ISC2 CC Practice Exam

• A. Integrity
• B. Availability
• C. Non-repudiation
• D. Confidentiality Correct answer

Option D, Confidentiality, is correct because an employee with no business need viewing payroll records is unauthorized disclosure of information. Integrity concerns unauthorized changes, Availability concerns access to systems, and Non-repudiation concerns proof of who performed an action.

• A. Role-based access
• B. Multi-factor authentication Correct answer
• C. Federated identity
• D. Single sign-on

Option B, Multi-factor authentication, is correct because it combines two different factor types: something you know (a password) and something you have (a hardware token). Role-based access is an authorization model, and federated identity and single sign-on concern reusing one login across systems.

• A. Availability
• B. Authorization
• C. Non-repudiation Correct answer
• D. Integrity

Option C, Non-repudiation, is correct because a digital signature ties the message to the signer, so the sender cannot credibly deny sending it. Availability, Authorization and Integrity do not provide proof of origin that defeats a denial.

• A. Asset
• B. Risk Correct answer
• C. Threat
• D. Vulnerability

Option B, Risk, is correct because risk is the potential for loss when a threat exploits a vulnerability. An asset is what is protected, a threat is the potential cause of harm, and a vulnerability is the weakness being exploited.

• A. It offers optional advice on good practice
• B. It states management's intent for protecting information Correct answer
• C. It lists the ordered steps for completing a task
• D. It sets minimum technical baselines for systems

Option B is correct because a policy is a high-level statement of management's intent and direction for protecting information. Option A describes a guideline, option C a procedure, and option D a standard.

• A. Policy
• B. Procedure Correct answer
• C. Standard
• D. Guideline

Option B is correct because a procedure gives the ordered, step-by-step instructions for performing a routine task. A policy states intent, a standard sets mandatory requirements, and a guideline offers optional advice.

• A. A voluntary internal guideline
• B. A government agency regulation
• C. A criminal statute
• D. A contractual industry standard Correct answer

Option D is correct because card-brand rules (such as PCI DSS) are an industry standard that binds the retailer through its payment processor contract. They are not a government regulation or criminal statute, and they are not voluntary.

• A. Risk Correct answer
• B. Vulnerability
• C. Control
• D. Threat

Option A is correct because risk is the combination of the likelihood that a threat exploits a vulnerability and the resulting impact. A threat, a vulnerability and a control are each only one element of, or a response to, that relationship.

• A. Provisioning Correct answer
• B. Access recertification
• C. Deprovisioning
• D. Credential rotation

Option A is correct because creating the account and assigning starting access after HR confirms a hire is provisioning, the first stage of the identity life cycle. Access recertification reviews existing access, deprovisioning removes it, and credential rotation changes secrets.

• A. Hand it to the manager for the replacement hire
• B. Reduce it to read-only access to the team's files
• C. Disable it and remove its access Correct answer
• D. Keep it active until the next access review

Option C is correct because a leaver's account should be disabled and its access removed promptly, by the end of the last working day. Handing it to a manager, keeping read-only access, or waiting for the next review all leave a live account for someone no longer employed.

• A. Privilege creep Correct answer
• B. Role explosion
• C. Privilege escalation
• D. Access aggregation

Option A is correct because accumulating permissions from earlier roles as someone changes jobs is privilege creep. Role explosion is too many roles, privilege escalation is gaining higher rights than granted, and access aggregation is combining access across systems.

• A. Remove idle accounts during the annual review
• B. Cut the account's permissions a little each month
• C. Set an expiration date when the account is created Correct answer
• D. Ask the contractor to report when the work is finished

Option C is correct because setting an expiration date at account creation makes access stop automatically on the known end date. Annual reviews, gradual permission cuts, or relying on the contractor to report in are late, partial or unreliable.

• A. Network Correct answer
• B. Session
• C. Transport
• D. Data Link

Option A is correct because the Network layer (Layer 3) handles logical IP addressing and routes packets between networks. Session manages dialogs between applications, Transport provides end-to-end delivery with ports, and Data Link moves frames within a single local segment using MAC addresses.

• A. DNS over TCP 53
• B. HTTP on TCP 8080
• C. HTTPS on TCP 443 Correct answer
• D. SSH on TCP 22

Option C is correct because HTTPS, which is HTTP carried over TLS, uses TCP port 443 by default. DNS uses port 53, plain HTTP alternates such as 8080 carry no TLS by default, and SSH on port 22 is a remote administration protocol, not web browsing.

• A. Credential stuffing
• B. On-path attack Correct answer
• C. Denial of service
• D. Cross-site scripting

Option B is correct because an on-path attack (formerly man-in-the-middle) places the attacker between two parties so they can relay and read traffic each side believes is private. Credential stuffing reuses leaked passwords, denial of service exhausts availability, and cross-site scripting injects script into web pages.

• A. Network intrusion detection system Correct answer
• B. Network intrusion prevention system
• C. Stateful firewall
• D. Reverse proxy

Option A is correct because a network intrusion detection system monitors traffic and alerts on known attack signatures without blocking it. An intrusion prevention system sits inline and can block, a stateful firewall enforces connection-based rules, and a reverse proxy fronts servers rather than alerting on attack patterns.

• A. Recording which team wrote the document
• B. Defining how the data must be handled Correct answer
• C. Showing when the document was last reviewed
• D. Naming the encryption used on the file

Option B is correct because classification labels such as Public, Internal, Confidential and Restricted tell staff and systems how the data must be handled, stored, shared and protected. The other options describe authorship, review dates or encryption details, which are not what a classification label conveys.

• A. Perform a quick format of each tape
• B. Degauss or physically shred the tapes Correct answer
• C. Move the tapes to a locked storage room
• D. Delete the files and empty the recycle bin

Option B is correct because degaussing or physically shredding magnetic tapes destroys the data so it cannot be recovered. A quick format and deleting files leave recoverable data, and moving the tapes to a locked room only protects them physically without sanitizing anything.

• A. Full-disk encryption Correct answer
• B. A host-based firewall
• C. Transport Layer Security for web traffic
• D. Multifactor authentication on the VPN

Option A is correct because full-disk encryption keeps the contents of a stolen laptop unreadable without the key. A host firewall and TLS protect network traffic, and MFA on the VPN protects remote access, none of which stop someone reading the disk directly.

• A. Data minimization of stored records
• B. Meeting the required retention period Correct answer
• C. Data sanitization of expired records
• D. Data classification of financial records

Option B is correct because the regulation sets a seven-year retention period and purging at three years fails to meet it. Minimization, sanitization and classification are different data-handling concepts and do not describe keeping records for a mandated length of time.