Free ISC2-CC practice questions

A training officer at a clinic explains that one member of the CIA triad is about making sure information is not disclosed to people or systems that have no authorisation to see it. Which member of the triad does this description define?

• AConfidentiality, because it limits disclosure of information to those parties that have been properly authorised to access it.check_circle Correct
• BIntegrity, because it keeps stored records accurate and unaltered by anyone who lacks the proper authorisation to change them.
• CAvailability, because it keeps information reachable so that authorised users can obtain it whenever they legitimately need it.
• DNon-repudiation, because it prevents a party from denying that it accessed or disclosed a given piece of information.

Why A is correct: Confidentiality is the triad property that prevents disclosure of information to unauthorised people or systems, which is exactly what the description states.

Why B is wrong: Integrity is tempting because unauthorised change is also a concern, but integrity concerns accuracy and prevention of alteration, not the prevention of disclosure that the description names.

Why C is wrong: Availability sounds relevant because it also involves authorised users, but it addresses timely access to data rather than stopping unauthorised parties from seeing it.

Why D is wrong: Non-repudiation is tempting through its link to accountability, but it proves that an action occurred rather than preventing disclosure to unauthorised parties.

During onboarding, an analyst is asked how integrity differs from confidentiality within the CIA triad. Which statement most accurately captures the essential difference between the two properties?

• AIntegrity assures that data can be reached whenever needed, whereas confidentiality assures that data is backed up to a second location for recovery.
• BIntegrity assures that data remains accurate and is not altered without authorisation, whereas confidentiality assures that data is not disclosed to unauthorised parties.check_circle Correct
• CIntegrity assures that a user cannot deny an action they took, whereas confidentiality assures that the same user is who they claim to be.
• DIntegrity assures that only authorised users can view records, whereas confidentiality assures that records are never changed by anyone at all.

Why A is wrong: This is tempting but conflates integrity with availability and misstates confidentiality as backup, so neither half describes the intended property.

Why B is correct: This correctly separates the two: integrity protects accuracy against unauthorised change, while confidentiality protects against unauthorised disclosure.

Why C is wrong: This confuses integrity with non-repudiation and confidentiality with authentication, so it describes different assurance concepts entirely.

Why D is wrong: This reverses the two properties, attaching disclosure control to integrity and an unrealistic no-change rule to confidentiality.

A help desk lead notes that a denial-of-service flood which stops staff from reaching an internal portal is an attack on one specific member of the CIA triad. Which member of the triad does such an attack primarily target?

• AConfidentiality, because the flood exposes internal traffic that unauthorised outsiders were never meant to observe.
• BIntegrity, because the flood silently rewrites the portal's stored records so that staff can no longer trust them.
• CAvailability, because the flood prevents authorised staff from reaching a service they are entitled to use.check_circle Correct
• DNon-repudiation, because the flood removes the logs that would otherwise prove which user performed each action.

Why A is wrong: Confidentiality is tempting because attacks are involved, but a flood that blocks access is not primarily about disclosing data to outsiders.

Why B is wrong: Integrity sounds plausible if one assumes data is corrupted, but a denial-of-service flood withholds access rather than altering the stored records.

Why C is correct: A denial-of-service flood aims to make a resource unreachable for authorised users, which is a direct attack on availability.

Why D is wrong: Non-repudiation is tempting through its link to logging, but the defining effect of a flood is lost access, not the inability to attribute actions.

A trainee is learning the OSI reference model and asks which layer is responsible for logical addressing and for selecting a path between networks so that a packet can reach a host on a different subnet. Which layer performs this function?

• AThe data link layer (Layer 2), which frames bits and uses MAC addresses to move data between devices on the same physical segment.
• BThe network layer (Layer 3), which uses logical IP addresses and routing decisions to forward packets between separate networks.check_circle Correct
• CThe transport layer (Layer 4), which segments data and provides reliable end-to-end delivery using port numbers to identify applications.
• DThe session layer (Layer 5), which establishes, manages and tears down dialogues between two communicating applications.

Why A is wrong: This is tempting because Layer 2 also does addressing, but it uses hardware MAC addresses and only moves frames within a single local segment, not between separate networks.

Why B is correct: Correct: Layer 3 handles logical addressing with IP and makes routing decisions, allowing a packet to travel from one subnet to another.

Why C is wrong: This is tempting because Layer 4 does end-to-end delivery, but it identifies applications with ports and does not perform logical network addressing or path selection.

Why D is wrong: This is tempting as it sits near the middle of the stack, but Layer 5 manages conversations between applications and plays no role in addressing or routing.

An instructor contrasts the OSI model with the TCP/IP model for a study group. Which statement most accurately describes how the two models relate?

• AThe TCP/IP model adds a presentation layer that the OSI model lacks, giving it more distinct layers than OSI overall.
• BBoth models define exactly seven layers, and only the names assigned to those layers differ between them.
• CThe TCP/IP model collapses the OSI application, presentation and session layers into a single application layer, so it has fewer layers overall.check_circle Correct
• DThe OSI model is used to forward live production traffic while the TCP/IP model exists purely as a teaching abstraction.

Why A is wrong: This reverses the reality; the presentation layer belongs to OSI, and TCP/IP actually has fewer layers, not more.

Why B is wrong: This is tempting to anyone recalling OSI's seven layers, but the TCP/IP model defines four layers, so the counts genuinely differ.

Why C is correct: Correct: the four-layer TCP/IP model merges OSI Layers 5, 6 and 7 into one application layer, giving it fewer layers than the seven-layer OSI model.

Why D is wrong: This inverts their roles; TCP/IP underpins real internet traffic, whereas OSI is chiefly a reference and teaching framework.

During a protocols lesson, a candidate is asked which statement correctly captures the essential difference between TCP and UDP at the transport layer. Which statement is accurate?

• ATCP is connectionless and sends datagrams without acknowledgements, while UDP establishes a connection and retransmits any lost segments.
• BBoth TCP and UDP guarantee ordered delivery, and they differ only in the range of port numbers each is permitted to use.
• CTCP operates at the network layer to route packets, while UDP operates at the transport layer to segment application data.
• DTCP establishes a connection and provides ordered, acknowledged delivery, while UDP is connectionless and offers lower overhead without guaranteed delivery.check_circle Correct

Why A is wrong: This is tempting because it names real behaviours, but it swaps the two protocols; connectionless behaviour and no retransmission belong to UDP, not TCP.

Why B is wrong: This is tempting because both use ports, but only TCP guarantees ordered delivery, and the two protocols share the same port number range.

Why C is wrong: This is tempting due to layer confusion, but both TCP and UDP are transport layer protocols, and neither performs network layer routing.

Why D is correct: Correct: TCP uses a handshake with acknowledgements for reliable ordered delivery, whereas UDP is connectionless with less overhead and no delivery guarantee.

During a review of a design document, an analyst reads that the owner of each file decides who else may read or write it, and that a user who has been granted read access may then pass that access to a colleague. Which logical access control model does this describe?

• ADiscretionary access control, because the resource owner sets permissions and access can be delegated onwardcheck_circle Correct
• BMandatory access control, because a central authority enforces labels that users cannot change
• CRole-based access control, because permissions follow the job function rather than the individual
• DRule-based access control, because a system rule automatically evaluates each request

Why A is correct: Correct: DAC lets the owner of an object set its permissions at their discretion, and a subject holding access can typically propagate that access to others, which is the defining behaviour described.

Why B is wrong: Tempting because MAC also governs who may read a resource, but MAC forbids owners and users from granting access; the described ability of an owner to decide and of a user to pass access on contradicts MAC entirely.

Why C is wrong: Tempting since RBAC is common, but the scenario ties permissions to an owner's personal decision about a specific file, not to a job role, so RBAC does not fit.

Why D is wrong: Tempting because a rule could permit reads, but rule-based control applies uniform system rules to all subjects rather than letting an owner personally grant and delegate access.

A security architect is comparing mandatory access control with discretionary access control for a classified system. Which statement most accurately captures the essential difference between the two models?

• AUnder MAC each user is assigned a role and inherits its permissions, whereas under DAC each user is granted permissions individually by an owner
• BUnder MAC a central authority enforces access using labels that ordinary users cannot alter, whereas under DAC owners set permissions at their own discretioncheck_circle Correct
• CUnder MAC permissions are evaluated by system rules such as time of day, whereas under DAC permissions are fixed by the vendor at installation
• DUnder MAC owners may lower a file's classification to share it, whereas under DAC only administrators may change permissions

Why A is wrong: Tempting because it correctly describes DAC, but the MAC half wrongly describes role-based access control; MAC is defined by labels and clearance, not by roles.

Why B is correct: Correct: MAC binds access to system-enforced security labels beyond user control, while DAC delegates permission decisions to resource owners, which is the core distinction between the two.

Why C is wrong: Tempting because rules sound authoritative, but that describes rule-based control, and DAC permissions are set by owners after installation, not fixed by the vendor.

Why D is wrong: Tempting but reversed: MAC specifically prevents owners from altering labels, and DAC is precisely the model in which owners, not only administrators, change permissions.

A hospital assigns permissions so that anyone holding the position of ward nurse can read patient charts on their ward, and staff gain or lose those permissions automatically when they move between positions. Which access control model does this arrangement best illustrate?

• ADiscretionary access control, because each nurse's manager chooses which charts that individual may read
• BRule-based access control, because a firewall-style rule permits chart access from ward devices
• CRole-based access control, because permissions attach to the position and follow staff as they change positionscheck_circle Correct
• DMandatory access control, because clearance labels on charts decide who may read them

Why A is wrong: Tempting because managers are involved in staffing, but permissions here follow the position rather than a per-individual grant by an owner, which is not how DAC works.

Why B is wrong: Tempting since automatic enforcement is mentioned, but the access pivots on the person's job position, not on a device or condition rule applied uniformly to all traffic.

Why C is correct: Correct: RBAC groups permissions by role, so users acquire the ward nurse role's rights on assignment and lose them on reassignment, exactly matching the described behaviour.

Why D is wrong: Tempting because healthcare data is sensitive, but nothing here relies on security labels and clearances; access is driven by job position, which is the hallmark of RBAC.

A junior analyst at a logistics firm is comparing symmetric and asymmetric cryptography while planning how two servers will exchange data. Which statement most accurately captures the essential difference between the two approaches?

• ASymmetric cryptography always uses a public and private key pair, whereas asymmetric cryptography relies on a single shared secret key for both parties.
• BSymmetric cryptography can only protect data in transit across a network, whereas asymmetric cryptography can only protect data at rest on storage.
• CSymmetric cryptography uses one shared secret key for both encryption and decryption, whereas asymmetric cryptography uses a mathematically linked public and private key pair.check_circle Correct
• DSymmetric cryptography provides non-repudiation through key pairs, whereas asymmetric cryptography cannot support digital signatures.

Why A is wrong: Tempting because it uses the right vocabulary, but it reverses the two definitions, so it describes each model incorrectly.

Why B is wrong: Plausible if a learner ties each type to one data state, but both approaches can protect data in transit or at rest, so the restriction is false.

Why C is correct: Correct: symmetric schemes such as AES rely on a single shared key, while asymmetric schemes such as RSA use a related public and private key pair, which is the defining distinction.

Why D is wrong: Attractive because non-repudiation is a real property, but it is asymmetric cryptography that enables signatures and non-repudiation, so this statement is inverted.

During onboarding, a mentor explains that data exists in different states and that each state needs its own protection. A new hire asks what the term data in use specifically refers to. Which description is accurate?

• AData stored on a disk, backup tape, or other persistent medium that is not currently being processed.
• BData moving across a network between two hosts, such as a file being downloaded.
• CData that has been permanently deleted and overwritten so it can no longer be recovered.
• DData actively held in memory or being processed by an application or CPU at the present moment.check_circle Correct

Why A is wrong: This describes data at rest, a neighbouring state, so it is a tempting but incorrect label for data in use.

Why B is wrong: This defines data in transit, another distinct state, so it does not match the definition of data in use.

Why C is wrong: Sanitised or destroyed data is an end-of-life outcome, not a recognised data state, so this choice conflates disposal with active processing.

Why D is correct: Correct: data in use is information loaded into memory or being actively processed, which is why it is the hardest state to encrypt.

A records team is reviewing why they store a hash of each downloadable file alongside the file itself. Which property of a cryptographic hash function best explains how it lets recipients confirm a file has not been altered?

• AThe function produces a fixed-length digest, and any change to the input yields a substantially different digest.check_circle Correct
• BThe function is reversible, so recipients can decrypt the hash back into the original file for comparison.
• CThe function uses the recipient's public key to guarantee that only the intended reader can verify the file.
• DThe function compresses the file so the smaller copy can be checked more quickly for changes.

Why A is correct: Correct: hashing is deterministic and collision-resistant, so even a one-bit change alters the digest, letting a recipient detect tampering by recomputing and comparing.

Why B is wrong: Tempting through confusion with encryption, but hash functions are one-way and cannot be reversed to recover the input, so this is wrong.

Why C is wrong: Plausible because public keys appear in signatures, but a plain hash uses no keys, so introducing a public key misstates the mechanism.

Why D is wrong: Attractive since a digest is shorter than the file, but hashing is not compression and the original cannot be rebuilt from the digest, so integrity is not about size.

A new analyst at a logistics firm is asked to explain what a business continuity plan is fundamentally intended to achieve. Which statement best captures the core purpose of a business continuity plan?

• AIt keeps the organisation's critical business functions running, or quickly resumed, during and after a disruptive event.check_circle Correct
• BIt restores IT systems and data to a working state after a technical failure or outage.
• CIt documents how the security team will detect, contain, and eradicate an active cyber attack.
• DIt lists the hardware and software assets the organisation owns for insurance purposes.

Why A is correct: This is correct because the business continuity plan exists to sustain or rapidly restore the delivery of critical functions and services when normal operations are disrupted.

Why B is wrong: This describes disaster recovery, which focuses on technology restoration. It is tempting because DR is part of resilience planning, but the business continuity plan has a broader aim than rebuilding systems.

Why C is wrong: This describes incident response, which handles security events. It is tempting because incidents can trigger continuity plans, but detection and containment are not the plan's central goal.

Why D is wrong: An asset inventory supports several processes but is not the purpose of continuity planning. It is tempting because a plan draws on asset data, yet the plan is about maintaining operations, not cataloguing property.

During planning, a team keeps confusing the business impact analysis with the wider continuity effort. Which description most accurately states what a business impact analysis produces?

• AA ranked list of the security controls that must be purchased before the next audit cycle.
• BAn assessment of how disruptions affect each function over time, identifying critical functions and their recovery priorities.check_circle Correct
• CA signed contract with a third party that guarantees an alternate processing site.
• DA test report confirming that backups can be restored within the agreed window.

Why A is wrong: Control selection belongs to risk treatment, not the impact analysis. It is tempting because both feed resilience, but the analysis measures disruption effects rather than recommending purchases.

Why B is correct: This is correct because the business impact analysis quantifies the operational and financial effects of losing each function, then ranks them so recovery priorities and timing objectives can be set.

Why C is wrong: A reciprocal or vendor agreement is a recovery strategy output, not the analysis itself. It is tempting because sites are chosen using impact data, but the agreement is a later decision.

Why D is wrong: Restore testing validates a recovery capability after strategies exist. It is tempting because timing matters to both, yet the analysis defines requirements rather than verifying a restore.

A manager asks how planners decide which of the organisation's many activities count as critical business functions. Which characteristic best defines a critical business function?

• AAn activity that consumes the largest share of the annual departmental budget.
• BAn activity that the newest members of staff are trained to perform first.
• CAn activity whose prolonged loss would cause unacceptable harm to the organisation's mission, finances, or obligations.check_circle Correct
• DAn activity that is performed by the largest number of employees each day.

Why A is wrong: High cost does not make a function critical to continuity. It is tempting because expense signals importance, but a costly activity may be pausable while a cheap one may be essential.

Why B is wrong: Training order reflects onboarding, not continuity value. It is tempting because early training can imply importance, yet routine tasks are often taught first regardless of criticality.

Why C is correct: This is correct because criticality is judged by the severity of consequences if the function stops, which is exactly what the impact analysis evaluates over time.

Why D is wrong: Headcount does not determine criticality. It is tempting because busy functions seem vital, but a small team can run a function whose loss would halt the organisation.