Practice for the ISC2 Certified in Cybersecurity (CC) Full Exams '26 exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Before sending a message, Bob encrypts it using Alice's public key. Why is Alice's public key used?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the ISC2 Certified in Cybersecurity (CC) Full Exams '26 practice test →
What you will practice
- Before sending a message, Bob encrypts it using Alice's public key. Why is Alice's public key used?
- In a healthcare organization, which of the following would be an example of the principle of least privilege?
- The sender transmits a message and an encrypted hash of the message using their private key. Why is this done?
- What is the PRIMARY goal of a Denial of Service (DoS) attack?
- What are the two PRIMARY transport layer protocols?
- What is the term used to verify or prove the user's identity?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Before sending a message, Bob encrypts it using Alice's public key. Why is Alice's public key used?
Answer: D. To ensure only the receiver can decrypt the message
Asymmetric encryption uses the recipient's public key to ensure confidentiality, meaning only the matching private key holder can decrypt the message. Non-repudiation is a trap here; that property requires the sender to digitally sign the message with their own private key.
Q2. In a healthcare organization, which of the following would be an example of the principle of least privilege?
Answer: C. Healthcare workers can only access the assets they need for their role and nothing more
The principle of least privilege ensures that healthcare workers can only access the assets they need for their specific role and nothing more. Allowing blanket access to all patient data violates this principle and introduces unnecessary privacy risks.
Q3. The sender transmits a message and an encrypted hash of the message using their private key. Why is this done?
Answer: D. To provide non-repudiation
Encrypting a hash with a sender's private key creates a digital signature that provides non-repudiation, proving the sender cannot deny sending the message. Confidentiality would require encrypting the message itself with the recipient's public key, not signing a hash.
Q4. What is the PRIMARY goal of a Denial of Service (DoS) attack?
Answer: C. Preventing legitimate activity on a system
A Denial of Service attack aims to prevent legitimate activity by overwhelming a system with traffic. Stealing data or spreading malware are goals of other attack types. Use the intent to disrupt availability to eliminate the distractors.
Q5. What are the two PRIMARY transport layer protocols?
Answer: D. TCP and UDP
The two primary transport layer protocols are TCP and UDP. TCP is connection-oriented, while UDP is connectionless. Eliminate the distractors because HTTPS and IMAP are application layer protocols, and ICMP is a network layer protocol.
Q6. What is the term used to verify or prove the user's identity?
Answer: D. Authentication
Authentication is the process of verifying a user's claimed identity. Authorization happens later and determines access rights. Rely on the standard identity proofing definitions to eliminate verification and validation distractors.
Q7. The concept of data integrity refers to:
Answer: C. Preventing data from being altered in an unintended manner
Data integrity ensures information remains accurate and unaltered during storage or transmission. The other options are incorrect because they describe ethical use, confidentiality, and availability.
Q8. What is a definition of confidentiality?
Answer: B. Ensuring access to data only to authorized users
Confidentiality ensures that data is accessible only to authorized users and is protected from unauthorized disclosure. Options describing unaltered data or completeness define integrity, leaving authorized access as the correct choice.
Q9. Posting photos of confidential documents containing clients' identifying information that were left unattended on a printer is considered a:
Answer: B. Breach
A breach involves the unauthorized access or inadvertent disclosure of sensitive or personally identifiable information. Posting photos of confidential documents constitutes an unintended disclosure, distinguishing it from a mere system occurrence or a direct technical exploit.
Q10. Which of the following cloud models allows organizations to integrate their existing on-premises networks?
Answer: A. Hybrid cloud
A hybrid cloud integrates an organization's existing on-premises private networks with public cloud services. This combination allows businesses to leverage both environments, unlike private, public, or community models deployed independently.
Q11. An employee received a suspicious text message with an unfamiliar invoice number and a hyperlink for more information. Which of the following attacks is MOST likely being described?
Answer: D. Smishing
Smishing is a social engineering attack that uses fraudulent text messages to trick victims into clicking malicious links. Vishing utilizes voice calls, while traditional phishing and whaling typically rely on email communication.
Q12. What is the PRIMARY difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?
Answer: C. IPS can block network traffic, but IDS can't
An intrusion prevention system actively blocks malicious network traffic, whereas an intrusion detection system only monitors and alerts on suspicious activity. The other options are incorrect because both systems can be hardware or software based, and their network placement can vary.
Q13. How are permissions typically assigned in a role-based access control (RBAC) model?
Answer: A. Based on the user's role within the organization
In a role-based access control model, permissions are assigned based on the user's specific role within the organization. This differs from discretionary control, where administrators set permissions, and mandatory control, which relies on clearances.
Q14. What port range refers to dynamic or private ports?
Answer: A. Ports 49152 – 65535
Dynamic or private ports fall within the range of 49152 to 65535, often used for temporary connections. Ports 0 to 1023 are well-known ports, and ports 1024 to 49151 are registered ports, making the other options incorrect for this range.
Q15. What attack involves intercepting and possibly altering communication between two persons without their knowledge?
Answer: C. Man-in-the-middle attack
A man-in-the-middle attack involves secretly intercepting and potentially altering communication between two parties. Distractors describe denial of service or spoofing, which do not inherently involve undetected communication modification.
Q16. Audit trail logs showed that a bank employee accessed customer accounts and transferred funds to a personal bank account. Which of the following describes this action?
Answer: C. Insider threat
An insider threat occurs when a trusted employee misuses their authorized access for malicious purposes. Options describing social engineering or third-party risks are eliminated because the threat actor is an internal employee.
Q17. In the context of disaster recovery planning, what does RTO stand for?
Answer: B. Recovery Time Objective
In disaster recovery, RTO stands for Recovery Time Objective, defining the maximum tolerable downtime. The other options use plausible terms but do not represent standard business continuity metrics.
Q18. During troubleshooting you encounter an IP address written using two consecutive colons and the number 1 (for example, ::1). What does this address represent?
Answer: C. The IPv6 loopback address
The address ::1 is the IPv6 loopback address, equivalent to 127.0.0.1 in IPv4, and it allows a system to test its internal network stack. Link-local addresses start with fe80, while multicast addresses begin with ff00, which helps eliminate those distractors.
Q19. What is the PRIMARY benefit of using a rule-based access control (RuBAC) model? (★)
Answer: A. It provides dynamic access control based on pre-defined rules
Rule-based access control relies on system-level preconditions to dynamically grant or restrict access. The distractors describe other models; for instance, allowing the object creator to dictate access defines discretionary access control rather than a centralized rule.
Q20. Which of the following is an example of the principle of least privilege?
Answer: B. Users can only access the assets they need for their role and nothing more
The principle of least privilege grants users only the minimum access required to perform their specific job duties. Unrestricted access or allowing users to control their own permissions directly violates this core security concept and increases organizational risk.
Q21. What kind of attack is likely to occur when a hacker intercepts and redirects traffic by spoofing the IP address of a corporate server?
Answer: C. On-path attack
An on-path attack occurs when a malicious actor intercepts and potentially alters communication between two parties, often using spoofed addresses. Trojans and spyware are malware types rather than network interception techniques, and advanced persistent threats are sustained intrusions.
Q22. What is the PRIMARY objective of Crime Prevention through Environmental Design (CPTED)?
Answer: D. Create safer workspaces through passive design elements
Crime Prevention Through Environmental Design creates safer workspaces through passive physical design elements like lighting and landscaping. Distractors mentioning green technologies or environmental policies are trap choices playing on the word environmental, which here refers to physical surroundings, not sustainability.
More ISC2 Certified in Cybersecurity (CC) Full Exams '26 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.