CertArea
All ISACA exams

Free Certified Cybersecurity Specialist (CCS) (beta) practice test: 30 questions with answers

30 original questions for Certified Cybersecurity Specialist (CCS) (beta), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified Cybersecurity Specialist (CCS) (beta) exam guide: topics, cost and format

All 30 Certified Cybersecurity Specialist (CCS) (beta) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Operations (10 questions)

  1. Question 1

    Which activity most helps a security team detect an attack that has already begun?

    1. ATurning off the logging system to reduce the workload of the team that reviews the logs
    2. BAssuming that nothing is happening because no alert has been triggered during the last week
    3. CWaiting for users to complain about slow systems before looking at any logs or alerts
    4. DReviewing logs and alerts for unusual activity, such as failed logins followed by a success
    Show answer and explanation
    Correct answer: D

    Reviewing logs and alerts for unusual patterns is how active attacks are found. Assumptions, waiting for complaints and disabling logs each delay or prevent detection.

  2. Question 2

    Which first step is appropriate when a user reports that they clicked a suspicious link and entered their password?

    1. AWait to see whether anything unusual happens before taking any action on the account
    2. BReset the password, revoke active sessions and report the incident to the security team
    3. CAsk the user to change the password on the same suspicious page to make it more secure
    4. DIgnore the report because the user has already admitted the error and it is not serious
    Show answer and explanation
    Correct answer: B

    Resetting the password, revoking sessions and reporting the incident limit the compromise quickly. Waiting, using the suspicious page and ignoring the report each increase the risk.

  3. Question 3

    What is the purpose of an incident response plan?

    1. ATo list the employees who are allowed to take holidays during the coming summer period
    2. BTo define roles, steps and communication for responding to security incidents consistently
    3. CTo describe the features of the company's products for the marketing team to use later
    4. DTo store the company's office supplies inventory for the facilities department each year
    Show answer and explanation
    Correct answer: B

    An incident response plan defines roles, steps and communication so that responses are consistent and timely. Holidays, product features and supplies are unrelated.

  4. Question 4

    Which activity is the most important for keeping systems protected against known vulnerabilities?

    1. AApplying security patches and updates in a timely, tested and controlled way
    2. BPostponing all updates indefinitely to avoid any disruption to the business operations
    3. CInstalling software from unknown sources whenever a new tool is needed by a user
    4. DDisabling the vulnerability scanning tools so that the scan reports do not create extra work
    Show answer and explanation
    Correct answer: A

    Timely, tested patching closes known vulnerabilities. Postponing updates, installing unknown software and disabling scans each leave systems exposed.

  5. Question 5

    What does a vulnerability scan do?

    1. AIt encrypts the data on each system so that its contents cannot be read by anyone
    2. BIt attacks systems to gain full control of them so that the team can see the impact
    3. CIt deletes unused accounts from the directory so that the access list stays short
    4. DIt checks systems for known weaknesses and reports where fixes or patches are needed
    Show answer and explanation
    Correct answer: D

    A vulnerability scan identifies known weaknesses and reports the fixes needed. Attacking systems, deleting accounts and encrypting data are different activities.

  6. Question 6

    Which TWO are good practices for handling security alerts? (Choose two.)

    1. ATriaging alerts by severity and the likely impact on the organisation
    2. BClosing every alert without review so that the queue is always empty at the end of the day
    3. CDocumenting the actions taken for each alert so that the work can be reviewed later
    4. DIgnoring alerts that repeat often, since repeated alerts are always harmless in practice
    5. ESharing the alert details publicly on social media so that the wider community can help
    Show answer and explanation
    Correct answer: A, C

    Triage by severity and impact, and documenting actions, make alert handling effective and auditable. Closing alerts unreviewed, ignoring repeats and public sharing each create risk.

  7. Question 7

    Which artefact best records the steps taken and the decisions made during an incident?

    1. AAn incident log with timestamps, actions taken, and the person responsible for each action
    2. BA calendar of meetings that the team attended during the month for the project planning
    3. CA list of the software licences the company bought in the previous financial year
    4. DA diagram of the office layout showing where each team member sits during working hours
    Show answer and explanation
    Correct answer: A

    An incident log with timestamps, actions and responsibilities documents what happened and why. The other items are unrelated to the incident record.

  8. Question 8

    Which TWO are typical goals of a security monitoring programme? (Choose two.)

    1. ADetecting suspicious activity early so that incidents can be contained quickly
    2. BRecording every keystroke typed by staff to monitor their productivity during the day
    3. CProviding evidence for investigations and for compliance with regulatory requirements
    4. DReplacing the need for any preventive controls, since monitoring alone stops every attack
    5. ESharing employee activity data with external marketing partners to target advertising
    Show answer and explanation
    Correct answer: A, C

    Early detection and evidence for investigations and compliance are core monitoring goals. Monitoring does not replace preventive controls, and sharing employee data for marketing is inappropriate.

  9. Question 9

    Which step should come first before a security tool is deployed across the organisation?

    1. ASkipping the review of the tool's permissions because the vendor is well known in the market
    2. BDeploying the tool to every system at once so that coverage is complete from the first day
    3. CDisabling the tool's alerts so that staff are not interrupted while it is being rolled out
    4. DTesting the tool in a limited pilot and confirming it does not disrupt business services
    Show answer and explanation
    Correct answer: D

    A limited pilot confirms the tool works and does not disrupt services before wider rollout. Full deployment, disabled alerts and skipped permission reviews each add risk.

  10. Question 10

    Which measure reduces the risk that a stolen laptop exposes an organisation's data?

    1. AFull disk encryption combined with a strong sign-in and remote wipe capability
    2. BStoring sensitive files on the laptop's desktop so that they are easy to find when needed
    3. CSharing the laptop's sign-in password with colleagues so that they can access files in its absence
    4. DLeaving the laptop unlocked at the desk so that colleagues can help if it is stolen during the day
    Show answer and explanation
    Correct answer: A

    Full disk encryption and strong sign-in protect the data, and remote wipe removes it if the device is lost. The other measures expose data to anyone who obtains the laptop.

Security Fundamentals (10 questions)

  1. Question 11

    Which property of information security ensures that data has not been altered by an unauthorised party?

    1. AAvailability, which ensures that systems and data are accessible to authorised users when needed
    2. BIntegrity, which ensures data is accurate and unchanged except by authorised actions
    3. CConfidentiality, which ensures that information is disclosed only to authorised people
    4. DAccountability, which ensures that actions can be traced back to the person who performed them
    Show answer and explanation
    Correct answer: B

    Integrity protects data from unauthorised alteration. Availability, confidentiality and accountability are other security properties that the question does not describe.

  2. Question 12

    Which control type is a policy that requires two people to approve a payment above a set amount?

    1. AAn administrative control, which governs how people work through policy and procedure
    2. BA physical control, which uses barriers, locks or guards to protect facilities
    3. CA technical control, which is enforced by software or hardware configuration
    4. DA detective control, which identifies events after they have happened in the environment
    Show answer and explanation
    Correct answer: A

    A two-person approval rule is a policy-based administrative control. Physical, technical and detective controls are enforced by barriers, systems or after-the-fact detection.

  3. Question 13

    What does the principle of least privilege require?

    1. AUsers share one account so that access is managed in a single place for the team
    2. BUsers receive full administrator rights so they can fix problems without waiting
    3. CUsers receive only the access needed to perform their assigned tasks
    4. DUsers keep access permanently, even after they change roles in the organisation
    Show answer and explanation
    Correct answer: C

    Least privilege limits each user to what their tasks require, which reduces exposure. The other options grant excessive or unmanaged access.

  4. Question 14

    Which statement best describes a vulnerability?

    1. AThe potential for loss or harm resulting from a threat exploiting a weakness
    2. BAn attacker who has the skills and motivation to target an organisation
    3. CA weakness in a system, process or control that a threat could exploit
    4. DA safeguard that reduces the likelihood or impact of a harmful event occurring
    Show answer and explanation
    Correct answer: C

    A vulnerability is a weakness that a threat could exploit. The other options describe a threat actor, a risk and a control respectively.

  5. Question 15

    Which element of a security awareness programme is most effective at changing staff behaviour?

    1. AA poster on the office wall that lists the company's security policy in very small print
    2. BA single annual slide deck that staff are asked to read once and then forget about
    3. CRegular, relevant training with realistic examples and simulated phishing followed by feedback
    4. DAn email that asks staff to be careful with their passwords but gives no further guidance
    Show answer and explanation
    Correct answer: C

    Regular, relevant training with realistic examples and feedback changes behaviour more than one-off or passive material. The other approaches are passive and infrequent.

  6. Question 16

    What does the term risk mean in information security?

    1. AThe potential for loss or harm when a threat exploits a vulnerability
    2. BA list of all the software installed on the company's computers and their version numbers
    3. CA measure of how quickly the company's network can transfer large files between sites
    4. DA name given to any employee who has access to confidential information in their role
    Show answer and explanation
    Correct answer: A

    Risk is the potential for loss or harm when a threat exploits a vulnerability. Software lists, network speed and employee labels are unrelated.

  7. Question 17

    Which term describes a process that verifies who a user is before granting access?

    1. AAuthorisation, which decides what an identified user is allowed to do once they are signed in
    2. BAuthentication, which verifies the identity of a user or system before access is granted
    3. CAccounting, which records the activity a user performs once access has been granted to them
    4. DAuditing, which reviews past events to check that policies were followed by the organisation
    Show answer and explanation
    Correct answer: B

    Authentication verifies identity. Authorisation decides permissions, accounting records activity, and auditing reviews past events.

  8. Question 18

    Which TWO are examples of technical controls? (Choose two.)

    1. AEncryption of data stored on laptops and servers across the organisation
    2. BWritten acceptable use policy that staff are asked to read and sign each year
    3. CFirewall rules that restrict which network services can be reached from outside
    4. DSecurity awareness training delivered through regular workshops for all employees
    5. EBackground checks performed on candidates before employment begins
    Show answer and explanation
    Correct answer: A, C

    Encryption and firewall rules are implemented in technology. Policies, training and background checks are administrative controls.

  9. Question 19

    Which statement about encryption is correct?

    1. AEncryption replaces the need for backups, because encrypted data is always recoverable
    2. BEncryption guarantees that data will never be lost, even when the key is misplaced by staff
    3. CEncryption protects data confidentiality by making it unreadable without the correct key
    4. DEncryption makes a system faster, because encrypted files are always smaller than plain ones
    Show answer and explanation
    Correct answer: C

    Encryption protects confidentiality by making data unreadable without the key. It does not prevent loss, replace backups or improve speed.

  10. Question 20

    Which THREE are part of a sound password policy? (Choose three.)

    1. ARequiring long passphrases rather than short complex passwords alone
    2. BChecking new passwords against lists of commonly used or breached passwords
    3. CStoring the passwords in a shared spreadsheet so that everyone can find them quickly
    4. DRequiring multi-factor authentication for accounts with access to sensitive systems
    5. ESetting passwords that never expire, so that users do not need to remember a change
    Show answer and explanation
    Correct answer: A, B, D

    Long passphrases, checks against breached lists and MFA for sensitive accounts are sound password practices. Shared spreadsheets and passwords that never change each weaken security.

Threats and Defence (10 questions)

  1. Question 21

    Which attack uses deceptive messages to trick people into revealing credentials or clicking malicious links?

    1. APort scanning, which probes systems to discover which network services are running
    2. BPhishing, which uses deceptive messages to obtain credentials or install malware
    3. CBuffer overflow, which writes more data to memory than a program expects to receive
    4. DRainbow table lookup, which reverses hashed passwords by comparing against precomputed values
    Show answer and explanation
    Correct answer: B

    Phishing uses deceptive messages to trick people into revealing credentials or clicking malicious content. The other attacks use technical methods rather than human deception.

  2. Question 22

    Which measure is the most effective protection against credential theft from password reuse across services?

    1. AWriting passwords on a card kept inside the desk drawer for quick reference at work
    2. BUsing the same strong password for every service so that it is easy to remember
    3. CUnique passwords for each service combined with multi-factor authentication
    4. DChanging the password every day so that stolen credentials expire quickly for attackers
    Show answer and explanation
    Correct answer: C

    Unique passwords stop one breach from exposing other services, and MFA stops stolen passwords alone from working. Reuse, written notes and daily changes do not provide that protection.

  3. Question 23

    Which type of malware encrypts a victim's files and demands payment for the decryption key?

    1. AAdware, which displays unwanted advertisements to users and tracks their browsing choices
    2. BSpyware, which secretly collects information about a user's activity and sends it away
    3. CRansomware, which encrypts files and demands payment for their recovery
    4. DRootkit, which hides its presence on a system while giving an attacker privileged access
    Show answer and explanation
    Correct answer: C

    Ransomware encrypts data and demands payment. Spyware, adware and rootkits have different goals and behaviours.

  4. Question 24

    Which measure best reduces the impact of ransomware on an organisation?

    1. AOffline backups that are tested regularly and kept separate from the network
    2. BKeeping all backups on a network drive that every workstation can write to
    3. CDisabling security updates so that systems do not restart during the working day
    4. DAllowing every user to install software freely so that users can fix problems quickly
    Show answer and explanation
    Correct answer: A

    Tested, offline backups allow recovery without paying a ransom. Writable network backups, disabled updates and free installation each increase the damage.

  5. Question 25

    Which control helps detect a user account that is being used by an attacker from an unusual location?

    1. ASharing one account between many users so that any unusual activity is hard to attribute
    2. BTurning off sign-in logging so that the attacker's logins are not recorded at all
    3. CAllowing unlimited failed sign-in attempts so that legitimate users are never locked out
    4. DMonitoring sign-in activity for unusual locations and alerting on anomalies
    Show answer and explanation
    Correct answer: D

    Monitoring sign-ins for unusual locations and alerting on anomalies detects misuse. Disabling logs, unlimited attempts and shared accounts each hide or enable misuse.

  6. Question 26

    What is a firewall's main function in network security?

    1. AStoring copies of files that users have deleted so that they can be restored later
    2. BFiltering traffic between networks according to rules about addresses, ports and protocols
    3. CTranslating human-readable domain names into numeric addresses for devices on a network
    4. DEncrypting every file on the disk of each computer connected to the company network
    Show answer and explanation
    Correct answer: B

    A firewall filters traffic according to rules. Backups, DNS and disk encryption are different functions.

  7. Question 27

    Which technique involves an attacker tricking a person in person to gain entry to a secure area?

    1. ACross-site scripting, which injects scripts into web pages viewed by other users of the site
    2. BPort scanning, which probes a network remotely to discover which services are running on hosts
    3. CPacket sniffing, which captures network traffic passing over a shared segment for later analysis
    4. DTailgating or pretexting, where an attacker follows someone in or invents a believable story
    Show answer and explanation
    Correct answer: D

    Tailgating and pretexting are social engineering methods used in person. Port scanning, packet sniffing and cross-site scripting are technical attacks.

  8. Question 28

    Which THREE are signs that an endpoint may be infected with malware? (Choose three.)

    1. AUnexpected outbound network connections to unfamiliar addresses
    2. BSecurity software that has been disabled or fails to start without a reason
    3. CFiles that have been renamed with unfamiliar extensions or encrypted without explanation
    4. DA printer that prints a page more slowly than usual during a busy morning in the office
    5. EA routine update that the system installs on its scheduled date each month automatically
    Show answer and explanation
    Correct answer: A, B, C

    Unexpected connections, disabled security software and unexplained encrypted or renamed files are common malware indicators. A slow printer and a scheduled update are normal events.

  9. Question 29

    Which attack floods a service with requests so that legitimate users cannot access it?

    1. AA denial-of-service attack, which overwhelms a service with traffic or requests
    2. BA man-in-the-middle attack, which intercepts communication between two parties without being seen
    3. CA SQL injection attack, which inserts malicious queries into input fields of a database application
    4. DA keylogger, which records the keys a user presses on the keyboard to capture passwords
    Show answer and explanation
    Correct answer: A

    A denial-of-service attack overwhelms a service so legitimate users cannot reach it. The other attacks intercept communication, exploit databases or capture keystrokes.

  10. Question 30

    Which type of attack intercepts communication between two parties so that the attacker can read or alter it?

    1. AA denial-of-service attack, which floods a service so that legitimate users cannot reach it
    2. BA man-in-the-middle attack, which intercepts and may alter communication between two parties
    3. CA brute-force attack, which tries many passwords one after another until one is accepted
    4. DA drive-by download, which installs software when a user visits a compromised website
    Show answer and explanation
    Correct answer: B

    A man-in-the-middle attack intercepts communication between parties. Denial of service, brute force and drive-by downloads are different attack types.