ISC2 CC sample questions

Question 1

Which pairing correctly classifies a mandatory background check performed before a new employee is given system access?

Accepted Answer

Administrative category, preventive type. A background check is a personnel policy and procedure, so it is administrative, and it aims to stop unsuitable people from gaining access, so it is preventive. Corrective is wrong because corrective controls act after an incident to fix its effects, not before access is granted.

Question 2

An employee types a username at a login prompt before entering a password. Which part of IAAA does typing the username represent?

Accepted Answer

Identification. Identification is the claim of an identity, such as supplying a username. Authentication is the next step, where the claim is proven with a factor such as a password; the username alone proves nothing.

Question 3

Which type of security document offers recommended practices that staff are encouraged, but not required, to follow?

Accepted Answer

Guideline. Guidelines are discretionary recommendations that help people apply policies and standards sensibly. Policies, standards and procedures are all mandatory within their scope; a standard in particular is often confused with a guideline, but it states requirements rather than advice.

Question 4

An attacker phones the service desk pretending to be a traveling sales director, gives the director's name and job title from a professional networking site, and persuades the agent to reset the director's password.

Which control most directly reduces the risk of this attack succeeding again?

Accepted Answer

Verify callers by calling back on the number held in HR records. The attacker exploited the reset process by pretexting over the phone, so the fix is a verification step that the caller cannot satisfy with public information, such as a call back to a number on record. Stronger password complexity is tempting but irrelevant: the attacker simply had the new password issued to them.

Question 5

Attackers send employees to a lookalike login page that relays everything they type to the real site in real time, including one-time codes, and captures the resulting session.

Which type of authenticator best resists this attack?

Accepted Answer

A FIDO2 security key or passkey bound to the site's origin. Phishing-resistant authenticators such as FIDO2/WebAuthn sign a challenge tied to the genuine site's origin, so a lookalike proxy site cannot obtain a usable response. An authenticator-app TOTP is the tempting upgrade from SMS, but the user can still type that code into the fake page, where the proxy relays it in real time.

Question 6

Policy: users may view quarterly forecasts only if their department is Finance, they are on a company-managed device, and the request is made between 07:00 and 19:00 local time.

Which access control model best supports this policy?

Accepted Answer

Attribute-based access control (ABAC). ABAC evaluates policies against attributes of the subject, object, action and environment, such as department, device state and time, at the moment of the request. RBAC is tempting because 'Finance' sounds like a role, but pure RBAC cannot natively express conditions like managed device and time of day without creating many role variants.

Question 7

A company is launching public web servers that must be reachable from the internet and must query a database on the internal network.

Where should the new public web servers be placed?

Accepted Answer

In a screened subnet (DMZ) with firewalls on both sides. A DMZ, or screened subnet, hosts internet-facing services in a separate segment, so a compromised web server does not give direct access to internal systems. Placing them next to the database servers is tempting for performance, but it removes the segmentation that limits an attacker's lateral movement.

Question 8

A healthcare firm storing records in the cloud must be able to control who can use its encryption keys and be able to revoke access to the data by disabling those keys.

Which approach best meets this requirement?

Accepted Answer

Encrypt with customer-managed keys in a key management service. Customer-managed keys in a key management service let the customer control key policies, rotation and revocation, so disabling the key makes the data unreadable. Provider-owned default encryption is the tempting option because it is already on, but the customer then has no say over key use or revocation.

Question 9

An investigator must image a hard drive removed from a suspect's computer without changing a single bit on the original disk.

Which tool should be placed between the suspect drive and the forensic workstation during imaging?

Accepted Answer

A write blocker. A write blocker allows data to be read from the suspect drive while preventing any writes, so the original evidence is not modified during acquisition. A network tap is tempting because it is also a passive monitoring device, but it copies network traffic and does nothing to protect a connected storage device.

Question 10

A user reports that files on their laptop are being renamed with a strange extension and a ransom note has appeared. The laptop is still connected to the corporate network.

What is the most appropriate immediate action?

Accepted Answer

Isolate the laptop from the network but keep it powered on. Containment limits the spread and damage, and network isolation stops communication with other systems and the attacker while preserving volatile evidence in memory. Wiping immediately is the tempting 'fast fix', but it destroys evidence and skips the analysis needed to find the root cause and other infected systems.

ISC2 CC sample questions with answers

ISC2 CC sample questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

More practice