Certified Cybersecurity Specialist (CCS) (beta)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1Security Operations

   Which activity most helps a security team detect an attack that has already begun?

   1. ATurning off the logging system to reduce the workload of the team that reviews the logs
   2. BAssuming that nothing is happening because no alert has been triggered during the last week
   3. CWaiting for users to complain about slow systems before looking at any logs or alerts
   4. DReviewing logs and alerts for unusual activity, such as failed logins followed by a success
   Show answer and explanationHide answer

   Correct answer: D

   Reviewing logs and alerts for unusual patterns is how active attacks are found. Assumptions, waiting for complaints and disabling logs each delay or prevent detection.

2. Question 2Security Fundamentals

   Which property of information security ensures that data has not been altered by an unauthorised party?

   1. AAvailability, which ensures that systems and data are accessible to authorised users when needed
   2. BIntegrity, which ensures data is accurate and unchanged except by authorised actions
   3. CConfidentiality, which ensures that information is disclosed only to authorised people
   4. DAccountability, which ensures that actions can be traced back to the person who performed them
   Show answer and explanationHide answer

   Correct answer: B

   Integrity protects data from unauthorised alteration. Availability, confidentiality and accountability are other security properties that the question does not describe.

3. Question 3Threats and Defence

   Which attack uses deceptive messages to trick people into revealing credentials or clicking malicious links?

   1. APort scanning, which probes systems to discover which network services are running
   2. BPhishing, which uses deceptive messages to obtain credentials or install malware
   3. CBuffer overflow, which writes more data to memory than a program expects to receive
   4. DRainbow table lookup, which reverses hashed passwords by comparing against precomputed values
   Show answer and explanationHide answer

   Correct answer: B

   Phishing uses deceptive messages to trick people into revealing credentials or clicking malicious content. The other attacks use technical methods rather than human deception.

4. Question 4Security Operations

   Which first step is appropriate when a user reports that they clicked a suspicious link and entered their password?

   1. AWait to see whether anything unusual happens before taking any action on the account
   2. BReset the password, revoke active sessions and report the incident to the security team
   3. CAsk the user to change the password on the same suspicious page to make it more secure
   4. DIgnore the report because the user has already admitted the error and it is not serious
   Show answer and explanationHide answer

   Correct answer: B

   Resetting the password, revoking sessions and reporting the incident limit the compromise quickly. Waiting, using the suspicious page and ignoring the report each increase the risk.

5. Question 5Security Fundamentals

   Which control type is a policy that requires two people to approve a payment above a set amount?

   1. AAn administrative control, which governs how people work through policy and procedure
   2. BA physical control, which uses barriers, locks or guards to protect facilities
   3. CA technical control, which is enforced by software or hardware configuration
   4. DA detective control, which identifies events after they have happened in the environment
   Show answer and explanationHide answer

   Correct answer: A

   A two-person approval rule is a policy-based administrative control. Physical, technical and detective controls are enforced by barriers, systems or after-the-fact detection.