ISC2 Certified in Cybersecurity (CC)QUESTIONS AND
ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS
| LATEST EXAM UPDATE | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
Here are 100 practice questions for the ISC2 Certified in Cybersecurity (CC) exam, covering all five domains.
Each question includes the answer and a rationale.
,Domain 1: Security Principles (Questions 1–20)
Domain 2: Business Continuity, Disaster Recovery & Incident Response (Questions 21–40)
Domain 3: Access Controls Concepts (Questions 41–60)
Domain 4: Network Security (Questions 61–80)
Domain 5: Security Operations (Questions 81–100)
Domain 1: Security Principles
1. Which of the following best describes the principle of least privilege?
A) Users should have access to all resources they need to perform any task
B) Users should be granted only the minimum access necessary to perform their job functions
C) Users should have administrative rights at all times
D) Users should share accounts to reduce complexity
Answer: B
,Rationale: Least privilege means granting users only the minimum permissions needed to complete their
assigned tasks, reducing the attack surface and potential for misuse.
2. The CIA triad consists of which three components?
A) Confidentiality, Integrity, Availability
B) Control, Intelligence, Authorization
C) Confidentiality, Identity, Authentication
D) Compliance, Integrity, Auditing
Answer: A
Rationale: The CIA triad—Confidentiality, Integrity, and Availability—is the foundational model for information
security.
3. Which principle states that a system should not rely on the secrecy of its design for security?
, A) Defense in depth
B) Security through obscurity
C) Kerckhoffs's principle
D) Separation of duties
Answer: C
Rationale: Kerckhoffs's principle states a system should be secure even if everything about it, except the key, is
public knowledge.
4. What is the primary purpose of a security policy?
A) To configure firewalls
B) To define management's intent and direction for security
C) To encrypt data at rest
D) To test vulnerabilities
Answer: B
ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS
| LATEST EXAM UPDATE | EXAM PREP | STUDY
GUIDE | PRACTICE TEST
Here are 100 practice questions for the ISC2 Certified in Cybersecurity (CC) exam, covering all five domains.
Each question includes the answer and a rationale.
,Domain 1: Security Principles (Questions 1–20)
Domain 2: Business Continuity, Disaster Recovery & Incident Response (Questions 21–40)
Domain 3: Access Controls Concepts (Questions 41–60)
Domain 4: Network Security (Questions 61–80)
Domain 5: Security Operations (Questions 81–100)
Domain 1: Security Principles
1. Which of the following best describes the principle of least privilege?
A) Users should have access to all resources they need to perform any task
B) Users should be granted only the minimum access necessary to perform their job functions
C) Users should have administrative rights at all times
D) Users should share accounts to reduce complexity
Answer: B
,Rationale: Least privilege means granting users only the minimum permissions needed to complete their
assigned tasks, reducing the attack surface and potential for misuse.
2. The CIA triad consists of which three components?
A) Confidentiality, Integrity, Availability
B) Control, Intelligence, Authorization
C) Confidentiality, Identity, Authentication
D) Compliance, Integrity, Auditing
Answer: A
Rationale: The CIA triad—Confidentiality, Integrity, and Availability—is the foundational model for information
security.
3. Which principle states that a system should not rely on the secrecy of its design for security?
, A) Defense in depth
B) Security through obscurity
C) Kerckhoffs's principle
D) Separation of duties
Answer: C
Rationale: Kerckhoffs's principle states a system should be secure even if everything about it, except the key, is
public knowledge.
4. What is the primary purpose of a security policy?
A) To configure firewalls
B) To define management's intent and direction for security
C) To encrypt data at rest
D) To test vulnerabilities
Answer: B
