A hospital wants to ensure that patient records cannot be altered without authorisation. Which security principle does this requirement address most directly?

Integrity, which ensures data is accurate and not changed without authorisation

Which incident response phase removes the cause of the incident and restores systems to normal operation?

Eradication and recovery, which remove the cause and restore normal operation of systems

Under the shared responsibility model for IaaS, which party is responsible for patching the guest operating system on a virtual machine?

The customer, which manages the operating system and applications on the virtual machine

Which document sets high-level management intent for information security and is approved by senior leadership?

A guideline, which provides recommended practices that are not mandatory

Which authentication approach combines two different types of factor, such as something the user knows and something the user has?

Multi-factor authentication, which requires two or more different factor types

A business impact analysis is used to determine which values for each critical system?

The recovery time objective and recovery point objective that the business requires

Which device filters traffic between network segments based on rules about addresses, ports and protocols?

A firewall, which filters traffic by rules about addresses, ports and protocols

Which principle limits each user and process to the minimum access needed to do their job?

Least privilege, which grants only the access required for the task

Which tool collects and correlates log data from many sources to help detect security events?

A security information and event management system, which collects and correlates logs

Which cloud service model provides a complete application that users access over the internet?

SaaS, which provides a complete application delivered to users over the internet

An organisation identifies a threat that could disrupt its online sales. Which first step follows the standard risk management approach?

Assess the likelihood and impact of the threat to decide how to respond to it

A company wants access decisions to depend on the user's department, the device they use and the time of day. Which access model fits best?

Attribute-based access control, where policies evaluate attributes of the user, device and context

Which TWO statements about backups are correct? (Choose two.)

Backups should be tested by restoring them periodically to confirm that they work

Backups should be protected with access controls at least as strong as the source data

Which protocol provides encrypted remote login and command execution over an untrusted network?

SSH, which provides encrypted remote login and command execution

A company layers a firewall, endpoint protection, access controls and staff training so that a failure of one control does not expose the whole system. What is this approach called?

A single point of control, which concentrates all protection in one device

Which backup approach copies only the data that has changed since the last full backup?

Differential backup, which copies data changed since the last full backup

Which THREE are typical security responsibilities of the customer in a SaaS model? (Choose three.)

Managing user accounts and their access rights within the application

Classifying and protecting the data the customer stores in the application

Configuring sharing settings and access policies correctly within the service

A cybersecurity professional must act in a way that protects the public and the common good before their employer's interests. Which document sets this obligation?

The ISC2 Code of Ethics, which places protecting society first among its canons

Which practice most directly reduces the risk when a user account is no longer needed by the business?

Sharing the account's password with a colleague who will take over the work

What does a recovery time objective define?

The maximum acceptable time to restore a service after disruption

What is the main purpose of network segmentation?

To limit how far an intrusion can spread by separating systems into zones

Which TWO are examples of the availability principle in practice? (Choose two.)

Redundant servers that keep a service running when one fails

Regular backups that allow data to be restored after an outage

Which TWO are typical phases or activities in incident response? (Choose two.)

Containment, to stop the incident from spreading to other systems

Analysis of the evidence to understand the cause and the extent of the incident

What is the default port used for HTTPS traffic?

Port 443, the standard port for encrypted web traffic

Which role is responsible for deciding how much risk the organisation is willing to accept and approving the security programme's direction?

Senior management and the governance body, which set risk appetite and approve the programme

Which control prevents one person from carrying out two steps of a sensitive process that should be checked independently?

Separation of duties, which requires different people for conflicting steps

A disaster recovery site has the building, power and network connections in place but no current hardware or data. What type of site is this?

A cold site, which has space and utilities but no hardware or current data in place

Which system can detect suspicious traffic and actively block it when deployed inline?

An intrusion prevention system deployed inline that can block malicious traffic

Which principle states that a security system should remain secure even if an attacker knows how it is designed, relying on secret keys rather than secret design?

Open design, which assumes the attacker knows the design and relies on secret keys

Which control detects unauthorised changes to important system files by comparing them against a known baseline?

File integrity monitoring, which compares file hashes to a baseline

All ISC2 exams

Free Certified in Cybersecurity (CC) practice test: 30 questions with answers

30 original questions for Certified in Cybersecurity (CC), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions: 30
Full bank: 112 questions

Certified in Cybersecurity (CC) exam guide: topics, cost and format

All 30 Certified in Cybersecurity (CC) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Principles (5 questions)

Question 1
A hospital wants to ensure that patient records cannot be altered without authorisation. Which security principle does this requirement address most directly?
1. AAvailability, which ensures systems and data are accessible when needed
2. BNon-repudiation, which prevents a party from denying an action it took
3. CConfidentiality, which restricts data to people who are authorised to see it
4. DIntegrity, which ensures data is accurate and not changed without authorisation
Show answer and explanationHide answer
Correct answer: D
Integrity is the principle that protects data from unauthorised or accidental change. Availability concerns access when needed, confidentiality concerns who can read the data, and non-repudiation concerns proof of who acted.
Question 2
Which principle limits each user and process to the minimum access needed to do their job?
1. ASeparation of duties, which splits a critical task across several people
2. BLeast privilege, which grants only the access required for the task
3. CDefence in depth, which layers several independent controls together
4. DNeed to know only, which restricts information by classification level
Show answer and explanationHide answer
Correct answer: B
Least privilege grants only the minimum access required for a task. Separation of duties splits critical tasks, defence in depth layers controls, and need-to-know restricts information specifically rather than all access.
Question 3
A company layers a firewall, endpoint protection, access controls and staff training so that a failure of one control does not expose the whole system. What is this approach called?
1. ADefence in depth, which uses multiple overlapping layers of controls
2. BA single point of control, which concentrates all protection in one device
3. CSecurity through obscurity, which hides the design of systems from attackers
4. DRisk transfer, which moves the responsibility for security to an insurer
Show answer and explanationHide answer
Correct answer: B
Defence in depth uses multiple overlapping controls so that no single failure exposes everything. Hiding the design, relying on one device and transferring risk are not what the layered approach describes.
Question 4
Which TWO are examples of the availability principle in practice? (Choose two.)
1. ARedundant servers that keep a service running when one fails
2. BEncryption of stored customer records held in the database
3. CRegular backups that allow data to be restored after an outage
4. DRole-based approval before a file can be read by a manager
5. EPassword complexity rules that make guessing credentials harder
Show answer and explanationHide answer
Correct answer: A, C
Redundancy and backups both keep systems and data available when failures occur. Encryption, approval workflows and password rules address confidentiality and authentication rather than availability.
Question 5
Which principle states that a security system should remain secure even if an attacker knows how it is designed, relying on secret keys rather than secret design?
1. AOpen design, which assumes the attacker knows the design and relies on secret keys
2. BSecurity through obscurity, which relies on hiding the design of the system from attackers
3. CLeast common mechanism, which shares a single mechanism across all users of a system
4. DFail-open design, which allows access whenever a control is unavailable for any reason
Show answer and explanationHide answer
Correct answer: A
The open design principle assumes the design is known and keeps security in the keys and controls. Relying on secrecy of design is the weaker approach the principle rejects.

Security Operations and Incident Response (5 questions)

Question 6
Which incident response phase removes the cause of the incident and restores systems to normal operation?
1. APreparation, which builds the plans, tools and training before any incident occurs
2. BDetection, which identifies that a security event may be an incident needing attention
3. CLessons learned, which reviews the incident to improve future responses to similar events
4. DEradication and recovery, which remove the cause and restore normal operation of systems
Show answer and explanationHide answer
Correct answer: D
Eradication removes the cause of the incident and recovery restores systems to normal operation. Preparation, detection and lessons learned are other phases of the same cycle.
Question 7
Which tool collects and correlates log data from many sources to help detect security events?
1. AA word processor used to write the incident report after the event has finished
2. BA spreadsheet that lists the staff who work on each system in the organisation
3. CA backup tool that copies data to tape each night for long-term retention
4. DA security information and event management system, which collects and correlates logs
Show answer and explanationHide answer
Correct answer: D
A SIEM collects logs from many sources and correlates them to surface security events. Word processors, spreadsheets and backup tools do not perform that correlation.
Question 8
Which backup approach copies only the data that has changed since the last full backup?
1. AFull backup, which copies every file in the selected set each time it runs
2. BDifferential backup, which copies data changed since the last full backup
3. CMirror image, which keeps an exact live copy that updates the moment data changes
4. DArchive backup, which moves old files to cheap storage and deletes the originals
Show answer and explanationHide answer
Correct answer: B
A differential backup copies everything changed since the last full backup, so restores need the full backup plus the latest differential. Full backups copy everything, mirrors update live copies, and archives move data rather than copy it for recovery.
Question 9
Which TWO are typical phases or activities in incident response? (Choose two.)
1. AContainment, to stop the incident from spreading to other systems
2. BInterior decorating of the security operations room for staff comfort
3. CMarketing review of the incident before any public statement is released
4. DAnalysis of the evidence to understand the cause and the extent of the incident
5. EPromotion of the incident responder to a senior role after the event
Show answer and explanationHide answer
Correct answer: A, D
Containment and evidence analysis are core incident response activities. Room decoration, marketing review and promotions are unrelated to the response itself.
Question 10
Which control detects unauthorised changes to important system files by comparing them against a known baseline?
1. AA printer log, which records each document sent to the printer by each user
2. BA screen saver with a password, which locks the display when the user is away
3. CFile integrity monitoring, which compares file hashes to a baseline
4. DA bookmark list, which stores the websites that the user visits most often
Show answer and explanationHide answer
Correct answer: C
File integrity monitoring compares current file hashes with a trusted baseline and reports changes. The other options do not detect changes to system files.

Networking and Cloud Security Concepts (4 questions)

Question 11
Under the shared responsibility model for IaaS, which party is responsible for patching the guest operating system on a virtual machine?
1. AThe cloud provider alone, for every layer including the guest operating system
2. BThe customer, which manages the operating system and applications on the virtual machine
3. CThe hardware vendor, which supplies the physical servers used by the cloud provider
4. DNeither party, since patching is handled automatically by the platform in all cases
Show answer and explanationHide answer
Correct answer: B
In IaaS the provider secures the physical and hypervisor layers, while the customer manages the guest operating system, its patches and the applications on it. Assuming automatic patching or provider ownership of the guest OS is the common misconception.
Question 12
Which cloud service model provides a complete application that users access over the internet?
1. ASaaS, which provides a complete application delivered to users over the internet
2. BIaaS, which provides virtual machines and storage for the customer to configure
3. CPaaS, which provides a platform for building and deploying custom applications
4. DOn-premises hosting, where the organisation runs all of its own hardware and software
Show answer and explanationHide answer
Correct answer: A
Software as a Service delivers a finished application over the internet. IaaS and PaaS provide infrastructure or a development platform, and on-premises hosting is not a cloud service model.
Question 13
Which THREE are typical security responsibilities of the customer in a SaaS model? (Choose three.)
1. AManaging user accounts and their access rights within the application
2. BPatching the provider's underlying infrastructure and hypervisors that host the service
3. CClassifying and protecting the data the customer stores in the application
4. DMaintaining the physical security of the provider's data centre buildings
5. EConfiguring sharing settings and access policies correctly within the service
Show answer and explanationHide answer
Correct answer: A, C, E
In SaaS the customer manages user access, protects its own data and configures sharing settings. The provider patches infrastructure and secures the data centre.
Question 14
What is the default port used for HTTPS traffic?
1. APort 25, the standard port for sending email between servers
2. BPort 80, the standard port for unencrypted web traffic
3. CPort 22, the standard port for encrypted remote shell access
4. DPort 443, the standard port for encrypted web traffic
Show answer and explanationHide answer
Correct answer: D
HTTPS uses port 443 by default. Port 80 is used for unencrypted HTTP, port 22 for SSH, and port 25 for SMTP email.

Security Governance (4 questions)

Question 15
Which document sets high-level management intent for information security and is approved by senior leadership?
1. AA security policy, which states management's intent and requirements for security
2. BA procedure, which gives step-by-step instructions for a specific task
3. CA guideline, which provides recommended practices that are not mandatory
4. DA standard, which sets specific mandatory technical requirements for a system
Show answer and explanationHide answer
Correct answer: C
A security policy states management's intent and is approved by senior leadership. Procedures give steps, standards set mandatory technical requirements, and guidelines are recommendations that are not mandatory.
Question 16
An organisation identifies a threat that could disrupt its online sales. Which first step follows the standard risk management approach?
1. AAssess the likelihood and impact of the threat to decide how to respond to it
2. BIgnore the threat until it actually causes an outage, to avoid spending money early
3. CBuy the most expensive security product on the market to cover every possible threat
4. DRemove the online sales service entirely, so that the threat no longer applies to the business
Show answer and explanationHide answer
Correct answer: A
Assessing likelihood and impact is the core of risk management and drives the response decision. Ignoring the threat, buying products without analysis and removing the service are not risk-based responses.
Question 17
A cybersecurity professional must act in a way that protects the public and the common good before their employer's interests. Which document sets this obligation?
1. AThe vendor's end-user licence agreement, which sets the terms for using the software
2. BThe company's staff handbook, which lists the working hours and holiday entitlements
3. CThe ISC2 Code of Ethics, which places protecting society first among its canons
4. DThe office health and safety policy, which covers the safe use of equipment at work
Show answer and explanationHide answer
Correct answer: C
The ISC2 Code of Ethics places protecting society, the common good and public trust first among its canons. The handbook, licence agreement and safety policy do not set that ethical priority.
Question 18
Which role is responsible for deciding how much risk the organisation is willing to accept and approving the security programme's direction?
1. ASenior management and the governance body, which set risk appetite and approve the programme
2. BThe helpdesk analyst, who resets passwords and records the calls from staff each day
3. CThe system administrator, who installs patches and configures servers on the network
4. DThe security awareness trainer, who runs the classes that staff attend each quarter
Show answer and explanationHide answer
Correct answer: A
Senior management and the governance body set risk appetite and approve the programme's direction. Helpdesk, administration and training roles carry out work within that direction.

Identity and Access Management Concepts (4 questions)

Question 19
Which authentication approach combines two different types of factor, such as something the user knows and something the user has?
1. ASingle sign-on, which lets a user access many systems after one login
2. BMulti-factor authentication, which requires two or more different factor types
3. CRole-based access, which assigns permissions according to a user's job role
4. DPassword history, which prevents users from reusing their previous passwords
Show answer and explanationHide answer
Correct answer: B
Multi-factor authentication requires two or more different types of factor, such as knowledge and possession. Single sign-on, role-based access and password history address other aspects of access.
Question 20
A company wants access decisions to depend on the user's department, the device they use and the time of day. Which access model fits best?
1. ADiscretionary access control, where the owner of each resource decides who has access
2. BAttribute-based access control, where policies evaluate attributes of the user, device and context
3. CRole-based access control, where access depends only on the user's job role in the company
4. DMandatory access control, where the system labels decide access that users cannot change
Show answer and explanationHide answer
Correct answer: B
Attribute-based access control makes decisions from attributes of the user, the resource and the context such as device and time. Discretionary, mandatory and role-based models rely on ownership, labels or roles alone.
Question 21
Which practice most directly reduces the risk when a user account is no longer needed by the business?
1. ADisabling or removing the account promptly and reviewing its remaining access
2. BLeaving the account active in case the user returns to the company in the future
3. CSharing the account's password with a colleague who will take over the work
4. DKeeping the account open with full administrator rights so that it can be reused
Show answer and explanationHide answer
Correct answer: C
Promptly disabling or removing unneeded accounts and reviewing their access removes an avoidable entry point. Keeping, sharing or over-privileging the account each increase the risk.
Question 22
Which control prevents one person from carrying out two steps of a sensitive process that should be checked independently?
1. ASeparation of duties, which requires different people for conflicting steps
2. BSingle sign-on, which lets one person sign in once to reach several systems
3. CAccount lockout, which blocks an account after repeated failed sign-in attempts
4. DSession timeout, which signs users out after a period of inactivity on screen
Show answer and explanationHide answer
Correct answer: A
Separation of duties requires different people for conflicting steps, so no single person can complete a sensitive process alone. The other controls address sign-in convenience, lockout and session length.

Business Continuity, Disaster Recovery and Incident Response (4 questions)

Question 23
A business impact analysis is used to determine which values for each critical system?
1. AThe colour scheme used for the company's internal dashboards and reports
2. BThe price that the company pays for each software licence when it is renewed
3. CThe number of employees who are allowed to take holidays during each year
4. DThe recovery time objective and recovery point objective that the business requires
Show answer and explanationHide answer
Correct answer: D
A business impact analysis identifies the maximum tolerable downtime and data loss for critical systems, which become the recovery time and recovery point objectives. The other options are unrelated to recovery planning.
Question 24
Which TWO statements about backups are correct? (Choose two.)
1. ABackups should be tested by restoring them periodically to confirm that they work
2. BBackups never need to be stored away from the primary site where the data lives
3. CBackups should be protected with access controls at least as strong as the source data
4. DA backup copy is always safe from ransomware if it is kept online at all times
5. EThe number of backup copies does not matter, as long as at least one copy exists
Show answer and explanationHide answer
Correct answer: A, C
Periodic restore tests confirm that backups are usable, and backups need access controls matching the source data. Offsite storage is needed to survive site loss, and online copies can be encrypted by ransomware.
Question 25
What does a recovery time objective define?
1. AThe amount of data, measured in time, that the business can afford to lose in an incident
2. BThe maximum acceptable time to restore a service after disruption
3. CThe number of backup copies that the organisation must keep at all times in each location
4. DThe time at which the disaster recovery plan was last reviewed and approved by management
Show answer and explanationHide answer
Correct answer: B
The recovery time objective is the maximum acceptable time to restore a service after disruption. The recovery point objective concerns how much data can be lost, and the other options are unrelated.
Question 26
A disaster recovery site has the building, power and network connections in place but no current hardware or data. What type of site is this?
1. AA hot site, which is fully equipped and running live with current data at all times
2. BA warm site, which has hardware and data partly ready, needing some hours to switch over
3. CA cold site, which has space and utilities but no hardware or current data in place
4. DA mirror site, which duplicates production in real time with no delay of any kind
Show answer and explanationHide answer
Correct answer: C
A cold site provides space and utilities but no hardware or current data, so it takes the longest to become operational. Hot and warm sites are better equipped, and a mirror site is a live duplicate.

Network Security (4 questions)

Question 27
Which device filters traffic between network segments based on rules about addresses, ports and protocols?
1. AA firewall, which filters traffic by rules about addresses, ports and protocols
2. BA hub, which repeats every packet to all connected ports on the network
3. CA modem, which converts digital signals for transmission over a telephone line
4. DA repeater, which amplifies a signal to extend the length of a cable run
Show answer and explanationHide answer
Correct answer: A
A firewall applies rules to traffic based on addresses, ports and protocols, which lets it allow or block flows between segments. A hub repeats traffic without filtering, while a modem and a repeater deal with signal transmission rather than access control.
Question 28
Which protocol provides encrypted remote login and command execution over an untrusted network?
1. ATelnet, which sends commands and passwords in plain text over the network
2. BFTP, which transfers files without encryption by default across the network
3. CSSH, which provides encrypted remote login and command execution
4. DHTTP, which transfers web pages without any encryption between client and server
Show answer and explanationHide answer
Correct answer: C
SSH encrypts the session for remote login and command execution, which is why it replaces Telnet. Telnet, FTP and HTTP all send data without encryption by default.
Question 29
What is the main purpose of network segmentation?
1. ATo increase the total bandwidth available to every user on the same network
2. BTo give every device the same IP address so that it is easy to locate on the network
3. CTo limit how far an intrusion can spread by separating systems into zones
4. DTo remove the need for any access control between the internal systems at all
Show answer and explanationHide answer
Correct answer: C
Segmentation divides the network into zones with controlled connections, so an intrusion in one zone is contained. It does not increase bandwidth, does not use shared addresses, and still needs access control between zones.
Question 30
Which system can detect suspicious traffic and actively block it when deployed inline?
1. AA packet capture tool that records network traffic for later manual analysis only
2. BA DNS server that resolves domain names to IP addresses for the clients on the network
3. CA DHCP server that assigns IP addresses to devices as they join the network
4. DAn intrusion prevention system deployed inline that can block malicious traffic
Show answer and explanationHide answer
Correct answer: D
An inline intrusion prevention system inspects traffic and can block malicious flows in real time, unlike passive detection. Packet capture only records, and DNS and DHCP provide network services rather than security enforcement.

All 30 Certified in Cybersecurity (CC) questions with answers

Security Principles (5 questions)

Question 1

Question 2

Question 3

Question 4

Question 5

Security Operations and Incident Response (5 questions)

Question 6

Question 7

Question 8

Question 9

Question 10

Networking and Cloud Security Concepts (4 questions)

Question 11

Question 12

Question 13

Question 14

Security Governance (4 questions)

Question 15

Question 16

Question 17

Question 18

Identity and Access Management Concepts (4 questions)

Question 19

Question 20

Question 21

Question 22

Business Continuity, Disaster Recovery and Incident Response (4 questions)

Question 23

Question 24

Question 25

Question 26

Network Security (4 questions)

Question 27

Question 28

Question 29

Question 30