(ISC)² Certified in Cybersecurity (CC) Practice Exam

What the (ISC)² Certified in Cybersecurity (CC) exam covers

• Security Principles239 questions
• Security Governance137 questions
• Identity and Access Management (IAM) Concepts212 questions
• Networking and Cloud Security Concepts236 questions
• Security Operations and Incident Response253 questions

Free CC practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,077.

1. Question 1Security Principles

   What does the CIA triad stand for in information security?

   • ACompliance, Integrity, Auditing
   • BConfidentiality, Integrity, AvailabilityCorrect
   • CControl, Identity, Access
   • DConfidentiality, Identity, Authentication
   ✓ Correct answer: B

   The CIA triad is the foundational model of information security. Confidentiality ensures that information is accessible only to those authorized to view it. Integrity ensures that data has not been altered in an unauthorized or undetected manner. Availability ensures that systems and data are accessible to authorized users when needed. Together these three properties define the core objectives that security controls are designed to protect.

   Why the other options are wrong

   • ACompliance, Integrity, Auditing is incorrect because Compliance and Auditing are governance and assurance activities, not core security properties that form the CIA triad.
   • CControl, Identity, Access is incorrect because these terms describe access management concepts, not the three foundational security properties of the triad.
   • DConfidentiality, Identity, Authentication is incorrect because Identity and Authentication are components of access control and the AAA framework, not the third pillar of the CIA triad, which is Availability.
2. Question 2Identity and Access Management (IAM) Concepts

   Which command locks (disables) the Linux account 'tempuser' so it cannot authenticate with a password?

   • Apasswd -l tempuserCorrect
   • Bid tempuser
   • Cchage -E -1 tempuser
   • Dpasswd -u tempuser
   ✓ Correct answer: A

   `passwd -l` locks a Linux account by prepending `!` to the password hash in /etc/shadow, invalidating password authentication (other methods like SSH keys may still work). This is the standard way to temporarily disable contractors, unused service accounts, or accounts under investigation without deleting them, preserving the account for later re-enablement. -u is the corresponding unlock flag. Takeaway: -l locks, -u unlocks; neither touches expiration or account attributes.

   Why the other options are wrong

   • Bid tempuser is incorrect because id only displays UID/GID and group info; it is read-only and does not affect authentication.
   • Cchage -E -1 tempuser is incorrect because -E -1 removes account expiration on many systems; it does not lock password authentication.
   • Dpasswd -u tempuser is incorrect because -u unlocks a locked account, the opposite of what is being asked.
3. Question 3Identity and Access Management (IAM) Concepts

   What does the OAuth 2.0 framework primarily provide in application integration scenarios?

   • AAutomatic assignment of IP addresses and other network configuration to client hosts as they join the network
   • BPhysical access control governing entry into a data center facility and its individually secured server rooms
   • CDelegated authorization so an app can access resources on a user's behalf without sharing the passwordCorrect
   • DEncryption of data stored at rest on server disks and on the various end-user endpoint devices in the fleet
   ✓ Correct answer: C

   OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on a service provider without revealing their credentials to that application. Instead of sharing a password, the user authorizes the application, which receives a scoped access token with defined permissions and an expiration time. This means the application never sees the user's password, the token can be revoked without changing the password, and the scope of access granted can be limited to exactly what the application needs. OAuth 2.0 is widely used to enable application integrations such as allowing a calendar app to access a user's contacts.

   Why the other options are wrong

   • AIP address assignment is handled by DHCP; OAuth governs authorization for application access, not addressing.
   • BPhysical facility entry control is unrelated to OAuth, which operates at the application authorization layer.
   • DEncrypting data at rest is a storage protection measure, not the delegated access OAuth provides.
4. Question 4Security Principles

   A security team is evaluating whether to implement a complex, multi-vendor single sign-on architecture versus a simpler in-house authentication system. Which security design principle argues in favour of choosing the simpler design?

   • ALeast common mechanism
   • BEconomy of mechanismCorrect
   • CComplete mediation
   • DOpen design
   ✓ Correct answer: B

   Economy of mechanism (also called keep it simple) is the principle that security mechanisms should be as small and simple as possible. Simpler designs have a smaller attack surface, are easier to understand, verify, and audit, and have fewer opportunities for implementation flaws.

   Why the other options are wrong

   • ALeast common mechanism recommends minimising shared resources between multiple users or processes; it is about resource isolation, not design simplicity.
   • CComplete mediation requires checking every access request against the authorisation mechanism each time; it does not address architectural complexity.
   • DOpen design holds that security should not rely on keeping the design secret; it is about transparency of mechanism, not about choosing a simpler architecture.
5. Question 5Identity and Access Management (IAM) Concepts

   A system administrator's account is configured so that the elevated administrative role can only be assumed temporarily for the duration of a specific maintenance task and then automatically reverts to standard privileges. Which concept does this implement?

   • AJust-in-time privileged accessCorrect
   • BMandatory access control
   • CSingle sign-on
   • DFederation
   ✓ Correct answer: A

   Just-in-time privileged access grants elevated rights only for the specific window a task requires, then automatically reverts the account to its normal, lower-privilege state once that window closes. This supports least privilege by removing standing admin access that sits active around the clock, shrinking the time an attacker who compromises the account could misuse elevated rights. JIT is typically implemented through privileged access management tools that log the request, approve it, apply the elevation, and revoke it automatically.

   Why the other options are wrong

   • BMandatory access control enforces fixed labels and clearances set by the system, not a temporary, task-tied elevation.
   • CSingle sign-on authenticates a user once across systems; it does not time-box how long elevated privileges last.
   • DFederation extends identity across organizations and has no role in time-limiting elevated access.
6. Question 6Identity and Access Management (IAM) Concepts

   Which statement BEST describes the relationship between accountability and identification in access control?

   • AAccountability is impossible without unique identification of each subjectCorrect
   • BIdentification by itself proves the subject's claimed identity
   • CIdentification determines which permissions a subject is granted
   • DAccountability is achieved solely by authenticating the subject
   ✓ Correct answer: A

   Unique identification ensures that logged actions can be attributed to a specific person or process, which is the foundation of accountability and non-repudiation. Without unique identifiers, audit trails cannot reliably tie an event to a responsible party.

   Why the other options are wrong

   • BIdentification only asserts an identity; proving that claim is authentication, so identification alone does not verify the subject.
   • CDeciding which permissions a subject receives is authorization, not identification, which merely establishes a unique claimed identity.
   • DAuthentication verifies identity, but accountability also depends on unique identification and audit logging, so it is not achieved by authentication alone.
7. Question 7Security Principles

   A document spells out the exact, ordered steps a help desk technician must take to reset a locked user account. Which governance document type is this?

   • AProcedureCorrect
   • BPolicy
   • CGuideline
   • DRegulation
   ✓ Correct answer: A

   A procedure lays out the exact, ordered steps needed to complete a task so it is performed the same way every time regardless of who does it. That consistency is the point: it reduces mistakes, supports training of new staff, and makes the work auditable afterward. The ordered account-reset steps for the help desk are a textbook procedure.

   Why the other options are wrong

   • BA policy states high-level intent, not the specific steps to perform a task.
   • CA guideline offers optional advice, not mandatory ordered steps.
   • DA regulation is an externally imposed legal requirement, not an internal task instruction.
8. Question 8Identity and Access Management (IAM) ConceptsSelect all that apply

   Which TWO of the following are categories of authentication factors? (Choose two.)

   • ASomething you knowCorrect
   • BSomething you areCorrect
   • CSomething you log
   • DSomething you authorize
   ✓ Correct answer: A, B

   Authentication factors are grouped into something you know (like a password), something you have (like a token), and something you are (like a fingerprint). Of the choices given, something you know and something you are are valid categories.

   Why the other options are wrong

   • CSomething you log is not an authentication factor category; logging relates to accounting.
   • DSomething you authorize is not a factor category; authorization is a separate step in the access process.
9. Question 9Security GovernanceSelect all that apply

   Which TWO practices help an employee work securely from a coffee shop or other public location? (Choose two.)

   • AConnect through the company VPN before accessing internal resourcesCorrect
   • BUse a privacy screen and stay aware of who can see the displayCorrect
   • CJoin any open Wi-Fi network labeled 'Free Public Wi-Fi' to save mobile data
   • DLeave the laptop unlocked at the table when stepping away briefly
   ✓ Correct answer: A, B

   On public networks a VPN encrypts traffic so it cannot be read on the shared Wi-Fi, and a privacy screen plus situational awareness prevents shoulder surfing of sensitive information. Both are simple, effective safeguards for working in public.

   Why the other options are wrong

   • CUntrusted open networks can be attacker-run and expose traffic to interception.
   • DAn unlocked, unattended laptop invites theft and hands-on access to company data.
10. Question 10Identity and Access Management (IAM) Concepts

    A hospital wants access decisions to depend on a combination of the user's department, the patient's assigned care team, and the time of day. Which access control model best fits this need?

    • ADiscretionary Access Control (DAC)
    • BMandatory Access Control (MAC)
    • CAttribute-Based Access Control (ABAC)Correct
    • DRole-Based Access Control (RBAC)
    ✓ Correct answer: C

    Attribute-Based Access Control evaluates policies made of attributes about the user, the resource, and the environment, such as department, care-team membership, and time of day. This lets access adapt to context in ways a fixed role cannot. Because the hospital needs several conditions combined into each decision, ABAC is the most fitting model.

    Why the other options are wrong

    • ADAC relies on resource owners granting access and cannot easily combine multiple context attributes.
    • BMAC uses fixed classification labels and clearances, not flexible multi-attribute policies.
    • DRBAC grants access by a single role and does not weigh time or patient-specific attributes.

Who this (ISC)² Certified in Cybersecurity (CC) practice exam is for

This practice set is for anyone preparing for the (ISC)² Certified in Cybersecurity (CC) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this (ISC)² Certified in Cybersecurity (CC) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real (ISC)² Certified in Cybersecurity (CC) exam.

Related Security resources

• (ISC)² Certified in Cybersecurity (CC) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• (ISC)² CGRC (Governance, Risk and Compliance) practice examRelated
• (ISC)² CISSP practice examRelated
• (ISC)² CSSLP practice examRelated

(ISC)² Certified in Cybersecurity (CC) practice exam FAQ