Free ISC2 CC Practice Test & Questions

Q1.An organization experiences a ransomware attack that encrypts all file servers. The security team isolates affected systems and begins recovery from clean backups. Meanwhile, management activates a plan that allows employees to access critical documents from a cloud-based backup service to maintain client deliverables. The plan that allows continued client deliverables is BEST described as part of the:

• A.Disaster recovery plan
• B.Business continuity plan
• C.Incident response plan
• D.Risk management plan

Domain: Security Governance

Q2.A new helpdesk technician joins the IT department. Rather than manually configuring permissions for each system, the administrator assigns the technician to the 'Helpdesk Technician' role, which automatically grants access to the ticketing system, password reset tools, and account unlock functions. When the technician later transfers to the Network Operations team, the administrator removes them from the Helpdesk role and adds them to the Network Operations role. This process demonstrates a key advantage of RBAC, which is:

• A.Preventing all insider threats through mandatory classification labels
• B.Simplifying provisioning and role transitions through role assignment and removal
• C.Allowing individual resource owners to share access at their own discretion
• D.Evaluating multiple contextual attributes and conditions before granting access

Domain: Identity and Access Management (IAM) Concepts

Q3.A manufacturing company identifies a critical vulnerability in its production control system. The vendor will not release a patch for three months. Management decides to implement compensating controls to reduce the risk while also purchasing insurance to cover potential losses. Which risk treatment options are being applied? (Select ALL that apply.)

• A.Risk acceptance
• B.Risk mitigation
• C.Risk transfer
• D.Risk avoidance

Domain: Security Principles

Q4.A development team performs threat modeling on a new web application and identifies that an unauthenticated user could potentially escalate their access to administrator level through a flaw in the session management design. This finding was identified BEFORE any code was written. What is the PRIMARY benefit of discovering this threat at this stage?

• A.It eliminates the need for any penetration testing once the application has been deployed
• B.It allows the design to be corrected before code is written, which costs far less than fixing later
• C.It proves the application is secure by design, so no further security testing will be needed
• D.It satisfies every regulatory compliance requirement that will apply to the finished application code

Domain: Security Operations and Incident Response

Q5.An organization migrates its database to an IaaS cloud environment but fails to apply operating system patches, assuming the cloud provider handles all security. After a breach exploiting an unpatched OS vulnerability, who bears primary responsibility for this failure?

• A.The cloud provider, because they host the infrastructure
• B.The customer, because OS patching is a customer responsibility in IaaS
• C.Both equally, because security is always a shared responsibility
• D.Neither, because the vulnerability was in the OS vendor's code

Domain: Networking and Cloud Security Concepts

Q6.The CISO reports to the CEO and presents security strategy to the board of directors. A cross-functional committee including representatives from IT, legal, finance, and HR meets quarterly to review security priorities. What governance roles do these describe?

• A.Chief Information Security Officer
• B.Security steering committee
• C.Incident response team
• D.Security operations center

Domain: Security Governance

Q7.A user in the RBAC 'Auditor' role has been given temporary access to the 'System Administrator' role to assist with a project. At the end of the project, the System Administrator role is not removed. What principle is violated when this combined access allows the auditor to both configure systems and audit those same configurations?

• A.Principle of Least Privilege
• B.Separation of Duties
• C.Need-to-know principle
• D.Defense in depth

Domain: Identity and Access Management (IAM) Concepts

Q8.An organization has a general willingness to accept moderate cybersecurity risk. However, for any risk involving customer payment card data, the organization has stated that no data breaches are acceptable and all vulnerabilities must be remediated within 24 hours. The 24-hour remediation requirement for payment card data represents the organization's:

• A.Risk appetite
• B.Risk tolerance
• C.Risk avoidance
• D.Risk transfer

Domain: Security Principles

Q9.A security team blocks malicious email attachments at the gateway to prevent a threat actor from reaching users. They also monitor outbound DNS traffic for C2 indicators and conduct regular phishing simulations. Which Cyber Kill Chain stages are these defenses designed to disrupt? (Select TWO)

• A.Reconnaissance
• B.Delivery
• C.Installation
• D.Command and Control

Domain: Security Operations and Incident Response

Q10.A company divides its internal network so that workstations are separated from servers, finance systems are isolated from general workstations, and backup systems are on their own segment with no inbound connections from workstations. What network security concept does this implement?

• A.Defense in depth
• B.Network segmentation
• C.Zero trust architecture
• D.Encryption at rest

Domain: Networking and Cloud Security Concepts