ISC2 Certified In Cybersecurity (CC) Practice Exam
Questions and Answers
A vendor sells a particular operating system A. Law, procedure
(OS). In order to deploy the OS securely on B. Standard, law
different platforms, the vendor publishes several C. Law, standard
sets of instructions on how to install it, depending D. Policy, standard
on which platform the customer is using. This is E. Policy, law - ANSWER -A. Law,
an example of ______. procedure
A. Law
B. Procedure
C. Standard Which of the following is an example of a
D. Policy - ANSWER -B. Procedure "something you know" authentication factor?
A. User ID
B. Password
The city of Grampon wants to know where all its C. Fingerprint
public vehicles (garbage trucks, police cars, etc.) D. Iris scan - ANSWER -B. Password
are at all times, so the city has GPS transmitters
installed in all the vehicles. What kind of control
is this? Tina is an (ISC)² member and is invited to join an
A. Administrative online group of IT security enthusiasts. After
B. Entrenched attending a few online sessions, Tina learns that
C. Physical some participants in the group are sharing
D. Technical - ANSWER -D. Technical malware with each other, in order to use it
against other organizations online. What should
Tina do?
Triffid Corporation has a rule that all employees A. Nothing
working with sensitive hardcopy documents must B. Stop participating in the group
put the documents into a safe at the end of the C. Report the group to law enforcement
workday, where they are locked up until the D. Report the group to (ISC)2 - ANSWER -
following workday. What kind of control is the B. Stop participating
process of putting the documents into the safe?
A. Administrative
B. Tangential A bollard is a post set securely in the ground in
C. Physical order to prevent a vehicle from entering an area
D. Technical - ANSWER -A. Administrative or driving past a certain point. Bollards are an
example of ______ controls.
A. Physical
Grampon municipal code requires that all B. Administrative
companies that operate within city limits will have C. Drastic
a set of processes to ensure employees are safe D. Technical - ANSWER -A. Physical
while working with hazardous materials. Triffid
Corporation creates a checklist of activities
employees must follow while working with Triffid Corporation has a policy that all employees
hazardous materials inside Grampon city limits. must receive security awareness instruction
The municipal code is a ______, and the Triffid before using email; the company wants to make
checklist is a ________. employees aware of potential phishing attempts
,ISC2 Certified In Cybersecurity (CC) Practice Exam
Questions and Answers
that the employees might receive via email. What colleagues is interested in getting an (ISC)2
kind of control is this instruction? certification and asks Zarma what the test
A. Administrative questions are like. What should Zarma do?
B. Finite A. Inform (ISC)2
C. Physical B. Explain the style and format of the questions,
D. Technical - ANSWER -A. Administrative but no detail
C. Inform the colleague's supervisor
D. Nothing - ANSWER -B. Explain the style
The Triffid Corporation publishes a strategic and format of the questions, but no detail
overview of the company's intent to secure all the
data the company possesses. This document is
signed by Triffid senior management. What kind Druna is a security practitioner tasked with
of document is this? ensuring that laptops are not stolen from the
A. Policy organization's offices. Which sort of security
B. Procedure control would probably be best for this purpose?
C. Standard A. Technical
D. Law - ANSWER -A. Policy B. Observe
C. Physical
D. Administrative - ANSWER -C. Physical
Chad is a security practitioner tasked with
ensuring that the information on the
organization's public website is not changed by For which of the following assets is integrity
anyone outside the organization. This task is an probably the most important security aspect?
example of ensuring _________. A. One frame of a streaming video
A. Confidentiality B. The file that contains passwords used to
B. Integrity authenticate users
C. Availability C. The color scheme of a marketing website
D. Confirmation - ANSWER -B. Integrity D. Software that checks the spelling of product
descriptions for a retail website -
ANSWER -B. The file that contains
The city of Grampon wants to ensure that all of passwords used to authenticate users
its citizens are protected from malware, so the
city council creates a rule that anyone caught
creating and launching malware within the city Jengi is setting up security for a home network.
limits will receive a fine and go to jail. What kind Jengi decides to configure MAC address filtering
of rule is this? on the router, so that only specific devices will be
A. Policy allowed to join the network. This is an example of
B. Procedure a(n)_______ control.
C. Standard A. Physical
D. Law - ANSWER -D. Law B. Administrative
C. Substantial
D. Technical - ANSWER -D. Technical
Zarma is an (ISC)² member and a security
analyst for Triffid Corporation. One of Zarma's
, ISC2 Certified In Cybersecurity (CC) Practice Exam
Questions and Answers
Siobhan is an (ISC)² member who works for D. Transference - ANSWER -A. Acceptance
Triffid Corporation as a security analyst.
Yesterday, Siobhan got a parking ticket while
shopping after work. What should Siobhan do? In risk management concepts, a(n) ___________
A. Inform (ISC)2 is something or someone that poses risk to an
B. Pay the parking ticket organization or asset.
C. Inform supervisors at Triffid A. Fear
D. Resign employment from Triffid - B. Threat
ANSWER -B. Pay the parking ticket C. Control
D. Asset - ANSWER -B. Threat
Hoshi is an (ISC)² member who works for the
Triffid Corporation as a data manager. Triffid Who approves the incident response policy?
needs a new firewall solution, and Hoshi is asked A. (ISC)2
to recommend a product for Triffid to acquire and B. Senior management
implement. Hoshi's cousin works for a firewall C. The security manager
vendor; that vendor happens to make the best D. Investor - ANSWER -B. Senior
firewall available. What should Hoshi do? management
A. Recommend a different vendor/product
B. Recommend the cousin's product
C. Hoshi should ask to be recused from the task When should a business continuity plan (BCP) be
D. Disclose the relationship, but recommend the activated?
vendor/product - ANSWER -D. Disclose the A. As soon as possible
relationship, but recommend the vendor/product B. At the very beginning of a disaster
C. When senior management decides
D. When instructed to do so by regulators -
Of the following, which would probably not be ANSWER -C. When senior management
considered a threat? decides
A. Natural disaster
B. Unintentional damage to the system cause by
a user True or False? Business continuity planning is a
C. A laptop with sensitive data on it reactive procedure that restores business
D. An external attacker trying to gain operations after a disruption occurs.
unauthorized access to the environment - A. True
ANSWER -C. A laptop with sensitive data B. False - ANSWER -B. False
on it
What is the goal of an incident response effort?
Sophia is visiting Las Vegas and decides to put a A. No incident ever happen
bet on a particular number on a roulette wheel. B. Reduce the impact of incidents on operations
This is an example of _________. C. Punish wrongdoers
A. Acceptance
D. Save money - ANSWER -B. Reduce the
B. Avoidance
impact of incidents on operations
C. Mitigation
Questions and Answers
A vendor sells a particular operating system A. Law, procedure
(OS). In order to deploy the OS securely on B. Standard, law
different platforms, the vendor publishes several C. Law, standard
sets of instructions on how to install it, depending D. Policy, standard
on which platform the customer is using. This is E. Policy, law - ANSWER -A. Law,
an example of ______. procedure
A. Law
B. Procedure
C. Standard Which of the following is an example of a
D. Policy - ANSWER -B. Procedure "something you know" authentication factor?
A. User ID
B. Password
The city of Grampon wants to know where all its C. Fingerprint
public vehicles (garbage trucks, police cars, etc.) D. Iris scan - ANSWER -B. Password
are at all times, so the city has GPS transmitters
installed in all the vehicles. What kind of control
is this? Tina is an (ISC)² member and is invited to join an
A. Administrative online group of IT security enthusiasts. After
B. Entrenched attending a few online sessions, Tina learns that
C. Physical some participants in the group are sharing
D. Technical - ANSWER -D. Technical malware with each other, in order to use it
against other organizations online. What should
Tina do?
Triffid Corporation has a rule that all employees A. Nothing
working with sensitive hardcopy documents must B. Stop participating in the group
put the documents into a safe at the end of the C. Report the group to law enforcement
workday, where they are locked up until the D. Report the group to (ISC)2 - ANSWER -
following workday. What kind of control is the B. Stop participating
process of putting the documents into the safe?
A. Administrative
B. Tangential A bollard is a post set securely in the ground in
C. Physical order to prevent a vehicle from entering an area
D. Technical - ANSWER -A. Administrative or driving past a certain point. Bollards are an
example of ______ controls.
A. Physical
Grampon municipal code requires that all B. Administrative
companies that operate within city limits will have C. Drastic
a set of processes to ensure employees are safe D. Technical - ANSWER -A. Physical
while working with hazardous materials. Triffid
Corporation creates a checklist of activities
employees must follow while working with Triffid Corporation has a policy that all employees
hazardous materials inside Grampon city limits. must receive security awareness instruction
The municipal code is a ______, and the Triffid before using email; the company wants to make
checklist is a ________. employees aware of potential phishing attempts
,ISC2 Certified In Cybersecurity (CC) Practice Exam
Questions and Answers
that the employees might receive via email. What colleagues is interested in getting an (ISC)2
kind of control is this instruction? certification and asks Zarma what the test
A. Administrative questions are like. What should Zarma do?
B. Finite A. Inform (ISC)2
C. Physical B. Explain the style and format of the questions,
D. Technical - ANSWER -A. Administrative but no detail
C. Inform the colleague's supervisor
D. Nothing - ANSWER -B. Explain the style
The Triffid Corporation publishes a strategic and format of the questions, but no detail
overview of the company's intent to secure all the
data the company possesses. This document is
signed by Triffid senior management. What kind Druna is a security practitioner tasked with
of document is this? ensuring that laptops are not stolen from the
A. Policy organization's offices. Which sort of security
B. Procedure control would probably be best for this purpose?
C. Standard A. Technical
D. Law - ANSWER -A. Policy B. Observe
C. Physical
D. Administrative - ANSWER -C. Physical
Chad is a security practitioner tasked with
ensuring that the information on the
organization's public website is not changed by For which of the following assets is integrity
anyone outside the organization. This task is an probably the most important security aspect?
example of ensuring _________. A. One frame of a streaming video
A. Confidentiality B. The file that contains passwords used to
B. Integrity authenticate users
C. Availability C. The color scheme of a marketing website
D. Confirmation - ANSWER -B. Integrity D. Software that checks the spelling of product
descriptions for a retail website -
ANSWER -B. The file that contains
The city of Grampon wants to ensure that all of passwords used to authenticate users
its citizens are protected from malware, so the
city council creates a rule that anyone caught
creating and launching malware within the city Jengi is setting up security for a home network.
limits will receive a fine and go to jail. What kind Jengi decides to configure MAC address filtering
of rule is this? on the router, so that only specific devices will be
A. Policy allowed to join the network. This is an example of
B. Procedure a(n)_______ control.
C. Standard A. Physical
D. Law - ANSWER -D. Law B. Administrative
C. Substantial
D. Technical - ANSWER -D. Technical
Zarma is an (ISC)² member and a security
analyst for Triffid Corporation. One of Zarma's
, ISC2 Certified In Cybersecurity (CC) Practice Exam
Questions and Answers
Siobhan is an (ISC)² member who works for D. Transference - ANSWER -A. Acceptance
Triffid Corporation as a security analyst.
Yesterday, Siobhan got a parking ticket while
shopping after work. What should Siobhan do? In risk management concepts, a(n) ___________
A. Inform (ISC)2 is something or someone that poses risk to an
B. Pay the parking ticket organization or asset.
C. Inform supervisors at Triffid A. Fear
D. Resign employment from Triffid - B. Threat
ANSWER -B. Pay the parking ticket C. Control
D. Asset - ANSWER -B. Threat
Hoshi is an (ISC)² member who works for the
Triffid Corporation as a data manager. Triffid Who approves the incident response policy?
needs a new firewall solution, and Hoshi is asked A. (ISC)2
to recommend a product for Triffid to acquire and B. Senior management
implement. Hoshi's cousin works for a firewall C. The security manager
vendor; that vendor happens to make the best D. Investor - ANSWER -B. Senior
firewall available. What should Hoshi do? management
A. Recommend a different vendor/product
B. Recommend the cousin's product
C. Hoshi should ask to be recused from the task When should a business continuity plan (BCP) be
D. Disclose the relationship, but recommend the activated?
vendor/product - ANSWER -D. Disclose the A. As soon as possible
relationship, but recommend the vendor/product B. At the very beginning of a disaster
C. When senior management decides
D. When instructed to do so by regulators -
Of the following, which would probably not be ANSWER -C. When senior management
considered a threat? decides
A. Natural disaster
B. Unintentional damage to the system cause by
a user True or False? Business continuity planning is a
C. A laptop with sensitive data on it reactive procedure that restores business
D. An external attacker trying to gain operations after a disruption occurs.
unauthorized access to the environment - A. True
ANSWER -C. A laptop with sensitive data B. False - ANSWER -B. False
on it
What is the goal of an incident response effort?
Sophia is visiting Las Vegas and decides to put a A. No incident ever happen
bet on a particular number on a roulette wheel. B. Reduce the impact of incidents on operations
This is an example of _________. C. Punish wrongdoers
A. Acceptance
D. Save money - ANSWER -B. Reduce the
B. Avoidance
impact of incidents on operations
C. Mitigation
