Free IIBA-CCA practice test: 30 questions with answers

Information classification assigns each asset a sensitivity level so that handling rules, access limits and protection such as encryption can be matched to that level. Sorting by department, numbering files for deletion and tying labels to bonuses are not the purpose of classification.

Symmetric encryption uses one shared secret key, and hashing is used to detect changes, so both statements are correct. Hashing is one-way rather than reversible, and in public-key cryptography the private key is the secret part while the public key is shared.

TLS encrypts data in transit between endpoints, which is what protects a browser-to-application connection. Full-disk encryption and encrypted backups protect data at rest, and schema access rules are authorization controls rather than encryption in transit.

A digital signature shows the document has not changed since signing, ties it to the signer's key and prevents the signer from later denying it. Signing does not hide the contract, so confidentiality, availability and anonymity are not the properties it provides.

Authentication verifies identity, which the password and one-time code do, while authorization decides which resources an authenticated identity may use. The option that reverses the two terms is wrong, and the other options misplace or drop one of the two concepts.

Separate privileged accounts with logging and review limit what admin activity can happen and make it traceable. Shared passwords, disabled audit logs and broad admin rights all remove accountability and increase the damage a single compromise can do.

Role-based access control groups permissions into roles and assigns users to roles, which matches the claims roles described. Discretionary and mandatory models are based on file owners or system labels, and network-based control filters devices by address rather than by job role.

A testable access requirement states, for each role, exactly which records and actions are allowed and who approves them, so it can be verified. The other options are vague, describe a preference or grant unlimited permissions on request.

The business analyst's core role is to elicit, document and trace security requirements with stakeholders, not to configure production systems, write code or accept risk. The other options describe work owned by technical teams or risk owners, and two of them skip required reviews.

A RACI matrix assigns each activity to Responsible, Accountable, Consulted and Informed roles, which is exactly the question being asked. A SWOT analysis, a fishbone diagram and a risk heat map are useful analysis tools, but none of them assigns roles to activities.

An information security management system is the management framework of policies, risk-based controls and improvement cycles described in ISO/IEC 27001. Penetration testing, disaster recovery and firewall rules are single activities or technical controls, not an organization-wide management system.

Access and erasure requests are data subject rights under privacy regulations such as GDPR, which the retailer must handle for personal data it holds. The other options describe security controls for data loss, network design and patching, which do not answer an individual's request about their own data.

Cyber risk combines the likelihood of a threat exploiting a vulnerability with the resulting harm to information assets and the business. The other options describe a product list, a control certainty and an insurance cost, none of which defines risk itself.

A risk assessment starts by identifying the assets at stake and their value, then moves on to threats, vulnerabilities and impact. Buying a firewall, scheduling a test or choosing insurance are responses that come only after the risks have been understood.

A business case is strongest when it links the investment to quantified losses from named risks, with the assumptions stated so reviewers can test them. A general aim, vendor marketing or a personal brand preference does not show the value the investment creates.

A process map reveals where sensitive data moves outside controlled systems and where manual steps create vulnerabilities, which feeds the risk assessment. The other options wrongly claim that a process map proves compliance, replaces technical testing or serves as a cost tool.

A well-formed requirement is specific and testable and states the behaviour the system must have, here lockout after a defined number of failures with an alert. The others are vague, describe a design preference or defer the requirement without a commitment.

IaaS gives the customer virtual machines, storage and networking while the customer keeps responsibility for the operating system, middleware and applications. SaaS and PaaS shift more management to the provider, and on-premises hosting involves no cloud provider at all.

Mapping requirements to components creates traceability, so gaps and untested requirements are visible before build and test. It does not guarantee audit results, remove the need for review or serve as a pricing tool.

A gap analysis compares the current process with the target process and identifies the changes needed, including new security checkpoints. Usability testing, penetration testing and cost estimating are useful activities but do not compare current and target states.

Availability means authorized users can reach systems and data when they need them, and ransomware that takes the system offline attacks that property. Confidentiality concerns unauthorized disclosure, integrity concerns unauthorized change and non-repudiation concerns denying actions, none of which is the main effect described.

A threat is the actor or event that could take advantage of a weakness, and a vulnerability is the weakness, such as an unpatched server. The option that reverses the two terms is wrong, and the other options misdefine the terms or merge two distinct concepts.

A second-person approval before release is a preventive control because it stops an unauthorized transfer before it happens. The detective option describes after-the-fact review, the corrective option describes recovery and the deterrent option describes warnings that discourage misuse without blocking the transfer.

Reputational impact is the loss of customer trust and business that follows a breach. Rebuilding servers, hiring forensic specialists and paying a ransom are direct costs of responding to the attack rather than damage to how the company is perceived.

Avoidance removes the risk by not starting the activity that creates it, which is what dropping the feature does. Accepting keeps the risk, transferring shifts financial impact to a third party and mitigating reduces the risk while the activity continues.

Remediation timeliness and phishing-report trends show how well security risks are being handled and how aware users are, which is what executives need. The colour scheme and printer vendor details have no bearing on security posture.

Root cause analysis uses methods such as repeated why questions and fishbone diagrams to find underlying causes rather than symptoms. Closing the ticket after restoring service does not identify causes, and publishing staff names is not part of the analysis.

Endpoint security protects the devices where users and applications run, such as laptops, desktops and phones, against malware and misuse. The network, physical and workflow options describe other layers or business controls rather than the endpoint layer.

Parameterized queries keep user input as data rather than as SQL code, which removes the injection path at the application layer. Firewall rules, disk encryption and password length are useful controls, but they do not stop the application from building unsafe queries.

Application allow-listing blocks any program that is not on the approved list, including programs downloaded from the internet. Email filtering, training and vulnerability scanning are valuable, but none of them stops an unapproved program from running on the endpoint.