ISC2 CC (Certified in Cybersecurity) Exam — Questions and Answers

Question 1: What is a key activity in vulnerability management?

Monitoring network traffic
Implementing firewalls
Training employees
Scanning for vulnerabilities (Correct answer)

Correct answer: Scanning for vulnerabilities

Vulnerability management is a continuous process of identifying, assessing, prioritizing, and remediating security weaknesses in systems and applications. A key activity in this process is regularly scanning for vulnerabilities, which involves using specialized tools to detect known security flaws and misconfigurations. This proactive identification is crucial for understanding an organization's attack surface and implementing timely patches or fixes.

Question 2: Which access control model allows resource owners to determine who can access their resources?

Discretionary Access Control (DAC) (Correct answer)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control

Correct answer: Discretionary Access Control (DAC)

Discretionary Access Control (DAC) allows the owner of a resource to decide who can access it and what permissions they have.

Question 3: Which of the following is NOT a component of CIA triad?

Integrity
Availability
Confidentiality
Authentication (Correct answer)

Correct answer: Authentication

The CIA triad is a foundational model in information security, representing three core principles: Confidentiality, Integrity, and Availability. Confidentiality ensures data privacy, Integrity ensures data accuracy and trustworthiness, and Availability ensures systems and data are accessible when needed. Authentication is a mechanism used to enforce these principles, particularly confidentiality and integrity, but it is not one of the three core principles itself.

Question 4: What is the primary purpose of access control?

To encrypt sensitive data
To detect security incidents
To ensure only authorized users can access resources (Correct answer)
To monitor network traffic

Correct answer: To ensure only authorized users can access resources

Access control ensures that only authorized individuals can access specific systems, data, or physical locations.

Question 5: What is the principle of separation of duties?

Dividing security responsibilities among team members
Separating development and production environments
Requiring multiple individuals to complete sensitive or critical tasks (Correct answer)
Dividing network access between departments

Correct answer: Requiring multiple individuals to complete sensitive or critical tasks

Separation of duties requires that critical tasks be divided among multiple individuals to prevent fraud or error by any single person.

Question 6: Which of the following BEST describes an Indicator of Compromise (IoC)?

A software patch that fixes a known vulnerability
A policy defining acceptable use of resources
A forensic artifact suggesting a system has been breached (Correct answer)
A tool used to scan networks for open ports

Correct answer: A forensic artifact suggesting a system has been breached

An Indicator of Compromise (IoC) is a forensic artifact or observable evidence that indicates a potential intrusion or security breach has occurred.

Question 7: What distinguishes a security 'incident' from a security 'event'?

Events are always malicious; incidents are accidental
Incidents are minor issues; events are critical threats
Events affect hardware systems; incidents affect software
An event is any observable occurrence; an incident is an event that threatens or violates security policy (Correct answer)

Correct answer: An event is any observable occurrence; an incident is an event that threatens or violates security policy

An event is any observable occurrence in a system or network, while an incident is an event that actually violates or imminently threatens the violation of security policies.

Question 8: Which of the following is an example of a physical security control?

Biometric access controls. (Correct answer)
Implementation of firewalls.
User access reviews.
Encryption of sensitive data

Correct answer: Biometric access controls.

Physical security controls are measures designed to protect physical assets, facilities, and personnel from unauthorized access, damage, or theft. Biometric access controls, such as fingerprint or facial recognition scanners, directly regulate physical entry to restricted areas. In contrast, encryption, firewalls, and user access reviews are logical or administrative security controls.

Question 9: Which of the following best describes the concept of due diligence in security?

Taking reasonable care to implement and maintain security controls (Correct answer)
Conducting penetration testing annually
Encrypting all sensitive data
Training all employees in cybersecurity

Correct answer: Taking reasonable care to implement and maintain security controls

Due diligence in security means taking reasonable steps to identify and address security risks and maintain appropriate protections.

Question 10: What is a man-in-the-middle (MITM) attack?

An attack targeting database servers with SQL injection
An attack where a hacker gains physical access to a server
An insider threat from a current or former employee
An attacker secretly intercepting and potentially altering communications between two parties (Correct answer)

Correct answer: An attacker secretly intercepting and potentially altering communications between two parties

In a MITM attack, an attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly.

Question 11: What does data sanitization ensure before disposing of storage media?

That all data is permanently removed and cannot be recovered from the media (Correct answer)
That the media is certified for secure storage going forward
That backup copies of the data exist before disposal
That the media meets performance benchmarks before reuse

Correct answer: That all data is permanently removed and cannot be recovered from the media

Data sanitization ensures that all data on storage media is permanently destroyed or unrecoverable before the media is disposed of or reused.

Question 12: Which type of incident response team is a full-time, permanently established team within an organization?

Outsourced CSIRT
Dedicated CSIRT (Correct answer)
Distributed CSIRT
Virtual CSIRT

Correct answer: Dedicated CSIRT

A Dedicated (Permanent) CSIRT is a full-time team with incident response as its primary mission, always available within the organization.

Question 13: Which of the following is an example of a physical security control?

Encryption
Intrusion detection system
Security badge reader (Correct answer)
Firewall

Correct answer: Security badge reader

A security badge reader is a physical control that restricts physical access to facilities or areas.

Question 14: What is the purpose of a Business Continuity Plan (BCP)?

To ensure IT systems are patched
To encrypt sensitive data
To mange user access
To maintain operations during a disruptive event (Correct answer)

Correct answer: To maintain operations during a disruptive event

A Business Continuity Plan (BCP) is a comprehensive strategy designed to ensure that an organization can continue to operate its critical functions during and after a disruptive event, such as a natural disaster, cyberattack, or system failure. Its primary purpose is to minimize downtime and financial losses by outlining procedures, resources, and responsibilities for maintaining essential business operations. It focuses on organizational resilience rather than just IT systems.

Question 15: Which of the following is a biometric authentication method?

Smart card
Retinal scan (Correct answer)
PIN
Password

Correct answer: Retinal scan

A retinal scan is a biometric authentication method that uses unique physical characteristics to verify identity.

Question 16: What is the purpose of security awareness training?

To teach employees programming and technical security skills
To replace technical security controls with human vigilance
To help employees recognize and respond appropriately to security threats (Correct answer)
To satisfy audit requirements without changing behavior

Correct answer: To help employees recognize and respond appropriately to security threats

Security awareness training educates employees about security threats, policies, and proper security behavior to reduce human-related security risks.

Question 17: Which authentication factor category does a hardware token belong to?

Something you do
Something you are
Something you have (Correct answer)
Something you know

Correct answer: Something you have

Hardware tokens are possession-based 'something you have' authentication factors that generate one-time codes.

Question 18: What does Single Sign-On (SSO) allow users to do?

Use a single very strong password across all systems
Authenticate once and access multiple systems without re-authenticating (Correct answer)
Sign in from a single device only
Share login credentials securely with colleagues

Correct answer: Authenticate once and access multiple systems without re-authenticating

SSO allows users to authenticate once and then access multiple applications or systems without needing to log in again.

Question 19: Which access control model grants access based on job functions or roles?

Attribute-Based Access Control (ABAC)
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC) (Correct answer)

Correct answer: Role-Based Access Control (RBAC)

RBAC (Role-Based Access Control) assigns permissions based on a user's role or job function within an organization.

Question 20: Which of the following is an example of multifactor authentication (MFA)?

Fingerprint and smart card (Correct answer)
OIN and username
Username and password
Password and security question

Correct answer: Fingerprint and smart card

Multifactor Authentication (MFA) requires combining two or more distinct authentication factors from different categories to verify a user's identity. A fingerprint represents "something you are" (a biometric factor), while a smart card represents "something you have" (a possession factor). The combination of these two distinct factors makes "Fingerprint and smart card" a clear example of multifactor authentication, providing enhanced security.

Question 21: After detecting a data breach, what should happen FIRST according to incident response best practices?

Contact law enforcement
Perform a full forensic system audit
Contain the incident to limit further damage (Correct answer)
Notify all affected customers immediately

Correct answer: Contain the incident to limit further damage

Containment should occur first to stop the spread and limit the damage of the breach before notification, investigation, or other activities proceed.

Question 22: What is the difference between a threat and a risk?

A threat is always intentional; a risk is never intentional
A risk is more specific than a threat
A threat is a potential danger; a risk combines threat likelihood and impact (Correct answer)
They are the same concept

Correct answer: A threat is a potential danger; a risk combines threat likelihood and impact

A threat is a potential danger, while risk is the combination of that threat's likelihood and its potential impact.

Question 23: How does the ISC2 Certified in Cybersecurity (CC) certification help in career advancement?

It allows for skipping entry-level job roles
It provides a direct promotion in the current job
It guarantees a higher salary in any organization
It makes candidates more attractive to employers by validating their cybersecurity knowledge (Correct answer)

Correct answer: It makes candidates more attractive to employers by validating their cybersecurity knowledge

The ISC2 Certified in Cybersecurity (CC) certification significantly helps in career advancement by providing a recognized credential that validates a candidate's foundational cybersecurity knowledge to potential employers. This validation demonstrates a commitment to the field and assures employers that the candidate possesses essential skills, making them more attractive and competitive in the job market. It opens doors to entry-level cybersecurity roles and provides a solid base for further specialization.

Question 24: What kind of professional development requirement is needed to maintain the ISC2 Certified in Cybersecurity (CC) certification?

Completing a new certification exam every year
Earning Continuing Professional Education (CPE) credits (Correct answer)
Submitting an annual report to ISC2 about professional activities
Working in a cybersecurity role continuously without a break

Correct answer: Earning Continuing Professional Education (CPE) credits

To maintain the ISC2 Certified in Cybersecurity (CC) certification, holders are required to earn Continuing Professional Education (CPE) credits. This ensures that certified professionals stay current with the rapidly evolving cybersecurity landscape, continuously update their skills, and remain knowledgeable about new threats and technologies. Earning CPEs through various activities like attending webinars, training, or industry events is a standard practice for maintaining many professional certifications.

Question 25: What does a warm site offer that a cold site does not?

Fully replicated live data and systems
Pre-installed equipment and connectivity but not live data (Correct answer)
Better temperature control for equipment
Only network connectivity with no servers

Correct answer: Pre-installed equipment and connectivity but not live data

A warm site has pre-installed equipment and network connectivity but requires data restoration before operations can fully resume.

Question 26: What is the 3-2-1 backup rule?

Keep 3 copies of data on 2 different media types with 1 copy stored off-site (Correct answer)
Back up 3 times a day using 2 methods with 1 cloud copy
Use 3 servers, 2 networks, and 1 firewall for data redundancy
Back up every 3 hours with 2 redundant copies and 1 full weekly backup

Correct answer: Keep 3 copies of data on 2 different media types with 1 copy stored off-site

The 3-2-1 backup rule recommends keeping 3 copies of data, on 2 different types of storage media, with 1 copy stored off-site.

Question 27: What does CSIRT stand for in cybersecurity?

Centralized Security Incident Review Team
Computer Security Incident Response Team (Correct answer)
Cyber Security Incident Response Team
Critical Security Incident Reporting Tool

Correct answer: Computer Security Incident Response Team

CSIRT stands for Computer Security Incident Response Team, the group responsible for coordinating an organization's response to security incidents.

Question 28: What is the purpose of periodic access reviews?

To train users on new security tools
To test authentication systems for vulnerabilities
To verify that user access rights remain appropriate and remove unnecessary permissions (Correct answer)
To create audit logs of login attempts

Correct answer: To verify that user access rights remain appropriate and remove unnecessary permissions

Periodic access reviews verify that each user's current access rights are still appropriate for their job role and revoke any excess permissions.

Question 29: Which OSI model layer handles IP addressing and routing between networks?

Layer 4 (Transport)
Layer 2 (Data Link)
Layer 5 (Session)
Layer 3 (Network) (Correct answer)

Correct answer: Layer 3 (Network)

Layer 3 (Network layer) handles logical addressing using IP addresses and the routing of packets between different networks.

Question 30: What term describes prioritizing security incidents based on their severity and potential impact?

Forensics
Remediation
Triage (Correct answer)
Escalation

Correct answer: Triage

Triage is the process of evaluating and prioritizing incidents based on their potential impact and urgency so the most critical issues are addressed first.

Question 31: What is the purpose of a security policy?

To enforce technical controls on systems
To train employees on security awareness
To document acceptable use and security requirements (Correct answer)
To detect security incidents

Correct answer: To document acceptable use and security requirements

A security policy documents an organization's rules, requirements, and acceptable use guidelines for information security.

Question 32: What is phishing?

A social engineering attack using fraudulent communications to steal sensitive information (Correct answer)
A technique for scanning open network ports
A technique for cracking encrypted passwords offline
An attack that targets web application databases with malicious queries

Correct answer: A social engineering attack using fraudulent communications to steal sensitive information

Phishing uses fraudulent emails, messages, or websites to trick users into revealing sensitive information like credentials or financial data.

Question 33: What is the purpose of the containment phase in incident response?

To restore affected systems to normal operation
To identify the root cause of the incident
To notify law enforcement about the incident
To stop the spread of the incident and limit further damage (Correct answer)

Correct answer: To stop the spread of the incident and limit further damage

Containment focuses on stopping the spread of an incident to prevent additional damage while preserving evidence for analysis.

Question 34: Which of the following is the MOST important outcome of a disaster recovery test?

Documenting lessons learned and improvements needed (Correct answer)
Testing all systems simultaneously
Involving only IT staff
Minimal disruption to operations

Correct answer: Documenting lessons learned and improvements needed

Documenting lessons learned is critical because it captures improvements needed to strengthen the DR plan for future real incidents.

Question 35: What is data at rest?

Data currently being transmitted over a network
Data actively being processed by a running application
Data that has been archived for long-term compliance retention
Data stored on physical media or storage devices (Correct answer)

Correct answer: Data stored on physical media or storage devices

Data at rest refers to inactive data stored on drives, databases, or other storage media, as opposed to data being transmitted or processed.

Question 36: Which authentication factor category does a password belong to?

Something you know (Correct answer)
Something you have
Something you are
Something you do

Correct answer: Something you know

Passwords, PINs, and security question answers are all knowledge-based 'something you know' authentication factors.

Question 37: Which of the following is an example of a technical security control?

Security policy document
Employee security awareness training
Employee background checks
Encryption of sensitive data (Correct answer)

Correct answer: Encryption of sensitive data

Encryption is a technical security control implemented through technology to protect data from unauthorized access.

Question 38: What is port scanning used for in security assessments?

Identifying open ports and services running on a target system (Correct answer)
Encrypting communications between network devices
Monitoring network bandwidth and throughput usage
Managing configuration of network switches

Correct answer: Identifying open ports and services running on a target system

Port scanning identifies which ports are open on a system and what services are listening, helping security teams discover potential attack surfaces.

Question 39: What is multi-factor authentication (MFA)?

Using multiple passwords for the same account
Requiring two or more different types of authentication factors to verify identity (Correct answer)
Using biometrics as the sole authentication method
Authenticating to multiple systems simultaneously

Correct answer: Requiring two or more different types of authentication factors to verify identity

MFA requires users to provide two or more different authentication factors (something you know, have, or are) to verify identity.

Question 40: What is a denial of service (DoS) attack?

Escalating privileges on a compromised system
Overwhelming a system with traffic or requests to make it unavailable to legitimate users (Correct answer)
Intercepting encrypted network communications
Stealing user credentials through phishing

Correct answer: Overwhelming a system with traffic or requests to make it unavailable to legitimate users

A DoS attack floods a system with traffic or requests to overwhelm its resources, making it unavailable to legitimate users.

Question 41: What does 'need to know' mean in the context of access control?

Users must know their security classification level
Managers must be notified of all access requests
Access is granted only to information required to perform a specific job (Correct answer)
Users should know all security policies

Correct answer: Access is granted only to information required to perform a specific job

Need to know means that access to information is granted only when it is necessary for a user to perform their specific job duties.

Question 42: Which term describes the process of returning to normal operations from a DR site?

Restoration
Failover
Recovery
Failback (Correct answer)

Correct answer: Failback

Failback is the process of returning operations from the disaster recovery site back to the primary site once it has been restored.

Question 43: What is a DMZ (Demilitarized Zone) in network security?

A segment that hosts public-facing servers while isolating them from the internal network (Correct answer)
A wireless network exclusively for guest users
A network segment with no security controls
A firewall configuration that blocks all traffic by default

Correct answer: A segment that hosts public-facing servers while isolating them from the internal network

A DMZ is a network segment that hosts public-facing services (like web servers) while isolating them from the internal corporate network.

Question 44: What does a VPN (Virtual Private Network) primarily provide?

Faster internet connection speeds
Protection against malware on endpoints
Encrypted tunnels for secure remote access over untrusted networks (Correct answer)
Anonymous browsing with no encryption

Correct answer: Encrypted tunnels for secure remote access over untrusted networks

A VPN creates an encrypted tunnel between a user and a network, providing secure remote access and protecting data in transit.

Question 45: Which of the following would MOST likely be classified as a high-severity incident requiring immediate escalation?

A minor misconfiguration in a non-critical test system
Ransomware encryption spreading across critical production servers (Correct answer)
An expired digital certificate on an internal development tool
A user visiting a blocked website

Correct answer: Ransomware encryption spreading across critical production servers

Ransomware spreading across critical production servers directly threatens the availability and integrity of critical organizational assets, making it the highest severity.

Question 46: What does NAT (Network Address Translation) primarily do?

Routes traffic between VLANs on a switch
Translates private internal IP addresses to a public IP address for internet access (Correct answer)
Assigns dynamic IP addresses to network devices
Encrypts network traffic before transmission

Correct answer: Translates private internal IP addresses to a public IP address for internet access

NAT translates private internal IP addresses to a public IP address, allowing multiple internal devices to share a single public IP for internet access.

Question 47: What is the purpose of maintaining a chain of custody during incident response?

To assign accountability for causing the security incident
To track evidence handling and preserve its integrity for legal proceedings (Correct answer)
To document a timeline of system configuration changes
To ensure all employees are aware of the incident

Correct answer: To track evidence handling and preserve its integrity for legal proceedings

Chain of custody documents the handling, transfer, and storage of evidence to ensure its integrity and admissibility in legal or disciplinary proceedings.

Question 48: What is the purpose of an access control list (ACL)?

To encrypt network communications
To define which users or systems have permission to access specific resources (Correct answer)
To log all user access attempts
To authenticate users to a network

Correct answer: To define which users or systems have permission to access specific resources

An ACL defines rules that specify which users, systems, or processes are permitted or denied access to specific resources.

Question 49: What is a vulnerability in security terms?

A weakness that can be exploited (Correct answer)
A realized attack on a system
A security control that failed
A threat actor targeting a system

Correct answer: A weakness that can be exploited

A vulnerability is a weakness in a system, process, or control that could be exploited by a threat.

Question 50: What does the term 'least privilege' mean in security?

Restricting user access to only what is necessary for their job (Correct answer)
Removing all user permissions by default
Granting temporary elevated permissions
Giving users maximum access for productivity

Correct answer: Restricting user access to only what is necessary for their job

Least privilege means users are granted only the minimum permissions necessary to perform their job functions.

Question 51: What is the purpose of a security audit?

To train employees on security policies
To implement new security technologies
To respond to active security incidents
To evaluate the effectiveness of security controls and compliance (Correct answer)

Correct answer: To evaluate the effectiveness of security controls and compliance

A security audit systematically evaluates security controls, policies, and procedures to determine their effectiveness and compliance.

Question 52: What is data classification?

Organizing data by file size for storage optimization
Backing up data organized by creation date
Encrypting data based on its file type
Categorizing data based on its sensitivity and required protection level (Correct answer)

Correct answer: Categorizing data based on its sensitivity and required protection level

Data classification categorizes data according to its sensitivity and required level of protection, helping organizations apply appropriate controls.

Question 53: What does the principle of 'zero trust' mean in network security?

Trusting all users inside the network perimeter
Trusting only cloud-based services and not on-premises systems
Never trusting any user or device by default and always requiring verification (Correct answer)
Blocking all network traffic by default unless whitelisted

Correct answer: Never trusting any user or device by default and always requiring verification

Zero trust means that no user, device, or network segment is inherently trusted — every access request must be verified regardless of its origin.

Question 54: What is the key difference between an IDS and an IPS?

They are identical in function and can be used interchangeably
An IDS detects and alerts while an IPS also actively blocks detected threats (Correct answer)
An IPS only monitors incoming traffic while an IDS monitors all traffic
An IDS is hardware-based; an IPS is software-based

Correct answer: An IDS detects and alerts while an IPS also actively blocks detected threats

An IDS monitors and alerts on suspicious activity, while an IPS can additionally take automated action to block detected threats.

Question 55: What does Mean Time Between Failures (MTBF) measure?

The maximum acceptable downtime
The time required to repair a failed system
The frequency of scheduled maintenance
The average time between system failures (Correct answer)

Correct answer: The average time between system failures

MTBF measures the average time between failures for a system or component and is used to assess overall reliability.

Question 56: What protocol does HTTPS use to secure web communications?

TLS (Transport Layer Security) (Correct answer)
SSL only
SSH
IPSec

Correct answer: TLS (Transport Layer Security)

HTTPS uses TLS (Transport Layer Security) to encrypt communications between web browsers and servers.

Question 57: What is the purpose of a proxy server?

To act as an intermediary between clients and servers, filtering and caching requests (Correct answer)
To encrypt all network traffic end to end
To provide redundant network paths for failover
To assign IP addresses to network devices via DHCP

Correct answer: To act as an intermediary between clients and servers, filtering and caching requests

A proxy server acts as an intermediary between clients and servers, providing caching, filtering, and access control functions.

Question 58: What is the primary purpose of a Business Continuity Plan (BCP)?

To ensue that critical business functions continue during and after a disaster. (Correct answer)
To identify and mitigate security security vulnerabilities in the network.
To outline the steps to recover IT systems after a disaster.
To create a backup of all data in the organization.

Correct answer: To ensue that critical business functions continue during and after a disaster.

A Business Continuity Plan (BCP) is a comprehensive strategy designed to ensure that an organization's critical business functions can continue operating during and after a disruptive event, such as a natural disaster, cyberattack, or power outage. Its main goal is to minimize downtime and financial losses by outlining procedures for maintaining essential operations. This differs from a Disaster Recovery Plan (DRP), which focuses specifically on IT system recovery.

Question 59: What does change management in security ensure?

That only senior IT staff can request system changes
That all systems are updated simultaneously during maintenance windows
That all changes are made as quickly as possible to reduce downtime
That changes to systems are reviewed, approved, and documented before implementation (Correct answer)

Correct answer: That changes to systems are reviewed, approved, and documented before implementation

Change management ensures that modifications to systems and configurations are properly reviewed, approved, and documented to minimize security and operational risks.

Question 60: Which concept refers to ensuring systems and data are accessible when needed?

Integrity
Authentication
Confidentiality
Availability (Correct answer)

Correct answer: Availability

Availability ensures that information systems and data are accessible to authorized users when they need them.

Question 61: What is the purpose of an Intrusion Detection System (IDS)?

To encrypt sensitive network communications
To block all unauthorized access attempts automatically
To manage user authentication across the network
To monitor network traffic and generate alerts on suspicious activity (Correct answer)

Correct answer: To monitor network traffic and generate alerts on suspicious activity

An IDS monitors network traffic and system activity, generating alerts when it detects patterns that may indicate an attack.

Question 62: Which regulation requires organizations to report personal data breaches to supervisory authorities within 72 hours?

ISO/IEC 27001
NIST SP 800-61
COBIT 2019
GDPR (General Data Protection Regulation) (Correct answer)

Correct answer: GDPR (General Data Protection Regulation)

GDPR mandates that organizations notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it.

Question 63: What is the primary objective of incident response?

Documenting all security events for compliance
Training employees after an incident occurs
Minimizing the impact of security incidents and restoring operations (Correct answer)
Prosecuting attackers

Correct answer: Minimizing the impact of security incidents and restoring operations

Incident response aims to contain and minimize the damage caused by security incidents while restoring normal operations as quickly as possible.

Question 64: When collecting digital evidence during incident response, what is MOST critical to ensure?

Network bandwidth is documented
Evidence integrity is maintained (Correct answer)
System performance metrics are captured
User credentials are preserved

Correct answer: Evidence integrity is maintained

Maintaining evidence integrity ensures that digital evidence accurately reflects the state of systems at the time of the incident and is admissible in legal proceedings.

Question 65: What is social engineering?

Building collaborative social networks within organizations
Manipulating people through psychological tactics to reveal information or perform actions (Correct answer)
Designing secure social media platforms and applications
Using social media platforms for open-source threat intelligence

Correct answer: Manipulating people through psychological tactics to reveal information or perform actions

Social engineering manipulates people through psychological tactics rather than technical means to gain unauthorized access or sensitive information.

Question 66: What is the purpose of a patch management program?

To back up all system configurations regularly
To manage user access permissions across systems
To monitor network traffic for security threats
To keep systems up to date with security and software fixes (Correct answer)

Correct answer: To keep systems up to date with security and software fixes

Patch management ensures that systems are regularly updated with security patches to fix known vulnerabilities before they can be exploited.

Question 67: Why is a passphrase generally considered stronger than a typical short password?

A passphrase changes automatically every 30 seconds
A passphrase requires biometric confirmation to use
A passphrase is a longer sequence of words that is harder to crack due to its length (Correct answer)
A passphrase is shorter but uses more special characters

Correct answer: A passphrase is a longer sequence of words that is harder to crack due to its length

A passphrase is a longer string of words that is generally easier to remember but much harder to crack due to its greater length.

Question 68: What is the formal document created to capture all details about a security incident for analysis and compliance purposes?

Incident Report (Correct answer)
Vulnerability Assessment
Audit Log
Penetration Test Report

Correct answer: Incident Report

An Incident Report is the formal documentation capturing all relevant details about a security incident for analysis, compliance, and future reference.

Question 69: What is the primary purpose of a firewall?

To monitor network performance metrics
To encrypt all network traffic
To detect malware on endpoints
To control incoming and outgoing network traffic based on security rules (Correct answer)

Correct answer: To control incoming and outgoing network traffic based on security rules

A firewall controls network traffic by allowing or blocking connections based on predefined security rules.

Question 70: What is federated identity management?

A government-issued digital identity system
Managing multiple passwords with a single vault
Creating identical user accounts across all systems
Allowing identity credentials from one organization to be accepted by another trusted organization (Correct answer)

Correct answer: Allowing identity credentials from one organization to be accepted by another trusted organization

Federated identity management allows users to use their identity credentials from one organization to access resources in another trusted organization or system.

Question 71: Which of the following BEST describes the Recovery phase of incident response?

Restoring affected systems to normal and verified operation (Correct answer)
Identifying the root cause of the incident
Notifying law enforcement about the breach
Capturing and preserving digital evidence

Correct answer: Restoring affected systems to normal and verified operation

The Recovery phase involves restoring affected systems to full, verified operational status after the incident has been contained and eradicated.

Question 72: 'Lessons learned' activities primarily occur during which phase of the incident response lifecycle?

Preparation
Recovery
Post-Incident Activity (Correct answer)
Containment

Correct answer: Post-Incident Activity

Post-Incident Activity includes conducting lessons learned meetings to evaluate the response, improve processes, and update documentation for future incidents.

Question 73: What is a cold site in disaster recovery?

A temporary off-site storage location
An empty facility with basic infrastructure but no equipment (Correct answer)
A cloud-based DR solution
A facility identical to the primary site

Correct answer: An empty facility with basic infrastructure but no equipment

A cold site provides basic infrastructure (power, connectivity) but requires equipment and systems to be installed before operations can resume.

Question 74: What is the purpose of an incident response plan?

To train new employees on security tools and procedures
To document all software vulnerabilities found in the environment
To schedule regular security audits and penetration tests
To provide a structured approach for detecting, containing, and recovering from security incidents (Correct answer)

Correct answer: To provide a structured approach for detecting, containing, and recovering from security incidents

An incident response plan provides a predefined, structured approach for identifying, containing, eradicating, and recovering from security incidents.

Question 75: What is the purpose of network traffic encryption?

To authenticate users to network resources
To protect data from being intercepted and read while in transit (Correct answer)
To speed up data transmission across networks
To prevent denial of service attacks

Correct answer: To protect data from being intercepted and read while in transit

Network traffic encryption protects the confidentiality of data as it travels across networks by making it unreadable to unauthorized parties.

Question 76: What is identity proofing?

Testing the strength of a user's password
Monitoring user behavior patterns over time
Verifying that a person is who they claim to be before issuing credentials (Correct answer)
Creating a new user account in a system

Correct answer: Verifying that a person is who they claim to be before issuing credentials

Identity proofing is the process of verifying a person's real-world identity before establishing their digital identity and credentials.

Question 77: What is the purpose of system hardening?

Reducing the attack surface by removing unnecessary services and applying secure configurations (Correct answer)
Increasing system processing speed and performance
Adding additional encryption layers to stored data
Implementing multi-factor authentication for all user accounts

Correct answer: Reducing the attack surface by removing unnecessary services and applying secure configurations

System hardening reduces the attack surface by removing unnecessary software, closing unused ports, and applying secure configurations to minimize vulnerabilities.

Question 78: Which step comes AFTER eradication in the standard incident response process?

Preparation
Identification
Recovery (Correct answer)
Containment

Correct answer: Recovery

After eradicating the threat, the next step is recovery — restoring affected systems and verifying they are operating normally.

Question 79: What is the purpose of account deprovisioning?

Resetting user passwords periodically for compliance
Removing access rights when a user no longer requires them (Correct answer)
Creating backup accounts for users
Granting temporary elevated access to users

Correct answer: Removing access rights when a user no longer requires them

Deprovisioning is the process of revoking a user's access rights and disabling or deleting accounts when they are no longer needed.

Question 80: What is a Security Information and Event Management (SIEM) system?

A tool that aggregates and correlates security logs from multiple sources for threat detection (Correct answer)
A next-generation network firewall with advanced packet filtering
An endpoint protection platform that detects and removes malware
A system for managing user identities and access provisioning

Correct answer: A tool that aggregates and correlates security logs from multiple sources for threat detection

A SIEM aggregates log data from multiple sources, correlates events, and provides real-time analysis to detect security threats.

Question 81: What is a VLAN (Virtual Local Area Network)?

A VPN solution designed for local area networks
A logical network segment created within a physical network infrastructure (Correct answer)
A wireless networking standard for local areas
A type of managed network switch

Correct answer: A logical network segment created within a physical network infrastructure

A VLAN is a logical grouping of network devices into separate broadcast domains even if they share the same physical infrastructure.

Question 82: What is network segmentation?

Dividing a network into smaller, isolated subnetworks to improve security (Correct answer)
Increasing network bandwidth capacity
Monitoring all network traffic for anomalies
Encrypting all network communications end-to-end

Correct answer: Dividing a network into smaller, isolated subnetworks to improve security

Network segmentation divides a network into smaller subnetworks to improve security, performance, and limit the spread of attacks.

Question 83: What does configuration management in security help prevent?

Network outages caused by unexpected traffic spikes
User errors in data entry and processing
Application performance degradation over time
Unauthorized or unplanned changes that could introduce vulnerabilities (Correct answer)

Correct answer: Unauthorized or unplanned changes that could introduce vulnerabilities

Configuration management tracks and controls changes to system configurations, preventing unauthorized or unplanned changes that could introduce security weaknesses.

Question 84: What is the purpose of a Business Impact Analysis (BIA)?

To document all business processes
To assess the effect of disruptions on critical business functions (Correct answer)
To evaluate employee performance during incidents
To identify the financial impact of IT projects

Correct answer: To assess the effect of disruptions on critical business functions

A BIA identifies critical business functions and analyzes the potential impact of disruptions on those functions.

Question 85: What does MTTR stand for in availability planning?

Minimum Transfer Time Requirement
Mean Time To Repair (Correct answer)
Maximum Throughput Time for Recovery
Monthly Testing and Training Report

Correct answer: Mean Time To Repair

MTTR (Mean Time To Repair) is the average time required to repair a failed system or component.

Question 86: Which term describes the process of identifying potential threats and their likelihood?

Penetration testing
Risk analysis (Correct answer)
Security audit
Vulnerability assessment

Correct answer: Risk analysis

Risk analysis involves identifying threats, their likelihood, and their potential impact on an organization.

Question 87: What is the FIRST phase of the NIST SP 800-61 incident response lifecycle?

Detection and Analysis
Containment, Eradication, and Recovery
Preparation (Correct answer)
Post-Incident Activity

Correct answer: Preparation

Preparation is the first phase of the NIST incident response lifecycle, establishing the capability and resources needed before incidents occur.

Question 88: What is the purpose of a clean desk policy?

Organizing files in a standardized directory structure
Removing unnecessary software from employee computers
Keeping workstations free of dust for equipment longevity
Ensuring sensitive information is not left visible or unattended at workstations (Correct answer)

Correct answer: Ensuring sensitive information is not left visible or unattended at workstations

A clean desk policy requires employees to secure sensitive documents and information at the end of work sessions to prevent unauthorized access.

Question 89: What is the primary purpose of a Security Information and Event Management (SIEM) system?

To monitor and analyze security events in real-time (Correct answer)
To perform regular backups of critical data
To manage user access controls
To encrypt all data on the network

Correct answer: To monitor and analyze security events in real-time

A Security Information and Event Management (SIEM) system's primary function is to collect, aggregate, and analyze security-related data from various sources across an organization's IT infrastructure. It provides real-time monitoring and correlation of security events, allowing for early detection of potential threats and incidents. This helps organizations identify and respond to security breaches more effectively.

Question 90: What is the primary purpose of a Business Continuity Plan (BCP)?

To document all organizational processes
To ensure critical business functions continue during disruptions (Correct answer)
To restore IT systems after a disaster
To comply with regulatory requirements

Correct answer: To ensure critical business functions continue during disruptions

A BCP ensures that critical business operations can continue during and after a disruptive event.

Question 91: What type of security control is a security guard?

Physical control (Correct answer)
Corrective control
Administrative control
Technical control

Correct answer: Physical control

A security guard is a physical control that protects against unauthorized physical access to facilities or resources.

Question 92: What is the purpose of a privileged account?

To allow temporary access for contractors
To provide administrators with elevated permissions for system management tasks (Correct answer)
To give all users elevated access temporarily
To bypass security controls for efficiency

Correct answer: To provide administrators with elevated permissions for system management tasks

Privileged accounts have elevated permissions beyond standard users, typically used by administrators for system management tasks.

Question 93: How does the ISC2 Certified in Cybersecurity (CC) certification serve as a pathway to advanced certifications?

By providing a solid foundation of knowledge required for more advanced certifications like CISSP and SSCP (Correct answer)
By automatically enrolling the holder in advanced certification programs
By exempting the holder from taking foundational courses in advanced certification programs
By reducing the cost of advanced certification exams

Correct answer: By providing a solid foundation of knowledge required for more advanced certifications like CISSP and SSCP

The ISC2 Certified in Cybersecurity (CC) certification serves as an excellent pathway to more advanced certifications by establishing a solid foundation of essential cybersecurity knowledge and concepts. It covers fundamental domains that are prerequisite for understanding the more complex topics addressed in higher-level certifications like CISSP (Certified Information Systems Security Professional) and SSCP (Systems Security Certified Practitioner). This foundational understanding makes the transition to advanced studies smoother and more effective.

Question 94: What is vulnerability scanning?

Automated identification of known security weaknesses in systems and applications (Correct answer)
Testing physical security controls with simulated attacks
Manually reviewing source code for security flaws
Monitoring user activity logs for suspicious behavior patterns

Correct answer: Automated identification of known security weaknesses in systems and applications

Vulnerability scanning uses automated tools to identify known security weaknesses in systems, applications, and network devices.

Question 95: What is the purpose of logging and monitoring in security operations?

To improve overall system performance and uptime
To create audit trails that enable detection and investigation of security events (Correct answer)
To automatically back up configuration files on a schedule
To enforce user access control policies on systems

Correct answer: To create audit trails that enable detection and investigation of security events

Logging and monitoring create audit trails of system and user activity, enabling detection and investigation of security incidents.

Question 96: What type of malware replicates itself across networks without requiring user action?

Virus
Spyware
Worm (Correct answer)
Trojan

Correct answer: Worm

A worm is self-replicating malware that spreads across networks automatically without requiring user interaction or attachment to another file.

Question 97: Which of the following is an example of multifactor authentication (MFA)?

Password and PIN
Password and security question
Password and fingerprint (Correct answer)
Password and username

Correct answer: Password and fingerprint

Multifactor Authentication (MFA) requires a user to provide two or more distinct forms of verification from different categories to gain access to a system or account. These categories typically include something you know (like a password), something you have (like a smart card or phone), and something you are (like a fingerprint or biometric). A password and fingerprint combine "something you know" with "something you are," making it a valid MFA example.

Question 98: What is the primary goal of integrity in information security?

Ensuring data is always available
Preventing unauthorized data modification (Correct answer)
Encrypting data at rest
Controlling user access

Correct answer: Preventing unauthorized data modification

Integrity ensures that data is accurate and has not been tampered with by unauthorized parties.

Question 99: Which phase of incident response involves identifying what happened and its scope?

Containment
Recovery
Preparation
Detection and Analysis (Correct answer)

Correct answer: Detection and Analysis

The detection and analysis phase involves identifying security events, determining if they are incidents, and understanding the scope of impact.

Question 100: What is account provisioning?

Auditing user access permissions
The process of creating and configuring user accounts and access rights (Correct answer)
Disabling inactive user accounts
Monitoring user account activity for anomalies

Correct answer: The process of creating and configuring user accounts and access rights

Account provisioning is the process of creating user accounts and granting appropriate access rights based on job roles and requirements.

ISC2 CC (Certified in Cybersecurity) Exam

The ISC2 Certified in Cybersecurity (CC) certification validates foundational knowledge and skills required for an entry-level cybersecurity role, covering security principles, access controls, network security, and security operations.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds