ISACA Cybersecurity Fundamentals
Certification Exam – Latest 2025/2026 Exam
Prep & Practice Questions
Confidentiality - correct answerProtection from unauthorized access
integrity - correct answerProtection from unauthorized modification
Availability - correct answerprotection from disruptions in access
Cybersecurity - correct answerthe protection of information assets (digital assets) by
addressing threats to information processed, stored, and transported by internetworked
information systems
NIST Functions to Protect Digital Assets - correct answerIPDRR
1) Identify
2) Protect
3) Detect
4) Respond
5) Recover
Nonrepudiation - correct answerDef: ensuring that a message or other piece of
information is genuine
Examples: digital signatures and transaction logs
Risk - correct answercombination of the probability of an event and its consequences,
mitigated through controls
Threat - correct answerAnything that is capable of acting against an asset in a harmful
manner
Asset - correct answersomething of either tangible or intangible value that is worth
protecting
Vulnerability - correct answerA weakness in the design, implementation, operation or
internal control of a process that could expose the system to adverse threats from threat
events
Inherent risk - correct answerThe risk level or exposure without taking into account the
actions that management has taken or might take (e.g., implementing controls)
,Residual risk - correct answerthe risk that remains after management implements
internal controls or some other response to risk
Likelihood - correct answerA.K.A probability
measure of frequency of which an event may occur, which depends on the threat and
vulnerability
Approaches to Cybersecurity Risk - correct answerDependent on:
1) Risk tolerance
2) Size & scope of the environment
3) Amount of data available
Approaches:
1) Ad hoc
2) Compliance-based
3) Risk-based
Threat Agents - correct answerThe actors causing the threats that might exploit a
vulnerability
Types:
1) Corporations - competitive advantage
2) Cybercriminals - profit
3) Cyberterrorists - critical infrastructures/government
4) Cyberwarriors - politically motivated
5) Employees - revenge
6) Hacktivists - politically motivated
7) Nation states - government/private entities
8) Online social hackers - identity theft, profit
9) Script kiddies - learning to hack
Attack vector - correct answerThe path or route used to gain access to the target (asset)
Types:
1) Ingress - intrusion
2) Egress - Data removal
Attack Attributes - correct answer1) Attack Vector
2) Payload
3) Exploit
4) Vulnerability
5) Target (Asset)
Threat Process - correct answer1) Perform reconnaissance (gathering information)
, 2) Create attack tools
3) Deliver malicious capabilities
4) Exploit and compromise
5) Conduct an attack
6) Achieve results
7) Maintain a presence or set of capabilities
8) Coordinate a campaign
Malware - correct answerDef: software designed to infiltrate or damage a computer
system without the user's informed consent
Examples: Viruses, network worms, Trojan horses
Policies - correct answercommunicate required and prohibited activities and behaviors
Standards - correct answerInterpret policies in specific situations
Procedures - correct answerProvide details on how to comply with policies and
standards
Guidelines - correct answerProvide general guidance on issues; not requirements but
strongly recommended
Defense in Depth - correct answerLayering defenses to provide added protection
Types:
1) Concentric rings
2) Overlapping Redundancy
3) Segregation
Security perimeter - correct answerA well-defined boundary between the organization
and the outside world. Cybersecurity emphasizes the system-centric model (placing
controls at the network level)
Internet Perimeter - correct answerSecure access to the Internet for enterprise
employees and guest users, regardless of location.
It should...
1) Route traffic between enterprise & internet
2) Prevent executable files from being transferred through email attachments/browsing
3) Monitor internal/external network ports
4) Detect & block traffic from infected internal end point
5) Control user traffic bound for the internet
6) Identify and block malicious packets
7) Eliminate threats such as email spam, viruses
8) Enforce filtering policies to block access to websites containing malware
Certification Exam – Latest 2025/2026 Exam
Prep & Practice Questions
Confidentiality - correct answerProtection from unauthorized access
integrity - correct answerProtection from unauthorized modification
Availability - correct answerprotection from disruptions in access
Cybersecurity - correct answerthe protection of information assets (digital assets) by
addressing threats to information processed, stored, and transported by internetworked
information systems
NIST Functions to Protect Digital Assets - correct answerIPDRR
1) Identify
2) Protect
3) Detect
4) Respond
5) Recover
Nonrepudiation - correct answerDef: ensuring that a message or other piece of
information is genuine
Examples: digital signatures and transaction logs
Risk - correct answercombination of the probability of an event and its consequences,
mitigated through controls
Threat - correct answerAnything that is capable of acting against an asset in a harmful
manner
Asset - correct answersomething of either tangible or intangible value that is worth
protecting
Vulnerability - correct answerA weakness in the design, implementation, operation or
internal control of a process that could expose the system to adverse threats from threat
events
Inherent risk - correct answerThe risk level or exposure without taking into account the
actions that management has taken or might take (e.g., implementing controls)
,Residual risk - correct answerthe risk that remains after management implements
internal controls or some other response to risk
Likelihood - correct answerA.K.A probability
measure of frequency of which an event may occur, which depends on the threat and
vulnerability
Approaches to Cybersecurity Risk - correct answerDependent on:
1) Risk tolerance
2) Size & scope of the environment
3) Amount of data available
Approaches:
1) Ad hoc
2) Compliance-based
3) Risk-based
Threat Agents - correct answerThe actors causing the threats that might exploit a
vulnerability
Types:
1) Corporations - competitive advantage
2) Cybercriminals - profit
3) Cyberterrorists - critical infrastructures/government
4) Cyberwarriors - politically motivated
5) Employees - revenge
6) Hacktivists - politically motivated
7) Nation states - government/private entities
8) Online social hackers - identity theft, profit
9) Script kiddies - learning to hack
Attack vector - correct answerThe path or route used to gain access to the target (asset)
Types:
1) Ingress - intrusion
2) Egress - Data removal
Attack Attributes - correct answer1) Attack Vector
2) Payload
3) Exploit
4) Vulnerability
5) Target (Asset)
Threat Process - correct answer1) Perform reconnaissance (gathering information)
, 2) Create attack tools
3) Deliver malicious capabilities
4) Exploit and compromise
5) Conduct an attack
6) Achieve results
7) Maintain a presence or set of capabilities
8) Coordinate a campaign
Malware - correct answerDef: software designed to infiltrate or damage a computer
system without the user's informed consent
Examples: Viruses, network worms, Trojan horses
Policies - correct answercommunicate required and prohibited activities and behaviors
Standards - correct answerInterpret policies in specific situations
Procedures - correct answerProvide details on how to comply with policies and
standards
Guidelines - correct answerProvide general guidance on issues; not requirements but
strongly recommended
Defense in Depth - correct answerLayering defenses to provide added protection
Types:
1) Concentric rings
2) Overlapping Redundancy
3) Segregation
Security perimeter - correct answerA well-defined boundary between the organization
and the outside world. Cybersecurity emphasizes the system-centric model (placing
controls at the network level)
Internet Perimeter - correct answerSecure access to the Internet for enterprise
employees and guest users, regardless of location.
It should...
1) Route traffic between enterprise & internet
2) Prevent executable files from being transferred through email attachments/browsing
3) Monitor internal/external network ports
4) Detect & block traffic from infected internal end point
5) Control user traffic bound for the internet
6) Identify and block malicious packets
7) Eliminate threats such as email spam, viruses
8) Enforce filtering policies to block access to websites containing malware
