IIBA IIBA-CCA: Certificate in Cybersecurity Analysis (IIBA-CCA)

Last checked November 10, 2026 against the official IIBA exam page.

1. Question 1Data Security

   A company labels its customer payment records as 'Restricted' and its marketing brochures as 'Public'. What is the main purpose of this labelling?

   1. ATo sort documents by the department that created them so that each department can archive its own files separately
   2. BTo decide which employees receive performance bonuses, based on the number of files each person has labelled
   3. CTo give each file a unique reference number that the backup system uses to delete files automatically after a set period
   4. DTo set handling and protection requirements, such as access and encryption, that match each category's sensitivity
   Show answer and explanationHide answer

   Correct answer: D

   Information classification assigns each asset a sensitivity level so that handling rules, access limits and protection such as encryption can be matched to that level. Sorting by department, numbering files for deletion and tying labels to bonuses are not the purpose of classification.

2. Question 2User Access Control

   An employee signs in with a password and a one-time code, and the system then checks which files that employee may open. Which statement correctly describes the two steps?

   1. AThe sign-in proves who the user is (authentication) and the permission check decides what they may access (authorization)
   2. BThe sign-in decides what the user may access (authorization) and the later permission check proves who the user really is (authentication)
   3. CBoth steps are authorization because each one grants the user access to a protected resource in the system
   4. DAuthentication is needed only for administrators, while authorization applies to regular users and their files
   Show answer and explanationHide answer

   Correct answer: A

   Authentication verifies identity, which the password and one-time code do, while authorization decides which resources an authenticated identity may use. The option that reverses the two terms is wrong, and the other options misplace or drop one of the two concepts.

3. Question 3Cybersecurity Overview and Basic Concepts

   A business analyst is asked to support a project that adds multi-factor authentication to a customer portal. Which contribution is most appropriate for the business analyst?

   1. AConfiguring the multi-factor settings directly in the production identity platform before the security team has reviewed them
   2. BWriting the authentication module code so the developers can meet the delivery date without waiting for requirements
   3. CEliciting security needs from stakeholders and tracing them to the sign-in behaviour the solution must provide
   4. DApproving the residual authentication risk on behalf of the security owner so the release is not delayed
   Show answer and explanationHide answer

   Correct answer: C

   The business analyst's core role is to elicit, document and trace security requirements with stakeholders, not to configure production systems, write code or accept risk. The other options describe work owned by technical teams or risk owners, and two of them skip required reviews.

4. Question 4Enterprise Risk

   Which statement best defines cyber risk?

   1. AThe potential for loss or harm to the organization when a threat exploits a vulnerability in its information assets
   2. BThe certainty that a security control will fail the moment an attacker targets the system it protects
   3. CThe list of security products purchased in the current budget cycle, reviewed by the executive committee each year
   4. DThe total annual premium paid for an insurance policy that covers losses from data breaches and cyber incidents
   Show answer and explanationHide answer

   Correct answer: A

   Cyber risk combines the likelihood of a threat exploiting a vulnerability with the resulting harm to information assets and the business. The other options describe a product list, a control certainty and an insurance cost, none of which defines risk itself.

5. Question 5Solution Delivery

   Which statement is written as a well-formed security requirement?

   1. AThe system should be as secure as reasonably possible and should protect all user information from unauthorized access at all times
   2. BThe team will consider adding account lockout to the sign-in process in a future release if time allows
   3. CDevelopers should make the sign-in page look modern and easy to use so that customers want to stay signed in
   4. DThe system must lock a user account after a defined number of consecutive failed sign-in attempts and alert the security team
   Show answer and explanationHide answer

   Correct answer: D

   A well-formed requirement is specific and testable and states the behaviour the system must have, here lockout after a defined number of failures with an alert. The others are vague, describe a design preference or defer the requirement without a commitment.