10 ISC2 CC Practice Questions That Mirror the Real Exam
Here are 10 multiple-choice questions designed to match the difficulty and style of the ISC2 Certified in Cybersecurity (CC) exam. These questions cover key domains including Security Principles, Incident Response, Business Continuity (BC/DR), and Access Control Concepts.
Intro: Welcome to this ISC2 CC practice quiz. These questions are designed to test your understanding of core cybersecurity concepts as outlined in the ISC2 CC exam outline. Read each question carefully and select the best answer. Before moving on, consider reading 8 CCSP Practice Questions That Mirror the Real Exam.
If you want a schedule that fits your study time, the free ISC2 Certified in Cybersecurity study plan can map out your preparation.
Question 1
A security analyst discovers that a user's account has been locked out due to multiple failed login attempts, followed by a successful login from a foreign IP address at 3:00 AM. Which type of security control would have prevented this unauthorized access?
A. Deterrent control
B. Preventive control
C. Detective control
D. Corrective control
Answer: B
Explanation: Preventive controls are designed to stop unauthorized activities from occurring. Multi-factor authentication (MFA) or a stricter account lockout policy are examples of preventive controls that would have blocked the attacker. Detective controls (like alarms) identify the incident after it happens, while corrective controls (like patching) fix the issue afterward.
Question 2
An organization is developing a new mobile application that processes credit card data. To ensure compliance with industry standards and reduce risk, they are categorizing data based on its sensitivity and the impact of its disclosure. Which process are they performing?
A. Data masking
B. Data classification
C. Data retention
D. Data sovereignty
Answer: B
Explanation: Data classification is the process of categorizing data based on its level of sensitivity and the impact to the organization if it is compromised (e.g., Public, Internal, Confidential, Restricted). This process helps determine the appropriate security controls and handling requirements. Data masking is a specific technique to hide data, while retention and sovereignty relate to storage duration and location.
Question 3
A company's primary data center has suffered a complete power failure. The IT team activates the backup site, which is configured to restore operations within 4 hours. According to the BCDR plan, what does the "4 hours" represent?
A. Recovery Time Objective (RTO)
B. Recovery Point Objective (RPO)
C. Mean Time to Repair (MTTR)
D. Service Level Agreement (SLA)
Answer: A
Explanation: The Recovery Time Objective (RTO) is the maximum acceptable amount of time it takes to restore business operations after a disaster. The Recovery Point Objective (RPO) refers to the maximum acceptable amount of data loss measured in time (e.g., losing 15 minutes of transactions). MTTR is a maintenance metric, and an SLA is a contract with a customer, not an internal recovery metric.
Question 4
An employee receives an email claiming to be from the CEO urgently requesting the purchase of gift cards. The email address looks slightly different from the official one (e.g., [email protected] instead of [email protected]). Which type of social engineering attack is this?
A. Phishing
B. Smishing You can explore this further in 10 CompTIA CySA+ (CS0-003) Practice Questions That Mirror the Real Exam.
C. Whaling
D. Vishing
Answer: C
Explanation: Whaling is a specific type of phishing attack that targets high-profile executives or senior management. The attacker impersonates the executive to trick other employees into performing actions like wire transfers or purchasing gift cards. Smishing uses SMS text messages, and vishing uses voice calls. While it is a form of phishing, "whaling" is the most specific and accurate answer.
Question 5
A system administrator needs to grant a new employee access to the company's CRM system. The administrator assigns the employee the standard "Sales User" role, which includes permissions to view and edit customer records but not to delete them. Which access control principle is being applied?
A. Separation of Duties
B. Least Privilege
C. Need to Know
D. Mandatory Access Control
Answer: B
Explanation: The principle of Least Privilege ensures that users are granted only the minimum levels of access (or permissions) needed to perform their job functions. Granting the standard "Sales User" role with limited permissions (view/edit but not delete) is a direct application of this principle. Separation of Duties requires more than one person to complete a critical task, and "Need to Know" is about limiting data access based on necessity.
Question 6
A security manager is reviewing the technical controls used to protect a data center. Which of the following is considered a technical control?
A. Security guards
B. Biometric access readers
C. Access control policies and procedures
D. CCTV cameras
Answer: B
Explanation: Technical controls (also called logical controls) are implemented using technology, such as software, hardware, or firmware. Biometric access readers (fingerprint or retina scanners) are a prime example of a technical control. Security guards and CCTV cameras are physical controls, while policies and procedures are administrative controls.
Question 7
An organization wants to ensure that a critical file has not been altered during transmission. Which cryptographic technique is used to provide this assurance?
A. Encryption
B. Digital signature
C. Hashing
D. Steganography
Answer: C Want to go further? 10 CompTIA PenTest+ Practice Questions That Mirror the Real Exam is a good next step.
Explanation: Hashing creates a unique fixed-length string (hash value) based on the file's contents. If the file is altered, the hash value will change, allowing the recipient to detect tampering and verify integrity. Encryption provides confidentiality, a digital signature provides authenticity and non-repudiation (and includes hashing), but hashing alone is the specific technique for integrity. Steganography hides data within other data.
Question 8
A company has just experienced a ransomware attack. The incident response team has contained the threat and eradicated the malware from the affected systems. What is the next step in the incident response process?
A. Identification
B. Recovery
C. Lessons Learned
D. Preparation
Answer: B
Explanation: The standard incident response lifecycle is: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Since containment and eradication are complete, the next logical step is Recovery, which involves restoring systems to normal operation and verifying they are no longer compromised. Lessons Learned is the final phase, and Preparation is the initial phase.
Question 9
Which of the following best describes the primary purpose of a Business Continuity Plan (BCP)?
A. To outline the steps for restoring IT systems and infrastructure after a disaster.
B. To ensure the continuation of critical business operations during and after a disruption.
C. To define the roles and responsibilities of the incident response team.
D. To establish the criteria for declaring a disaster and activating the recovery site.
Answer: B
Explanation: The BCP is a holistic plan that focuses on maintaining the essential business functions (e.g., customer service, payroll, manufacturing) during and after a disruption. The Disaster Recovery Plan (DRP) is a subset of the BCP that specifically focuses on restoring IT systems and infrastructure. Options C and D are components of a DRP or IR plan, not the overarching purpose of the BCP.
Question 10
An organization is implementing a new access control system. They decide to use a model where access rights are assigned based on the user's job function within the organization (e.g., "Marketing", "Finance", "HR"). Which access control model is this?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Role-Based Access Control (RBAC)
D. Attribute-Based Access Control (ABAC)
Answer: C
Explanation: Role-Based Access Control (RBAC) grants permissions based on the roles or job functions that users are assigned to. This simplifies administration, as permissions are managed at the role level rather than for each individual user. DAC allows the owner to set permissions, MAC uses system-enforced labels, and ABAC uses a combination of user, resource, and environmental attributes.
Closing: These questions represent the core concepts you'll need to master for the ISC2 CC exam. Remember to focus on understanding the purpose of each control and the order of processes, as the exam often tests your ability to apply these concepts to real-world scenarios.
When you need a quick check of your weak topics before test day, use the free ISC2 Certified in Cybersecurity readiness check.
Round out your revision with ISC2 Certified in Cybersecurity (CC) mock test — they are the missing piece most candidates skip.