Certified in Cybersecurity (CC)

Last checked October 22, 2026 against the official ISC2 exam page.

1. Question 1Security Principles

   A hospital wants to ensure that patient records cannot be altered without authorisation. Which security principle does this requirement address most directly?

   1. AAvailability, which ensures systems and data are accessible when needed
   2. BNon-repudiation, which prevents a party from denying an action it took
   3. CConfidentiality, which restricts data to people who are authorised to see it
   4. DIntegrity, which ensures data is accurate and not changed without authorisation
   Show answer and explanationHide answer

   Correct answer: D

   Integrity is the principle that protects data from unauthorised or accidental change. Availability concerns access when needed, confidentiality concerns who can read the data, and non-repudiation concerns proof of who acted.

2. Question 2Security Operations and Incident Response

   Which incident response phase removes the cause of the incident and restores systems to normal operation?

   1. APreparation, which builds the plans, tools and training before any incident occurs
   2. BDetection, which identifies that a security event may be an incident needing attention
   3. CLessons learned, which reviews the incident to improve future responses to similar events
   4. DEradication and recovery, which remove the cause and restore normal operation of systems
   Show answer and explanationHide answer

   Correct answer: D

   Eradication removes the cause of the incident and recovery restores systems to normal operation. Preparation, detection and lessons learned are other phases of the same cycle.

3. Question 3Networking and Cloud Security Concepts

   Under the shared responsibility model for IaaS, which party is responsible for patching the guest operating system on a virtual machine?

   1. AThe cloud provider alone, for every layer including the guest operating system
   2. BThe customer, which manages the operating system and applications on the virtual machine
   3. CThe hardware vendor, which supplies the physical servers used by the cloud provider
   4. DNeither party, since patching is handled automatically by the platform in all cases
   Show answer and explanationHide answer

   Correct answer: B

   In IaaS the provider secures the physical and hypervisor layers, while the customer manages the guest operating system, its patches and the applications on it. Assuming automatic patching or provider ownership of the guest OS is the common misconception.

4. Question 4Security Governance

   Which document sets high-level management intent for information security and is approved by senior leadership?

   1. AA security policy, which states management's intent and requirements for security
   2. BA procedure, which gives step-by-step instructions for a specific task
   3. CA guideline, which provides recommended practices that are not mandatory
   4. DA standard, which sets specific mandatory technical requirements for a system
   Show answer and explanationHide answer

   Correct answer: C

   A security policy states management's intent and is approved by senior leadership. Procedures give steps, standards set mandatory technical requirements, and guidelines are recommendations that are not mandatory.

5. Question 5Identity and Access Management Concepts

   Which authentication approach combines two different types of factor, such as something the user knows and something the user has?

   1. ASingle sign-on, which lets a user access many systems after one login
   2. BMulti-factor authentication, which requires two or more different factor types
   3. CRole-based access, which assigns permissions according to a user's job role
   4. DPassword history, which prevents users from reusing their previous passwords
   Show answer and explanationHide answer

   Correct answer: B

   Multi-factor authentication requires two or more different types of factor, such as knowledge and possession. Single sign-on, role-based access and password history address other aspects of access.