Practice for the ISC2 Certified in Cybersecurity (CC) Full Exams '26 exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the PRIMARY difference between qualitative and quantitative risk analysis?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the ISC2 Certified in Cybersecurity (CC) Full Exams '26 practice test →
What you will practice
- What is the PRIMARY difference between qualitative and quantitative risk analysis?
- What is a Business Impact Analysis (BIA)?
- Which is one PRIMARY benefit of having the least privilege principle?
- A system password with two separate parts that no single person knows the full password
- Which of the following is NOT a type of phishing attack?
- Which is the PRIMARY objective of the principle of segregation of duties?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the PRIMARY difference between qualitative and quantitative risk analysis?
Answer: D. Qualitative risk analysis is based on subjective data, while quantitative risk analysis is based on numerical data
Qualitative risk analysis relies on subjective data like expert judgment and opinions, whereas quantitative analysis uses numerical or measurable data. The key exam rule is to associate qualitative with subjective scenarios and quantitative with hard numbers.
Q2. What is a Business Impact Analysis (BIA)?
Answer: D. A systematic process to evaluate the potential effects of an interruption to critical business operations
A Business Impact Analysis is a systematic process used to evaluate the potential effects of an interruption to critical business operations. Do not confuse this with disaster recovery, which involves the proactive development of procedures to restore operations after an event.
Q3. Which is one PRIMARY benefit of having the least privilege principle?
Answer: D. To minimize the risk of unauthorized access to sensitive data
The primary benefit of the least privilege principle is to minimize the risk of unauthorized access to sensitive data by restricting users to minimum necessary permissions. Options suggesting administrative simplification or account reduction miss the core security objective.
Q4. A system password with two separate parts that no single person knows the full password
Answer: C. A system password with two separate parts that no single person knowing the full password
Dual control requires two or more people to complete a sensitive task, such as combining two halves of a password. The trap option involving an employee creating an invoice and a manager approving it is segregation of duties, not dual control.
Q5. Which of the following is NOT a type of phishing attack?
Answer: A. Tailgating
Tailgating is a physical security breach where an unauthorized person follows someone into a restricted area, making it completely different from phishing. Whaling, spear phishing, and vishing are all variations of social engineering attacks that use electronic communications.
Q6. Which is the PRIMARY objective of the principle of segregation of duties?
Answer: A. To ensure that no one person should control an entire high-risk task from start to finish
Segregation of duties ensures no single person controls an entire high-risk task from start to finish. This prevents fraud and errors. Eliminate distractors about distributing workloads or verifying tasks twice, as those are management concepts, not security controls.
Q7. Two healthcare organizations are planning to collaborate on a project. Which of the following can be used to formalize this collaboration agreement?
Answer: C. A memorandum of understanding (MOU)
A memorandum of understanding formalizes a collaborative partnership between organizations. Eliminate the alternatives because an SLA defines service metrics, and an NDA only restricts information sharing without establishing the partnership itself.
Q8. What should be included in the Business Continuity Plan (BCP) team members list?
Answer: D. Multiple contact methods and a list of backup members
A Business Continuity Plan team list requires multiple contact methods and backup members for redundancy. Call trees and supply chain numbers are separate operational components. Focus on personnel availability to eliminate the process distractors.
Q9. Until the generators start up and stabilize, what do battery backups need to be properly sized to carry?
Answer: A. The critical load
Battery backups must carry the critical load until generators stabilize. This ensures essential systems remain operational during the transition. HVAC and fire suppression are supporting infrastructure, not the primary critical load.
Q10. What term describes a potential malicious actor that may cause harm to an organization or its assets?
Answer: B. Threat
A threat is defined as a potential malicious actor or event that could cause harm to an organization or its assets. A vulnerability is a weakness, while a breach is an incident where a threat successfully compromises a system.
Q11. What is a disadvantage of password managers?
Answer: D. They can be compromised if protected by a weak password
Password managers create a single point of failure if compromised by a weak master password. The other options are incorrect because modern managers are generally inexpensive, compatible, and user-friendly.
Q12. Which type of malware self-replicates without the need for user interaction?
Answer: C. Worm
A worm is malware that self-replicates and spreads across networks without user interaction. The other options are incorrect because viruses and Trojans require user action, while spyware monitors rather than replicates.
Q13. A company application asks employees to acknowledge that usage is only permitted for authorized individuals. Employees must click the "Accept Terms" button. What does this PRIMARILY exemplify?
Answer: B. Acceptable Use Policy (AUP)
An Acceptable Use Policy dictates the rules and constraints for using organizational systems. The other options are incorrect because they govern service expectations, confidentiality, or bilateral agreements rather than user behavior.
Q14. Which of the following documents are NOT commonly part of a Disaster Recovery Plan?
Answer: D. Software source code
Disaster recovery plans contain procedural documentation rather than actual software source code. The other options are incorrect because checklists, executive summaries, and technical guides are standard components of recovery documentation.
Q15. Choosing NOT to implement the needed security controls is a form of:
Answer: B. Risk acceptance
Risk acceptance means acknowledging a risk and deliberately choosing not to implement controls. The other options are incorrect because avoidance, transference, and mitigation require active steps to change the risk profile.
Q16. What is the PRIMARY goal of Change Management in cybersecurity?
Answer: D. Release software without introducing new vulnerabilities
The primary goal of change management is to implement updates securely without disrupting operations or introducing new vulnerabilities. Options describing patch creation or vulnerability scanning belong to vulnerability management, not change control.
Q17. In a change management process, what is the purpose of Verification and Audit?
Answer: D. Verify that newly applied changes don't break anything
Verification and audit ensure that newly applied changes function correctly without causing system failures or unintended side effects. Identifying a baseline or requesting changes occurs during the initial planning stages rather than the post-implementation audit.
Q18. In the context of information security, what is a definition for 'control'?
Answer: D. A safeguard conceived to guarantee the CIA of data
A control is a safeguard designed to preserve the confidentiality, integrity, and availability of data. The distractors list specific technical mechanisms like encryption protocols or policy documents, which are too narrow to define a control comprehensively.
Q19. Which of the following best describes a robust security awareness training program?
Answer: A. A combination of education, training, and awareness activities
A robust security awareness program integrates education, training, and awareness activities to address human risk effectively. Single-focus options fail because they omit critical elements like practical skill-building or ongoing reinforcement.
Q20. Which organization is responsible for establishing global computer connectivity by setting communication protocol standards?
Answer: C. IETF
The Internet Engineering Task Force, or IETF, establishes communication protocol standards that enable global computer connectivity. ISO and NIST focus on broader security frameworks and best practices rather than core internet protocols.
Q21. What is the purpose of the two-person rule in a security strategy?
Answer: C. Require a minimum of two individuals to be together in high-security areas
The two-person rule requires at least two authorized individuals to be present during sensitive activities to prevent fraud or errors. The distractors misinterpret the rule as either a simple task division or a strict limit on total access.
Q22. Why is it important to have a rollback plan in place for organizations that do not have the ability to fully test a change?
Answer: B. Because it allows them to roll back to a previous state if necessary
A rollback plan allows an organization to revert a system to its previous stable state if an untested change causes unexpected failures. Baselines and third-party testing are planning steps, not the safety net provided by rolling back.
More ISC2 Certified in Cybersecurity (CC) Full Exams '26 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.