ISC ² CERTIFIED IN CYBERSECURITY CC
EXAM PREP 2025 to 2026 COMPLETE
STUDY GUIDE PRACTICE QUESTIONS
VERIFIED ANSWERS and DETAILED
EXPLANATIONS
An individual or a group that attempts to exploit vulnerabilities to cause or
force a threat to occur. - CORRECT ANSWER-Threat Actor
The means by which a threat actor carries out their objectives. -
CORRECT ANSWER-Threat Vector
A physical object a user possesses and controls that is used to authenticate
the user's identity. Source: NISTIR 7711 - CORRECT ANSWER-
Token
Weakness in an information system, system security procedures, internal
controls or implementation that could be exploited by a threat source.
Source: NIST SP 800-30 Rev 1 - CORRECT ANSWER-Vulnerability
IEEE is a professional organization that sets standards for
telecommunications, computer engineering and similar disciplines. -
CORRECT ANSWER-Institute of Electrical and Electronics
Engineers
,Which of the following is a biometric access control mechanism? (D3,
L3.2.1)
A) A badge reader
B) A copper key
C) A fence with razor tape on it
D) A door locked by a voiceprint identifier - CORRECT ANSWER-D)
A door locked by a voiceprint identifier
All of the following are typically perceived as drawbacks to biometric
systems, except: (D3, L3.2.1)
A) Lack of accuracy
B) Potential privacy concerns
C) Retention of physiological data past the point of employment
D) Legality - CORRECT ANSWER-A) Lack of accuracy
Which of the following is probably most useful at the perimeter of a
property? (D3, L3.2.1)
A) A safe
B) A fence
C) A data center
D) A centralized log storage facility - CORRECT ANSWER-B) A fence
,Gary is unable to log in to the production environment. Gary tries three
times and is then locked out of trying again for one hour. Why? (D3, L3.3.1)
A) Gary is being punished
B) The network is tired
C) Users remember their credentials if they are given time to think about it
D) Gary's actions look like an attack - CORRECT ANSWER-D) Gary's
actions look like an attack
Larry and Fern both work in the data center. In order to enter the data
center to begin their workday, they must both present their own keys
(which are different) to the key reader, before the door to the data center
opens.
Which security concept is being applied in this situation? (D3, L3.1.1)
A) Defense in depth
B) Segregation of duties
C) Least privilege
D) Dual control - CORRECT ANSWER-D) Dual control
A human guard monitoring a hidden camera could be considered a
______ control. (D3, L3.2.1)
A) Detective
B) Preventive
C) Deterrent
, D) Logical - CORRECT ANSWER-A) Detective
Which of the following statements is true? (D3, L3.3.1)
A) Logical access controls can protect the IT environment perfectly; there is
no reason to deploy any other controls
B) Physical access controls can protect the IT environment perfectly; there
is no reason to deploy any other controls
C) Administrative access controls can protect the IT environment perfectly;
there is no reason to deploy any other controls
D) It is best to use a blend of controls in order to provide optimum security
- CORRECT ANSWER-D) It is best to use a blend of controls in order
to provide optimum security
Visitors to a secure facility need to be controlled. Controls useful for
managing visitors include all of the following except: (D3, L3.2.1)
A) Sign-in sheet/tracking log
B) Fence
C) Badges that differ from employee badges
D) Receptionist - CORRECT ANSWER-B) Fence
Trina and Doug both work at Triffid, Inc. Doug is having trouble logging
into the network. Trina offers to log in for Doug, using Trina's credentials,
so that Doug can get some work done.
What is the problem with this? (D3, L3.3.1)
EXAM PREP 2025 to 2026 COMPLETE
STUDY GUIDE PRACTICE QUESTIONS
VERIFIED ANSWERS and DETAILED
EXPLANATIONS
An individual or a group that attempts to exploit vulnerabilities to cause or
force a threat to occur. - CORRECT ANSWER-Threat Actor
The means by which a threat actor carries out their objectives. -
CORRECT ANSWER-Threat Vector
A physical object a user possesses and controls that is used to authenticate
the user's identity. Source: NISTIR 7711 - CORRECT ANSWER-
Token
Weakness in an information system, system security procedures, internal
controls or implementation that could be exploited by a threat source.
Source: NIST SP 800-30 Rev 1 - CORRECT ANSWER-Vulnerability
IEEE is a professional organization that sets standards for
telecommunications, computer engineering and similar disciplines. -
CORRECT ANSWER-Institute of Electrical and Electronics
Engineers
,Which of the following is a biometric access control mechanism? (D3,
L3.2.1)
A) A badge reader
B) A copper key
C) A fence with razor tape on it
D) A door locked by a voiceprint identifier - CORRECT ANSWER-D)
A door locked by a voiceprint identifier
All of the following are typically perceived as drawbacks to biometric
systems, except: (D3, L3.2.1)
A) Lack of accuracy
B) Potential privacy concerns
C) Retention of physiological data past the point of employment
D) Legality - CORRECT ANSWER-A) Lack of accuracy
Which of the following is probably most useful at the perimeter of a
property? (D3, L3.2.1)
A) A safe
B) A fence
C) A data center
D) A centralized log storage facility - CORRECT ANSWER-B) A fence
,Gary is unable to log in to the production environment. Gary tries three
times and is then locked out of trying again for one hour. Why? (D3, L3.3.1)
A) Gary is being punished
B) The network is tired
C) Users remember their credentials if they are given time to think about it
D) Gary's actions look like an attack - CORRECT ANSWER-D) Gary's
actions look like an attack
Larry and Fern both work in the data center. In order to enter the data
center to begin their workday, they must both present their own keys
(which are different) to the key reader, before the door to the data center
opens.
Which security concept is being applied in this situation? (D3, L3.1.1)
A) Defense in depth
B) Segregation of duties
C) Least privilege
D) Dual control - CORRECT ANSWER-D) Dual control
A human guard monitoring a hidden camera could be considered a
______ control. (D3, L3.2.1)
A) Detective
B) Preventive
C) Deterrent
, D) Logical - CORRECT ANSWER-A) Detective
Which of the following statements is true? (D3, L3.3.1)
A) Logical access controls can protect the IT environment perfectly; there is
no reason to deploy any other controls
B) Physical access controls can protect the IT environment perfectly; there
is no reason to deploy any other controls
C) Administrative access controls can protect the IT environment perfectly;
there is no reason to deploy any other controls
D) It is best to use a blend of controls in order to provide optimum security
- CORRECT ANSWER-D) It is best to use a blend of controls in order
to provide optimum security
Visitors to a secure facility need to be controlled. Controls useful for
managing visitors include all of the following except: (D3, L3.2.1)
A) Sign-in sheet/tracking log
B) Fence
C) Badges that differ from employee badges
D) Receptionist - CORRECT ANSWER-B) Fence
Trina and Doug both work at Triffid, Inc. Doug is having trouble logging
into the network. Trina offers to log in for Doug, using Trina's credentials,
so that Doug can get some work done.
What is the problem with this? (D3, L3.3.1)
