

While anti-spyware and anti-virus software are primary tools for direct protection, PC diagnostic software can play an indirect role in guarding against harmful software. It identifies system anomalies, unusual processes, or performance degradation that might be symptoms of an infection. By detecting these indicators, it prompts users to investigate and potentially remove the threat, thus contributing to overall system security.

Question 68: What does 'least privilege' mean as a compliance and security principle?

All users should have equal access to all systems
Guest accounts should be disabled by default
Users and systems should have only the minimum access needed to perform their role (Correct answer)
Administrators should hold the most privileged accounts at all times

Correct answer: Users and systems should have only the minimum access needed to perform their role

The principle of least privilege limits user and system permissions to the bare minimum required for their function, reducing the blast radius of any compromise.

Question 69: What is a scope of work (SOW) in penetration testing?

A court order authorizing the test
A summary of all vulnerabilities found
A document defining what systems are authorized for testing and the rules of engagement (Correct answer)
A software license for testing tools

Correct answer: A document defining what systems are authorized for testing and the rules of engagement

The SOW defines the boundaries of the engagement — which systems can be tested, what methods are allowed, and timeframes — protecting both parties legally.

Question 70: What does mean time to detect (MTTD) measure in security operations?

The time to recover systems after an outage
The average patch deployment speed
The frequency of false positive alerts
The average time between a breach occurring and its discovery (Correct answer)

Correct answer: The average time between a breach occurring and its discovery

MTTD measures how long it takes on average for a SOC to detect a security incident after it begins, a key KPI for evaluating detection capability.

Question 71: What is the main function of endpoint detection and response (EDR)?

Compress files
Manage payroll
Monitor and respond to threats on devices (Correct answer)
Generate marketing reports

Correct answer: Monitor and respond to threats on devices

EDR continuously monitors endpoints to detect and respond to threats.

Question 72: Which protocol primarily uses cryptography to secure web (HTTPS) communications?

SMTP
HTTP
FTP
TLS/SSL (Correct answer)

Correct answer: TLS/SSL

TLS (Transport Layer Security), and its predecessor SSL, use cryptographic protocols to establish encrypted channels for HTTPS and other secure communications.

Question 73: What is triage in the context of incident response?

Patching all systems simultaneously
Prioritizing incidents based on severity and business impact (Correct answer)
Wiping compromised systems immediately
Notifying media about a breach

Correct answer: Prioritizing incidents based on severity and business impact

Triage involves quickly assessing and prioritizing multiple security incidents to allocate response resources to the most critical issues first.

Question 74: What is the purpose of multi-factor authentication (MFA) in an organization?

Eliminate the need for passwords entirely
Require more than one proof of identity to reduce account compromise (Correct answer)
Speed up logins
Encrypt the hard drive

Correct answer: Require more than one proof of identity to reduce account compromise

MFA adds extra identity factors so a stolen password alone cannot grant access.

Question 75: What does FISMA require of US federal agencies?

Encrypt all outbound email
Conduct annual penetration tests on all systems
Report quarterly earnings to shareholders
Develop, document, and implement agency-wide information security programs (Correct answer)

Correct answer: Develop, document, and implement agency-wide information security programs

FISMA (Federal Information Security Management Act) requires US federal agencies to implement comprehensive information security programs and report annually to OMB.

Question 76: In cryptography, what is a 'nonce' primarily used for?

A variant of a hashing algorithm
A type of private encryption key
A standardized certificate format
A number used once to prevent replay attacks (Correct answer)

Correct answer: A number used once to prevent replay attacks

A nonce (number used once) is a random or pseudo-random value included in cryptographic communications to ensure that old messages cannot be reused in replay attacks.

Question 77: What is the 'kill chain' model used for in incident response?

A method for calculating breach financial impact
A tool for automating patch deployment
Mapping attack stages to help defenders identify and disrupt attacker progression (Correct answer)
A physical security control for server rooms

Correct answer: Mapping attack stages to help defenders identify and disrupt attacker progression

The Cyber Kill Chain framework maps the stages of a cyberattack (reconnaissance through exfiltration) to help defenders detect and interrupt attacks at each step.

Question 78: Which of the following remote access protocols is secure?

FTP
Telnet
SSH (Correct answer)
SMTP

Correct answer: SSH

SSH (Secure Shell) is a cryptographic network protocol that provides a secure channel over an unsecured network for remote access and data transfer. Unlike older protocols like Telnet or FTP, SSH encrypts all communications, including authentication credentials, protecting them from eavesdropping and tampering. This makes it the preferred choice for secure remote administration.

Question 79: RSA is a well-known example of which category of cryptographic algorithm?

Stream cipher
Symmetric encryption
Hash function
Asymmetric encryption (Correct answer)

Correct answer: Asymmetric encryption

RSA uses a public/private key pair, classifying it as an asymmetric (public-key) algorithm used for encryption and digital signatures.

Question 80: Which tool is commonly used to create a forensic bit-for-bit image of a hard drive?

dd or FTK Imager (Correct answer)
Wireshark
Microsoft Word
nmap

Correct answer: dd or FTK Imager

Tools like dd (Linux) and FTK Imager create exact bit-for-bit copies of storage media for forensic analysis without altering the original.

Question 81: Which of the following best reflects the proper format for reporting an IT security breach?

Use a phone.
Utilizing the procedure detailed in the company's security policy. (Correct answer)
Using any available communication method.
By sending the IT Manager an email.

Correct answer: Utilizing the procedure detailed in the company's security policy.

The proper procedure for reporting an IT security breach is crucial for effective incident response. Companies typically establish a formal security policy that outlines specific steps, communication channels, and personnel to notify in the event of a breach. Following this documented procedure ensures that the incident is handled consistently, efficiently, and in compliance with regulations.

Question 82: Which port does HTTPS traffic use by default?

22
80
3389
443 (Correct answer)

Correct answer: 443

HTTPS uses TCP port 443 by default, while plain HTTP uses port 80.

Question 83: What does CVE stand for in vulnerability research?

Certified Vulnerability Expert
Critical Vector Enumeration
Common Vulnerabilities and Exposures (Correct answer)
Cyber Vulnerability Evaluation

Correct answer: Common Vulnerabilities and Exposures

CVE (Common Vulnerabilities and Exposures) is the standardized list of publicly known cybersecurity vulnerabilities, each assigned a unique ID (e.g., CVE-2021-44228).

Question 84: A sandbox in malware analysis is used to do what?

Safely execute and observe suspicious files (Correct answer)
Speed up the CPU
Compress backups
Encrypt emails

Correct answer: Safely execute and observe suspicious files

A sandbox isolates and runs suspicious code so its behavior can be observed without risk.

Question 85: What is a payload in a penetration testing context?

The malicious code that executes on the target after successful exploitation (Correct answer)
The network packet header
The scope of work document
A list of discovered vulnerabilities

Correct answer: The malicious code that executes on the target after successful exploitation

A payload is the component of an exploit that performs the intended malicious action on the target system, such as opening a reverse shell or establishing persistence.

Question 86: What should the penetration testing phase be done in chronological order?

Planning, attack, discovery, reporting
Attack, discovery, reporting, planning (Correct answer)
Attack, planning, discovery, reporting
Discovery, Planning, attack, reporting

Correct answer: Attack, discovery, reporting, planning

This order might reflect an iterative or reactive penetration testing approach. An initial 'attack' could be launched to test immediate defenses, followed by 'discovery' of how systems reacted and what vulnerabilities were exposed. The findings are then compiled in a 'reporting' phase, which informs the strategic 'planning' for future security enhancements or subsequent testing cycles.

Question 87: RTO (Recovery Time Objective) measures:

How quickly a system must be restored after an outage (Correct answer)
How many users a server supports
The strength of a password
The number of firewall rules

Correct answer: How quickly a system must be restored after an outage

RTO defines the target time to restore a system or process after disruption.

Question 88: Which type of software provides single sign-on and federated identity across applications?

Spreadsheet app
IAM/SSO platform (Correct answer)
Disk defragmenter
Photo editor

Correct answer: IAM/SSO platform

Identity and Access Management (IAM) platforms enable SSO and federated authentication.

Question 89: What is 'purple teaming' in a cyber security job context?

A type of malware analysis technique
Collaborative exercises where red and blue teams work together (Correct answer)
A color-coded phishing simulation
A certification program for government contractors

Correct answer: Collaborative exercises where red and blue teams work together

Purple teaming combines offensive (red) and defensive (blue) teams working jointly to improve detection and response capabilities.

Question 90: What primary threat is post-quantum cryptography designed to address?

The ability of quantum computers to break classical public-key encryption algorithms (Correct answer)
Reducing cryptographic key sizes to improve efficiency
The need for faster symmetric encryption on mobile devices
Improving the reliability of current hash function standards

Correct answer: The ability of quantum computers to break classical public-key encryption algorithms

Quantum computers running Shor's algorithm can theoretically break RSA and ECC; post-quantum cryptography develops algorithms resistant to quantum attacks.

Question 91: What does multi-factor authentication (MFA) add beyond a password?

An additional verification factor like a code or token (Correct answer)
Automatic password resets
A faster login process
A stronger password hash

Correct answer: An additional verification factor like a code or token

MFA requires a second independent factor, so a stolen password alone is not enough.

Question 92: What is the main function of an EDR (Endpoint Detection and Response) tool?

Encrypt network traffic
Manage user passwords
Block spam email
Monitor and respond to threats on endpoints (Correct answer)

Correct answer: Monitor and respond to threats on endpoints

EDR continuously monitors endpoints to detect, investigate, and respond to suspicious activity.

Question 93: Which document records identified risks, their severity, and treatment decisions?

Marketing plan
Change log
Asset invoice
Risk register (Correct answer)

Correct answer: Risk register

A risk register catalogs risks along with their ratings and chosen treatments.

Question 94: Which software is used to centrally manage and deploy security patches across many machines?

Game launcher
Patch management system (Correct answer)
Drawing tool
Music streaming app

Correct answer: Patch management system

Patch management systems automate the distribution and tracking of software updates.

Question 95: What does IDS stand for in network security?

Internal DNS Server
Internet Data Storage
Integrated Decryption Suite
Intrusion Detection System (Correct answer)

Correct answer: Intrusion Detection System

An IDS (Intrusion Detection System) monitors network traffic and alerts administrators to suspicious or malicious activity.

Question 96: An employee's login attempts come from two countries minutes apart. What does this likely indicate?

A software update
A faster connection
Possible compromised credentials (Correct answer)
Normal travel behavior

Correct answer: Possible compromised credentials

Impossible-travel logins suggest stolen credentials being used elsewhere.

Question 97: What is the purpose of a Business Associate Agreement (BAA) under HIPAA?

Documents network topology for compliance auditors
Legally binds third-party vendors to protect PHI on behalf of covered entities (Correct answer)
Grants employees access to patient records
Outlines the company's social media policy

Correct answer: Legally binds third-party vendors to protect PHI on behalf of covered entities

A BAA is a required HIPAA contract between a covered entity and a business associate that handles PHI, holding the vendor to HIPAA security and privacy requirements.

Question 98: An organization wants a single document that defines acceptable use, access rules, and consequences for employees. Which artifact is this?

Network diagram
Security policy (Correct answer)
Incident log
Penetration test report

Correct answer: Security policy

A security policy formally defines acceptable use, access rules, and enforcement consequences.

Question 99: What is the role of a threat intelligence platform (TIP)?

Manage payroll
Aggregate and operationalize threat data feeds (Correct answer)
Render 3D graphics
Edit videos

Correct answer: Aggregate and operationalize threat data feeds

A TIP collects, normalizes, and operationalizes external threat intelligence feeds.

Question 100: Which practice best protects against a ransomware attack encrypting your files?

Using a single shared admin password
Paying the ransom promptly
Disabling antivirus to save resources
Maintaining offline, tested backups (Correct answer)

Correct answer: Maintaining offline, tested backups

Reliable offline backups allow recovery without paying attackers.

ISC2 Certified in Cybersecurity (CC)

The ISC2 Certified in Cybersecurity (CC) is an entry-level certification designed for individuals pursuing cyber security careers, covering foundational security principles, network security, access controls, incident response, and security operations.

100

Questions

180 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds