(ISC)² Certified in Cybersecurity (CC) Practice Exam

What the (ISC)² Certified in Cybersecurity (CC) exam covers

• Security Principles241 questions
• Business Continuity, Disaster Recovery, and Incident Response Concepts121 questions
• Access Controls Concepts205 questions
• Network Security224 questions
• Security Operations194 questions

Free (ISC)² Certified in Cybersecurity (CC) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 985.

1. Question 1Security Principles

   What does the CIA triad stand for in information security?

   • ACompliance, Integrity, Auditing
   • BConfidentiality, Integrity, AvailabilityCorrect
   • CControl, Identity, Access
   • DConfidentiality, Identity, Authentication
   ✓ Correct answer: B

   The CIA triad is the foundational model of information security. Confidentiality ensures that information is accessible only to those authorized to view it. Integrity ensures that data has not been altered in an unauthorized or undetected manner. Availability ensures that systems and data are accessible to authorized users when needed. Together these three properties define the core objectives that security controls are designed to protect.

   Why the other options are wrong

   • ACompliance, Integrity, Auditing is incorrect because Compliance and Auditing are governance and assurance activities, not core security properties that form the CIA triad.
   • CControl, Identity, Access is incorrect because these terms describe access management concepts, not the three foundational security properties of the triad.
   • DConfidentiality, Identity, Authentication is incorrect because Identity and Authentication are components of access control and the AAA framework, not the third pillar of the CIA triad, which is Availability.
2. Question 2Security OperationsSelect all that apply

   Which TWO Linux commands help review who has logged in and recent authentication activity? (Choose TWO)

   • Amkfs.ext4 /dev/sda1
   • BlastCorrect
   • ClastbCorrect
   • Dtar -xzf logs.tgz
   ✓ Correct answer: B, C

   The `last` command reads from /var/log/wtmp and displays a history of successful user logins and logouts, including usernames, terminal/TTY, source IP address, and session duration. The `lastb` command reads from /var/log/btmp and displays a history of failed login attempts, providing visibility into brute-force attacks, credential stuffing, or unauthorized access attempts. Together these commands provide a quick and effective way to review authentication activity without requiring access to a SIEM or log aggregation system, making them essential tools for Linux security administration and incident response.

   Why the other options are wrong

   • Amkfs.ext4 /dev/sda1 is incorrect because `mkfs.ext4` formats a disk partition with the ext4 filesystem; it is a destructive disk preparation command used when setting up storage, not a tool for reviewing authentication or login activity.
   • Dtar -xzf logs.tgz is incorrect because `tar -xzf` extracts files from a compressed tar archive; while it might be used to unpack archived log files for review, it is a file extraction utility and does not itself display login or authentication history information.
3. Question 3Network Security

   What is the purpose of placing a network tap or SPAN/mirror port in a monitored network?

   • ATo physically anchor and secure the server rack against theft or tampering
   • BTo copy traffic to a monitoring or IDS sensor without interrupting the live flowCorrect
   • CTo apply persistent encryption to all traffic passing over the wire
   • DTo hand out IP addresses to new hosts as they join the segment
   ✓ Correct answer: B

   A network tap is a passive hardware device inserted into a network link that creates an exact copy of all traffic and sends it to a monitoring port, while the original traffic continues unaffected through the live link. A SPAN (Switched Port Analyzer) or mirror port is a switch feature that copies traffic from one or more ports or VLANs to a designated monitoring port. Both methods allow security tools-such as IDS sensors, protocol analyzers, or packet capture systems-to receive a full copy of network traffic for analysis without introducing latency or creating a single point of failure in the production network.

   Why the other options are wrong

   • AA tap or SPAN port copies traffic for monitoring; it provides no physical rack security.
   • CA monitoring tap passively copies traffic and does not encrypt it.
   • DIP assignment is a DHCP function, unrelated to a monitoring tap or SPAN port.
4. Question 4Security Operations

   Which statement about regulatory compliance and security is most accurate?

   • AAn organization that is compliant is automatically immune to all breaches
   • BRecognized security frameworks explicitly forbid compliance requirements
   • CCompliance and security are entirely unrelated to one another
   • DCompliance establishes a minimum baseline, but being compliant does not guarantee an organization is secureCorrect
   ✓ Correct answer: D

   Frameworks like PCI DSS, HIPAA, and SOX define minimum required controls for given data and industry risks, and achieving compliance shows those minimums were met at assessment time. But compliance is backward-looking - it codifies known risks and best practices and cannot anticipate every novel attack or threat actor. A compliant organization can still carry unaddressed risks, emerging vulnerabilities, or gaps outside the framework's scope.

   Why the other options are wrong

   • ACompliance sets a baseline but cannot make an organization immune to breaches.
   • BFrameworks support and align with compliance requirements rather than forbidding them.
   • CCompliance and security are closely related, with compliance setting a minimum bar.
5. Question 5Network Security

   An IDS signature library is updated monthly, but attackers use a zero-day exploit with no existing signature. Which detection method could still identify the attack based on unusual behavior patterns?

   • ASignature-based detection
   • BAnomaly-based (behavioral) detectionCorrect
   • CProtocol decode analysis
   • DBlacklist-based URL filtering
   ✓ Correct answer: B

   Anomaly-based IDS/IPS establishes a baseline of normal network or host behavior, then alerts when traffic deviates significantly from that baseline - for example, an unusual spike in DNS queries, atypical outbound data volumes, or a host communicating on unexpected ports. Because it does not rely on known attack signatures, it can detect novel or zero-day exploits at the cost of a higher false-positive rate compared to signature-based systems.

   Why the other options are wrong

   • ASignature-based detection matches traffic against a library of known attack patterns; by definition it cannot detect a zero-day exploit for which no signature exists.
   • CProtocol decode analysis verifies that traffic conforms to expected protocol structure and can catch malformed packets, but it still relies on known expected behavior rather than detecting entirely new attack patterns.
   • DBlacklist-based URL filtering blocks access to known malicious domains or URLs; it depends on the attacker's infrastructure being listed, which would not be the case for a brand-new zero-day campaign.
6. Question 6Business Continuity, Disaster Recovery, and Incident Response Concepts

   A company keeps three copies of its data, on two different media types, with one copy stored offsite. Which widely recommended backup principle does this describe?

   • AThe 3-2-1 backup ruleCorrect
   • BThe grandfather-father-son rotation
   • CThe principle of least privilege
   • DThe defense-in-depth model
   ✓ Correct answer: A

   The 3-2-1 rule recommends keeping at least three copies of data, on two different storage media, with one copy located offsite. This protects against media failure, local disasters, and single-location loss. It is a foundational guideline for backup resilience.

   Why the other options are wrong

   • BGrandfather-father-son is a media rotation scheme for backup retention cycles, not the 3-2-1 copy distribution.
   • CLeast privilege is an access-control concept, unrelated to backup copy counts.
   • DDefense in depth is a layered-security strategy, not a backup copy rule.
7. Question 7Security Operations

   An organization wants to ensure a recovered file is byte-for-byte identical to the original after a restore. Which technique best provides this assurance?

   • AComparing the cryptographic hash of the original and the restored fileCorrect
   • BEncrypting both copies with the same symmetric key and comparing the ciphertext
   • CComparing the file creation and modification timestamps on both copies
   • DComparing the reported file sizes in bytes for the original and the restore
   ✓ Correct answer: A

   A cryptographic hash function produces a fixed-length digest that changes if even a single bit differs. If the hash of the original equals the hash of the restored copy, the files are byte-for-byte identical, confirming integrity.

   Why the other options are wrong

   • BEncrypting both copies does not prove they were identical beforehand and adds no assurance about byte-for-byte equality after restore.
   • CMatching timestamps only shows when files were created or changed and can agree even when the file contents differ.
   • DTwo files can share the same byte count yet differ internally, so a size comparison cannot confirm they are identical.
8. Question 8Business Continuity, Disaster Recovery, and Incident Response Concepts

   Immediately after confirming malware on a server, responders isolate it from the network to stop the infection from spreading. Which step is this?

   • AContainmentCorrect
   • BEradication
   • CRecovery
   • DLessons learned
   ✓ Correct answer: A

   Isolating an infected host stops the threat from reaching other systems and buys time to investigate. Containment comes before removing the threat and restoring service.

   Why the other options are wrong

   • BEradication is removing the malware and root cause, which follows containment.
   • CRecovery is restoring systems to normal operation after the threat is removed.
   • DLessons learned is a post-incident review step, not an immediate containment action.
9. Question 9Network Security

   An attacker secretly positions themselves between a user and a banking website so they can read and alter the messages passing between them. What kind of attack is this?

   • AOn-path (man-in-the-middle) attackCorrect
   • BDenial-of-service attack
   • CBrute-force password attack
   • DRansomware infection
   ✓ Correct answer: A

   In an on-path attack the attacker sits between the two communicating endpoints and relays or modifies traffic, so each side believes it is talking directly to the other. This lets the attacker eavesdrop on or tamper with the data in transit.

   Why the other options are wrong

   • BA denial-of-service attack tries to make a service unavailable, not to silently intercept traffic.
   • CA brute-force attack guesses passwords repeatedly; it does not sit between two parties relaying traffic.
   • DRansomware encrypts files for extortion; it is not about intercepting communications in transit.
10. Question 10Security Principles

    A small team must assess many risks quickly and lacks precise financial data, so they rate each risk's likelihood and impact as low, medium, or high on a rating scale. Which type of risk analysis is this?

    • AQuantitative analysis
    • BRoot cause analysis
    • CActuarial analysis
    • DQualitative analysisCorrect
    ✓ Correct answer: D

    Qualitative risk analysis uses subjective, descriptive ratings such as low, medium, and high rather than exact monetary figures. It is faster and works well when precise data is scarce, though it is less objective. Quantitative analysis, by contrast, assigns numeric values like SLE and ALE to express risk in financial terms.

    Why the other options are wrong

    • AQuantitative analysis uses numeric monetary values and formulas, which the team is not applying here.
    • BRoot cause analysis investigates why an incident occurred and is not a method for rating risk severity.
    • CActuarial analysis relies on statistical loss data typical of insurance modeling, not simple descriptive scales.

Related Security resources

• (ISC)² Certified in Cybersecurity (CC) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• CompTIA Security+ SY0-701 practice examRelated
• CompTIA PenTest+ (PT0-003) practice examRelated

(ISC)² Certified in Cybersecurity (CC) practice exam FAQ