Skip to main content
All Quizzes

ISC² CC Certified in Cybersecurity — Full Study Guide

Complete Q&A for the ISC² CC (Certified in Cybersecurity) exam. Covers risk management, access control, network security, incident response, cryptography, and more — 600 questions.

Q 600 questions·ISC² CC Cert Guide
C) SLR (Service-Level Requirements)
Risk Assessment
Threats
Threat Vectors
Risks
Likelihood and impact
Qualitative Risk Assessment
Quantitative Risk Assessment
Risk Treatment
Risk Avoidance
Risk Mitigation
Risk Profile
Inherent Risk
Residual Risk
Risk Tolerance
Security Controls
Preventive Control
Detective Control
Recovery Control
Preventative
Detective
Recovery
Technical Controls
Administrative Controls
Physical Controls
Configuration Management
Baselines (track changes)
Versioning
Diagrams
Change and Configuration Management
Risk Transference
Likelihood and Impact
Baselining
Preventive
Internal
Policies, Standards, Guidelines, Procedures
Policies (mandatory and approved at the highest level of an organization)
Standards (mandatory)
Guidelines (recommendations/advice and compliance is not mandatory)
Procedures (not mandatory)
Acceptable Use Policies (AUP)
Data Handling Policies
Password Policies
Bring Your Own Device (BYOD) Policies
Privacy Policies
Change Management Policies
Guidelines
GDPR
BYOD Policy
Business Continuity Planning (BCP)
Continuity of Operations Planning (COOP)
(This is a statement, not a question. The answer is implied by the statement itself.)
Business Impact Assessment
Collaboration
Redundancy
Single Point of Failure Analysis
SPOF Analysis
High Availability
Fault Tolerance
Load Balancing
Power Supply, Storage Media, Networking
1
5 (uses 3 or more disks to store data)
Availability
3
High Availability
Incident Response Plan
Incident Response Plans
Prior Planning
Statement of Purpose, Strategies and goals for incident response, Approach to incident response, Communication with other groups, Senior leadership approval
NIST SP 800-61
24/7
Monitoring
Security Incident and Event Management (SIEM)
Isolation
Containing the damage
False
Disaster Recovery
Contain the Damage, Recover normal operations
Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Recovery Service Level (RSL)
Backups
Tape backups, Disk-to-disk backups, Cloud backups
Full Backups
Snapshots and Images
Differential Backups
Incremental Backups
Sunday's FULL backup (To establish a base), Thursday's differential backup (To grab the latest data change)
Sunday's FULL backup (To establish a base), Monday, Tuesday, Wednesday, and Thursday incremental backups
Disaster Recovery Sites
Hot Site, Cold Site, Warm Site
Hot Site
Cold Site
Warm Site
Offsite Storage
Validate that the plan functions correctly, Identify necessary plan updates
Read-through, Walk-through, Simulation, Parallel Test, Full interruption test
Read-throughs
Walk-throughs (aka Tabletop exercise)
Simulations
Parallel tests
Full Interruption tests
Incremental
RTO
Parallel
Hot site
D) Anyone
B) Inform (ISC)²
A) Non-repudiation
B) Threat
D) Technical
B) Stop participating in the group
D) Law
C) Standard
C) Inform Triffid management
A) Administrative
C) Mitigation
B) Procedure
B) Policy, standard
B) Explain the style and format of the questions, but no detail
C) A laptop with sensitive data on it
B) Pay the parking ticket
D) A photograph of your face
D) Medical systems that monitor patient condition in an intensive care unit
B) Asset
A) Administrative
B) Return to normal, full operations
B) False
A) Intrusion
D) Preserve health and human safety
A) The danger posed by the disaster might still be present
B) Reduce the impact of incidents on operations
C) When senior management decides
B) Stored
C) Defense in depth
A) MAC (mandatory access control)
D) Least privilege
D) Firewall
People
To provide guidance and direction for the organization's security program.
To plan, implement, and manage an organization's security program.
A process of identifying, quantifying, and prioritizing security weaknesses in an organization's systems, applications, and networks.
A vulnerability assessment is a non-intrusive evaluation of an organization's security posture, while a penetration test is an intrusive evaluation that attempts to exploit identified vulnerabilities.
Confidentiality, Integrity, and Availability.
Confidentiality refers to the protection of sensitive information from unauthorized access, while privacy refers to an individual's right to control their personal information.
The principle that users and processes should only be given the minimum level of access necessary to perform their duties.
A network security device that monitors and controls incoming and outgoing traffic based on a set of rules.
A demilitarized zone, a network segment that is isolated from the internal network and is used to host servers that are accessible from the internet.
The process of converting plain text into an unreadable format to protect the confidentiality of the data.
An electronic method of verifying the authenticity and integrity of a message or document.
An organization that issues digital certificates that can be used to verify the identity of individuals, systems, or organizations.
A protocol that provides secure communication over the internet by encrypting data between web servers and web browsers.
A technology that creates a secure and encrypted connection between two networks over the internet.
A security mechanism that requires users to provide more than one form of authentication, such as a password and a fingerprint, to gain access to a system.
An attack that attempts to make a server, network, or website unavailable by overwhelming it with traffic or requests.
The use of deception to manipulate individuals into divulging confidential information or performing actions that may not be in their best interest.
A software that is designed to cause harm or damage to a computer system, network, or data.
An attack that attempts to trick individuals into revealing sensitive information, such as passwords or credit card numbers, by posing as a trustworthy entity.
An attack that intercepts communication between two parties to eavesdrop or modify the data being exchanged.
A software that is designed to hide its presence on a system, allowing an attacker to gain unauthorized access and control.
A decoy system that is designed to attract and detect unauthorized access attempts.
An event that could potentially threaten the confidentiality, integrity, or availability of an organization's information or systems.
A vulnerability is a weakness in a system that can be exploited by an attacker, while a risk is the likelihood and potential impact of a vulnerability being exploited.
A measure or mechanism that is implemented to reduce or mitigate a security risk.
A security control is a general term that refers to any measure or mechanism used to reduce risk, while a security countermeasure specifically refers to a measure that is implemented in response to a known threat.
The principle of implementing multiple layers of security controls to protect an organization's systems and data.
A documented plan that outlines the steps to be taken in the event of a security incident.
A systematic evaluation of an organization's security controls and practices to ensure they are in compliance with industry standards and regulations.
A process of identifying, analyzing, and evaluating risks to an organization's systems and data.
A vulnerability scan is a non-intrusive evaluation of an organization's systems and networks, while a penetration test is an intrusive evaluation that attempts to exploit identified vulnerabilities.
A set of minimum security requirements that must be met by an organization's systems and networks.
Symmetric encryption uses the same key for both encryption and decryption, while asymmetric encryption uses a public key for encryption and a private key for decryption.
A set of rules that determines which users or systems are allowed to access or interact with a particular resource.
A system that collects and analyzes security events and alerts to detect and respond to security threats.
A system that monitors and prevents the unauthorized transmission of sensitive data outside of an organization's network.
A policy that allows employees to use their personal devices for work purposes, with certain security requirements and restrictions.
A program that educates employees on security best practices and potential threats to reduce the likelihood of security incidents.
A set of coding techniques and best practices that are designed to reduce the likelihood of security vulnerabilities in software.
A vulnerability disclosure program is a formal process for reporting and addressing security vulnerabilities, while a bug bounty program is a program that rewards individuals for reporting vulnerabilities.
A level of authorization granted to an individual that allows them access to sensitive or classified information.
A process for developing software that integrates security into every stage of the development process.
An individual or group that initiates a security threat, such as an attacker or hacker.
A vulnerability that is unknown to the software vendor and for which no patch or fix has been released.
A team responsible for responding to security incidents and managing the organization's incident response plan.
A security event is any observable occurrence that has the potential to affect the security of an organization's systems or data, while a security incident is an event that has been confirmed as a security breach or compromise.
A physical or digital device that is used to authenticate a user's identity for access to a system or application.
A network that allows organizations to share security information and threat intelligence.
The overall level of security of an organization's systems, data, and operations.
A specific goal or requirement that a security control is designed to achieve.
A structured approach to identifying, analyzing, and mitigating risks to an organization's systems and data.
A documented plan that outlines the steps to be taken to maintain critical business operations in the event of a disruption or disaster.
A documented plan that outlines the steps to be taken to restore systems and data after a disruption or disaster.
A document that summarizes the details of a security incident, including the cause, impact, and response.
A document that summarizes the findings of a security risk assessment, including identified vulnerabilities and recommended security controls.
A centralized team responsible for monitoring and responding to security incidents and events.
An investigation into an individual's background, character, and loyalty to determine their eligibility for a security clearance.
A standardized configuration for an organization's systems and applications that meets minimum security requirements.
A documented plan that outlines the specific steps to be taken in response to different types of security incidents.
A system used to generate, distribute, and manage encryption keys.
A framework that outlines the policies, procedures, and processes for managing an organization's security program.
A protocol used to exchange encryption keys securely between two parties.
A standard format for exchanging security information and threat intelligence.
A standardized approach to assessing and managing security vulnerabilities and configurations.
A system that collects, analyzes, and reports on security events and incidents.
A system that analyzes security events from multiple sources to identify potential security threats.
A system that manages user access to an organization's systems and data.
A log of security events and actions that can be used to track and investigate security incidents.
A process for reviewing and approving exceptions to an organization's security policies and procedures.
A plan that outlines how communication will be handled during a security incident, including who will be notified, what information will be shared, and how communication will be managed.
A program that identifies, prioritizes, and addresses security vulnerabilities in an organization's systems and applications.
A law that requires organizations to notify individuals of a security breach that may have compromised their personal information.
A service that issues and manages security tokens used for authentication and authorization.
A database or storage system that contains security-related information and documentation.
A process for managing security incidents from identification through resolution and reporting.
An assessment of an organization's overall security posture, including strengths, weaknesses, and areas for improvement.
A rule that specifies criteria for correlating security events and alerts to detect and respond to security threats.
A graphical display that provides a real-time view of an organization's security events and alerts.
A tool that scans an organization's systems and networks for vulnerabilities.
A feed of information about security threats, vulnerabilities, and attacks that can be used to inform an organization's security program.
A framework that provides guidelines and standards for conducting security assessments.
A system for categorizing information based on its sensitivity and confidentiality requirements.
A framework that provides guidelines and standards for designing and implementing a secure architecture for an organization's systems and applications.
An assessment of an organization's security controls to determine their effectiveness and compliance with industry standards and regulations.
A program that manages the process of identifying, testing, and deploying security patches to address vulnerabilities in an organization's systems and applications.
A classification system used to categorize security incidents based on their potential impact and severity.
A process for requesting exceptions to an organization's security policies and procedures.
A tool used to analyze logs of security events and actions to identify potential security threats.
An attack that uses a vulnerability in an organization's systems or applications to gain unauthorized access or control.
The process of testing an organization's security incident response plan to ensure it is effective and efficient.
A policy that specifies how long security event logs and data should be retained.
An engine that analyzes security events and alerts to detect and respond to security threats.
The process of testing and verifying the effectiveness of an organization's security controls.
The process of testing an organization's security incident response playbook to ensure it is effective and efficient.
A model that provides a framework for assessing an organization's security maturity and identifying areas for improvement.
The collective beliefs, attitudes, and behaviors of an organization's employees towards security.
A committee responsible for overseeing an organization's security program and ensuring it aligns with business objectives.
A plan that outlines the steps to be taken to identify, assess, and mitigate security risks to an organization's systems and data.
The process of developing, implementing, reviewing, and updating an organization's security policies and procedures.
Application Server
Asymmetric Encryption
Checksum
Ciphertext
Classification
Configuration management
Cryptanalyst
Cryptography
Data Loss Prevention (DLP)
Decryption
Degaussing
Digital Signature
Egress Monitoring
Encryption
Encryption System
Hardening
Hash Function
Hashing
Information Sharing
Ingress Monitoring
Message Digest
Operating System
Patch
Patch Management
Plaintext
Records
Records Retention
Remanence
Request for change (RFC)
Security Governance
Social engineering
Symmetric encryption
Web Server
Whaling Attack
Application programming interface (API)
Bit
Broadcast
Byte
Cloud computing
Community cloud
De-encapsulation
Denial-of-Service (DoS)
Domain Name Service (DNS)
Encapsulation
Encryption
File Transfer Protocol (FTP)
Fragment attack
Hardware
Hybrid cloud
Infrastructure as a Service (IaaS)
Internet Control Message Protocol (ICMP)
Internet Protocol (IPv4)
Man-in-the-Middle
Microsegmentation
Oversized Packet Attack
Packet
Payload
Payment Card Industry Data Security Standard (PCI DSS)
Platform as a Service (PaaS)
Private cloud
Protocols
Public cloud
Simple Mail Transport Protocol (SMTP)
Software
Software as a Service (SaaS)
Spoofing
Transport Control Protocol/Internet Protocol (TCP/IP) Model
VLAN
VPN
WLAN
Zenmap
Zero Trust
Audit
Crime Prevention through Environmental Design (CPTED)
Defense in Depth
Discretionary Access Control (DAC)
Encrypt
Firewalls
Insider Threat
iOS
Layered Defense
Linux
Log Anomaly
Logging
Logical Access Control Systems
Mandatory Access Control
Mantrap
Object
Physical Access Controls
Principle of Least Privilege
Privileged Account
Ransomware
Role-based access control (RBAC)
Rule
Segregation of Duties
Subject
Technical Controls
Turnstile
Unix
User Provisioning
Adverse Events
Breach
Business Continuity (BC)
Business Continuity Plan (BCP)
Business Impact Analysis (BIA)
Disaster Recovery (DR)
Disaster Recovery Plan (DRP)
Event
Exploit
Incident
Incident Handling
Incident Response (IR)
Incident Response Plan (IRP)
Intrusion
Security Operations Center
Vulnerability
Zero Day
Adequate Security
Administrative Controls
Artificial Intelligence
Asset
Authentication
Authorization
Availability
Baseline
Biometric
Bot
Classified or Sensitive Information
Confidentiality
Criticality
Data Integrity
Encryption
General Data Protection Regulation (GDPR)
Governance
Health Insurance Portability and Accountability Act (HIPAA)
Impact
Information Security Risk
Integrity
International Organization of Standards (ISO)
Internet Engineering Task Force (IETF)
Likelihood
Likelihood of Occurrence
Multi-Factor Authentication
National Institutes of Standards and Technology (NIST)
Non-repudiation
Personally Identifiable Information (PII)
Physical Controls
Privacy
Probability
Protected Health Information (PHI)
Qualitative Risk Analysis
Quantitative Risk Analysis
Risk
Risk Acceptance
Risk Acceptance
Risk Assessment
Risk Avoidance
Risk Management
Risk Management Framework
Risk Mitigation
Risk Tolerance
Risk Transference
Risk Treatment
Security Controls
Sensitivity
Single-Factor Authentication
State
System Integrity
Technical Controls
Threat
Threat Actor
Threat Vector
Token
Vulnerability
Institute of Electrical and Electronics Engineers
D) A door locked by a voiceprint identifier
A) Lack of accuracy
B) A fence
D) Gary's actions look like an attack
D) Dual control
A) Detective
D) It is best to use a blend of controls in order to provide optimum security
B) Fence
C) Anything either of them do will be attributed to Trina
B) Segregation of duties
A) Role-based access controls (RBAC)
A) Role-based access controls (RBAC)
C) Updating and patching systems
A) DDOS (distributed denial of service)
D) Logical
D) Firewall
D) Firewall
B) DMZ
B) Infrastructure as a service (IaaS)
B) Mail server
C) Server
B) NTP (Network Time Protocol)
C) On-path
B) Internet Protocol (IP) address
B) Anti-malware
D) SIEM
D) Freedom from legal constraints
B) 80
A) Water
B) Update the anti-malware solution regularly
B) 4
D) An informed user is a more secure user
D) Rollback
B) Preserve health and human safety
A) The same length
C) Remanence
B) Security policy that conflicts with business goals can inhibit productivity
A) Destroyed
B) The acceptable use policy (AUP)
C) Senior management
A) 1
D) All
C) All
A) Two Person Integrity
B) Two Person Control
C) CPTED
D) Cipher lock
B) Cameras
A) True
C) Geotagging
C) Geofencing
B) Provisioning
A) Deprovisioning
A) True
A) True
B) False (Authorization determines what an authenticated user can do.)
A) Mandatory Access Control (MAC)
C) Discretionary Access Control (DAC)
B) Role-Based Access Control (RBAC)
A) Least privilege
B) WAN
C) 8
D) Telephone connections
A) 6
A) Personal Area Networks (PANs)
A) 30 FT / 10 meters
A) connection
A) SYN > SYN/ACK > ACK
C) SYN
A) SYN
B) UDP
A) Layer 1 (Physical)
D) Layer 4 (Transport)
C) Layer 6 (Presentation)
C) 4
D) 7
A) Network Interface, Internet, Transport, Application
D) 65,535
A) 0 - 1,023
B) 1,024 - 49,151
A) 49,152 - 65,535
C) FTP
B) SSH
D) RDP
B) NetBIOS
A) DNS
A) SMTP
D) POP
C) IMAP
A) HTTP
B) HTTPS
C) Temporal
C) CCMP
B) SAE
A) ICMP Echo Reply
C) ICMP Echo Request
B) SYN
B) Bluetooth
B) 139 (NetBIOS)
D) NAT
A) tracert
C) WPA2
B) 2 (Propagation Mechanism, Payload)
A) User Education
C) Botnets
A) Man-in-the-Browser
B) False
B) SSL Stripping
A) Fault Injection Attacks
A) Worm
C) Session tokens
A) IDS
A) True
B) IPS
(This is a statement, not a question. The answer is implied by the statement itself.)
A) True
A) True
B) Signature detection
D) False positive
A) Port scanning
D) Network vulnerability scanning
A) 64.4 F - 80.6 F
C) 41.9 - 50 F
A) True
B) Internet, DMZ, Internal
D) Extranet
B) Honeynet
C) Ad-Hoc Network
A) East-West Traffic
A) North-South Traffic
B) Layer 2 (Data Link) and C) Layer 3 (Network)
B) Stateless
A) Stateful (These are Modern Firewalls)
A) Implicit Deny (This is a default deny rule)
A) Firewalls, Routers, Servers, VPN Concentrators
C) Layer 3 (Supports L2TP - Layer 2 Tunneling Protocol)
A) 443
A) True
A) True
A) True
B) 802.1x
A) True
C) Supplicant
D) 443
D) Network segmentation
B) Router
D) Firewall
D) Implicit deny
A) Switch
B) 64.4 degrees Fahrenheit
A) Cloud Computing
A) SaaS, IaaS, PaaS
C) SaaS (Software as a Service)
A) IaaS (Infrastructure as a Service)
B) PaaS (Platform as a Service)
A) True
A) True
A) True
C) Public
D) Multi-Cloud
A) MSSPs
A) Security as a Service (SECaaS)
C) CASB (Cloud Access Security Brokers)
A) True
E) All of the above (Vendor Selection, Onboarding, Monitoring, Offboarding)
A) True
B) Private cloud
D) SLA (Service-Level Agreement)
D) IaaS (Keyword: server)
B) Fixed
A) Symmetric
A) Public, Private
B) Asymmetric (Note: This question seems to be a duplicate/error. The answer for asymmetric is different keys.)
B) Asymmetric
B) Asymmetric
A) Symmetric, Asymmetric
Hash Function
A) True
A) 128
A) True
B) 160
B) False
E) All of the above (224, 256, 384, 512)
B) SHA-3
E) All of the above (128, 160, 256, 320)
A) HMAC (Hash-Based Message Authentication Code)

These answers are free — always.

If this study guide helped you prepare for your exam, consider extending a hand to Mary & Lydia through AbleHearts — a community supporting those in need. Even a small contribution makes a real difference.

Donate to AbleHearts

able-hearts.org/donate · Helping Mary & Lydia