ISC2 Certified in Cybersecurity (ISC2-CC) practice questions

During a review of a design document, an analyst reads that the owner of each file decides who else may read or write it, and that a user who has been granted read access may then pass that access to a colleague. Which logical access control model does this describe?

• ADiscretionary access control, because the resource owner sets permissions and access can be delegated onwardcheck_circle Correct
• BMandatory access control, because a central authority enforces labels that users cannot change
• CRole-based access control, because permissions follow the job function rather than the individual
• DRule-based access control, because a system rule automatically evaluates each request

Why A is correct: Correct: DAC lets the owner of an object set its permissions at their discretion, and a subject holding access can typically propagate that access to others, which is the defining behaviour described.

Why B is wrong: Tempting because MAC also governs who may read a resource, but MAC forbids owners and users from granting access; the described ability of an owner to decide and of a user to pass access on contradicts MAC entirely.

Why C is wrong: Tempting since RBAC is common, but the scenario ties permissions to an owner's personal decision about a specific file, not to a job role, so RBAC does not fit.

Why D is wrong: Tempting because a rule could permit reads, but rule-based control applies uniform system rules to all subjects rather than letting an owner personally grant and delegate access.

A training officer at a clinic explains that one member of the CIA triad is about making sure information is not disclosed to people or systems that have no authorisation to see it. Which member of the triad does this description define?

• AConfidentiality, because it limits disclosure of information to those parties that have been properly authorised to access it.check_circle Correct
• BIntegrity, because it keeps stored records accurate and unaltered by anyone who lacks the proper authorisation to change them.
• CAvailability, because it keeps information reachable so that authorised users can obtain it whenever they legitimately need it.
• DNon-repudiation, because it prevents a party from denying that it accessed or disclosed a given piece of information.

Why A is correct: Confidentiality is the triad property that prevents disclosure of information to unauthorised people or systems, which is exactly what the description states.

Why B is wrong: Integrity is tempting because unauthorised change is also a concern, but integrity concerns accuracy and prevention of alteration, not the prevention of disclosure that the description names.

Why C is wrong: Availability sounds relevant because it also involves authorised users, but it addresses timely access to data rather than stopping unauthorised parties from seeing it.

Why D is wrong: Non-repudiation is tempting through its link to accountability, but it proves that an action occurred rather than preventing disclosure to unauthorised parties.

A trainee is learning the OSI reference model and asks which layer is responsible for logical addressing and for selecting a path between networks so that a packet can reach a host on a different subnet. Which layer performs this function?

• AThe data link layer (Layer 2), which frames bits and uses MAC addresses to move data between devices on the same physical segment.
• BThe network layer (Layer 3), which uses logical IP addresses and routing decisions to forward packets between separate networks.check_circle Correct
• CThe transport layer (Layer 4), which segments data and provides reliable end-to-end delivery using port numbers to identify applications.
• DThe session layer (Layer 5), which establishes, manages and tears down dialogues between two communicating applications.

Why A is wrong: This is tempting because Layer 2 also does addressing, but it uses hardware MAC addresses and only moves frames within a single local segment, not between separate networks.

Why B is correct: Correct: Layer 3 handles logical addressing with IP and makes routing decisions, allowing a packet to travel from one subnet to another.

Why C is wrong: This is tempting because Layer 4 does end-to-end delivery, but it identifies applications with ports and does not perform logical network addressing or path selection.

Why D is wrong: This is tempting as it sits near the middle of the stack, but Layer 5 manages conversations between applications and plays no role in addressing or routing.