ISC2 Certified in Cybersecurity (CC) Full Exams ’26 Practice Test – 473 Free Exam Questions with Answers

Correct answer: C. Rootkits

A rootkit is designed to obtain and maintain highly privileged access while actively concealing its existence from system monitoring tools. Trojans provide backdoors but lack the robust stealth mechanisms inherent to rootkits, making them less effective for hidden root access.

Correct answer: A. Confidentiality

Confidentiality ensures that sensitive data is only accessible and readable by authorized individuals. Authentication verifies identity but does not itself enforce access rules, and accessibility focuses on system uptime rather than restricting unauthorized data disclosure.

Correct answer: B. TCP

TCP establishes a reliable connection by ensuring error-checked, ordered packet delivery, making it ideal when data integrity outweighs speed constraints. UDP skips handshake processes and error correction to favor low-latency transmission, rendering it unsuitable for reliable delivery.

Correct answer: D. Defense in Depth

Defense in depth uses multiple, overlapping security controls across people, technology, and operations to protect an organization. Least privilege and separation of duties are access control principles, while privileged accounts are an administrative asset type.

Correct answer: D. Risk transfer

Risk transfer shifts the financial consequences of a threat to a third party, typically by purchasing an insurance policy. Risk mitigation reduces threat likelihood or impact, and risk avoidance requires eliminating the vulnerable process entirely.

Correct answer: A. GDPR

The General Data Protection Regulation, or GDPR, is the European Union legislation governing data protection and privacy. The other options are United States regulations and do not apply to European data governance.

Correct answer: B. DMZ

Publicly accessible servers like web servers belong in a demilitarized zone, or DMZ, to isolate them from the trusted internal network. Placing them internally exposes the network, while a VPN is an access tunnel, not a hosting segment.

Correct answer: D. Firewalls

Firewalls are technical controls regulating network traffic, not physical barriers protecting facilities. Security cameras, biometric readers, and electronic locks act as tangible, physical deterrents restricting direct access to buildings.

Correct answer: D. 7

The Open Systems Interconnection model consists of exactly seven distinct layers. These range from the physical hardware layer up to the application layer, differing from the four-layer TCP/IP model.

Correct answer: A. Bob's public key

To ensure confidentiality in asymmetric encryption, the sender must encrypt the message using the recipient's public key. This guarantees that only the intended recipient, who holds the matching private key, can decrypt and read the contents. Using your own private key provides non-repudiation, not confidentiality.

Correct answer: C. Confidentiality

Digital signatures provide authentication, integrity, and non-repudiation, but they do not provide confidentiality. A signature verifies the sender and proves the message was not altered, but it does not encrypt the contents to hide them from unauthorized viewers.

Correct answer: B. RBAC

Role-based access control grants permissions based on the user's assigned role or job function within the organization. Eliminate mandatory and discretionary models because they rely on security labels or direct owner discretion rather than organizational roles.

Correct answer: C. NAC

Network Access Control enforces security policy by restricting device access to the network until appropriate credentials and compliance checks are met. Intrusion detection and SIEM systems are monitoring tools that lack the active enforcement capability needed to block initial access.

Correct answer: B. Threat Actor

The correct answer proves a threat actor is an entity that intentionally exploits system vulnerabilities to compromise security. While an attacker is a plausible synonym, threat actor is the precise ISC2 exam terminology for this specific concept.

Correct answer: C. Audit logs

The correct answer proves audit logs are generated by verification and audit procedures rather than serving as core elements of system security configuration management. Baselines, inventories, and updates are foundational steps for securely configuring systems.

Correct answer: B. Guidelines

Guidelines are voluntary recommendations providing flexibility, whereas policies, procedures, and regulations mandate strict compliance. Recognizing this distinction in force is essential for categorizing governance documents accurately.

Correct answer: A. Patch the system

Applying patches and updates directly eliminates system vulnerabilities, hardening it against exploitation. The other options focus on detection or architectural isolation rather than actively reducing the system's inherent attack surface.

Correct answer: D. Segregation

Segregation, specifically segregation of duties, is an administrative control principle preventing fraud by splitting responsibilities. Baiting, pretexting, and quid pro quo are all recognized social engineering tactics used to manipulate human behavior.

Correct answer: A. The Disaster Recovery Plan

The Disaster Recovery Plan guides restoring IT infrastructure and operations after a catastrophic event. A Business Impact Analysis identifies critical functions, while the Business Continuity Plan sustains operations during the disruption.

Correct answer: D. Detection and Analysis

Incidents are prioritized during the detection and analysis phase. The team assesses alerts to determine severity and impact, ensuring the most critical threats are addressed first. Other phases handle preparation, containment, or post-incident review rather than initial prioritization.

Correct answer: A. A symmetric key

Symmetric encryption uses a single shared secret key for both encrypting and decrypting data. This method is fast and efficient for bulk data. Asymmetric cryptography, by contrast, uses a matched public and private key pair where one key encrypts and the other decrypts.

Correct answer: B. Security control

A security safeguard is synonymous with a security control, acting as a measure to manage risk by protecting system resources. Controls can be administrative, technical, or physical. The other terms describe different concepts and do not accurately define a safeguard.

Correct answer: B. Exhaustion of device resources

A denial of service attack overwhelms a target system with malicious traffic, causing exhaustion of its computational resources. This renders the service unavailable to legitimate users. The primary goal is operational disruption, not unauthorized remote control or malware deployment.

Correct answer: B. SIEM

A Security Information and Event Management system is designed specifically to collect, aggregate, and analyze security events from across the network. Firewalls and routers handle traffic filtering and routing, while hubs act as basic signal repeaters without analytical capabilities.

Correct answer: C. Risk reduction

Implementing security controls is a form of risk reduction, also known as risk mitigation. The other options represent different risk responses, such as avoiding the activity, accepting the potential loss, or transferring the risk to a third party through insurance.

Correct answer: C. SaaS

Software as a Service gives the customer the least responsibility over the infrastructure because the provider manages everything from servers to the application. Infrastructure as a Service requires the customer to manage the operating systems and applications, leaving more infrastructure responsibility.

Correct answer: A. Trojans

A Trojan horse embeds malicious payload inside a reputable or trusted software to evade security mechanisms. A rootkit maintains privileged access while concealing malicious activity, whereas phishing and cross-site scripting target users and web applications rather than hiding inside trusted software.

Correct answer: D. SNMP

Simple Network Management Protocol is an application layer protocol, which corresponds to level seven of the OSI model, not level three. IP, ICMP, and IGMP all operate at the network layer, making them incorrect answers when looking for a non-level three protocol.

Correct answer: B. 13.16.123.1

A public IP address must be routable on the open internet, and the thirteen dot sixteen dot one hundred twenty-three dot one address fits this requirement. The remaining options fall under private address ranges reserved for internal local area networks, such as ten dot zero dot zero dot zero.

Correct answer: D. DAC

Discretionary Access Control allows the creator or owner of an object to delegate permissions to other users. Mandatory access control enforces strict rules set by a central authority, while role-based and attribute-based models rely on assigned roles or policies.

Correct answer: A. Vulnerability

A vulnerability is an exploitable weakness or flaw in a system or component that a threat source could leverage. A threat is the potential danger, risk is the potential for loss, and a bug is simply a software flaw that does not always create a security issue.

Correct answer: B. Authentication

Authentication is the process of verifying or proving a user's identification before granting access to a system. Authorization determines what specific resources the verified user can access, while confidentiality and integrity are core security principles.

Correct answer: C. Router

A router is the network device specifically used to connect a local area network to the Internet by directing data packets between networks. Firewalls filter traffic for security, intrusion detection systems monitor for threats, and SIEM analyzes security alerts.

Correct answer: D. Whaling

Whaling is a specific type of phishing attack that explicitly targets high-ranking executives. Phishing targets general users, while Trojans and rootkits refer to malicious software rather than social engineering techniques.

Correct answer: B. Separation of Duties

Separation of Duties ensures that critical tasks require multiple individuals, preventing one person from committing and concealing fraud. This shared responsibility serves as a direct fraud detection mechanism, unlike least privilege or defense in depth.

Correct answer: D. 443

Port 443 is used for HTTPS to ensure encrypted web traffic. Port 80 is unencrypted HTTP, while ports 69 and 25 are reserved for TFTP and SMTP respectively.

Correct answer: B. Create → Store → Use → Share → Archive → Destroy

According to ISC2, the six phases of the data lifecycle are create, store, use, share, archive, and destroy. Memorizing this exact order is crucial for the exam.

Correct answer: A. Impact

Impact is defined as the magnitude of harm expected from unauthorized disclosure or loss of information. Likelihood measures probability, while vulnerabilities are weaknesses and threats are potential adverse events.

Correct answer: D. SYN → SYN/ACK → ACK

TCP uses a three-way handshake to establish a reliable connection by exchanging three packets with the SYN, SYN/ACK and ACK flags. Although SYN, ACK and FIN are valid TCP packet flags, the sequence SYN → ACK → FIN is not the TCP handshake. Both the sequences Discover → Offer → Request and Offer → Request → ACK are used in DHCP.

Correct answer: A. Hybrid cloud

A hybrid cloud combines on-premises infrastructure, private cloud services, and a public cloud to handle storage and services. Community clouds involve shared resources among organizations with common goals, while multi-tenancy refers to customers sharing computing resources.

Correct answer: A. Change Management

Change management is the process of implementing necessary changes so that they do not adversely affect business operations. Vulnerability management tracks system flaws, configuration management maintains system integrity, and incident management addresses unplanned events.

Correct answer: D. Access control lists

Access control lists are technical security controls implemented in software or hardware to limit access to digital resources based on rules. Fences, bollards, and turnstiles are physical security controls designed to prevent unauthorized physical access to facilities.

Correct answer: B. John the Ripper

John the Ripper is a standard password cracking and auditing tool used to test password strength. The other options serve different security functions: Burp Suite tests web applications, while Wireshark and Nslookup are used for network analysis and DNS queries.

Correct answer: C. Tutorial

Awareness, training, and education are the three foundational learning activities defined in security programs. Tutorials simply teach specific step-by-step tasks and are not categorized as a primary security learning activity.

Correct answer: B. Least Privilege

The principle of least privilege ensures users are granted only the minimum access required to perform their specific job duties. Separation of duties divides tasks to prevent fraud, while defense in depth uses multiple security layers.

Correct answer: A. MAC

The Bell and LaPadula model is a classic implementation of mandatory access control, focusing on data confidentiality across strict security levels. Unlike discretionary access control, users cannot change the security labels governing access.

Correct answer: B. Pre-existing

Valid incident response team structures include dedicated, leveraged, and hybrid models. A pre-existing team is not a recognized model because incident response groups are intentionally formed to address specific organizational security mandates.

Correct answer: A. One-Time passwords (OTP)

One-time passwords act as a secondary authentication factor, typically fulfilling the 'something you have' criteria. Badges, keys, and standard passwords only represent a single authentication factor unless paired with another mechanism.

Correct answer: A. Smoke sensors

Smoke sensors are detection controls because they identify hazards and trigger alerts. The distractors represent physical or technical preventive controls—bollards, turnstiles, and firewalls—which are designed to block unauthorized access entirely.

Correct answer: D. ABAC

Attribute-based access control, or ABAC, evaluates complex rules using subject, object, and environmental attributes. The alternative models rely on fixed labels, ownership, or roles, lacking ABAC's dynamic policy flexibility.

Correct answer: B. Preparation → Detection and Analysis → Containment, Eradication and Recovery → Post-Incident Activity

The standard incident response lifecycle includes preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Eliminate any options that place containment after recovery, as you must isolate the threat before safely removing it and restoring systems.

Correct answer: D. Business Continuity Plan

A Business Continuity Plan outlines how an organization will sustain critical business operations during and after a major disruption. Disaster recovery focuses specifically on restoring IT infrastructure, whereas business continuity addresses the overall mission and business processes.

Correct answer: A. IPSec Tunnel Mode

IPSec tunnel mode encapsulates and encrypts the entire original IP packet within a new packet header, which hides internal network addresses during transit. Transport mode only encrypts the payload and leaves the original IP header visible, making it unsuitable for site-to-site gateway connections.

Correct answer: A. Firewalls

Firewalls inspect packet header information against a defined rule set to either allow or deny network traffic. Switches and routers forward traffic based on destination addresses, while hubs simply broadcast all packets without any inspection or filtering capabilities.

Correct answer: B. Regulation

Regulations are legal requirements established by governments, meaning non-compliance can result in official financial penalties. Standards are voluntary technical guidelines, while policies and procedures are internal organizational rules that do not carry government fines.

Correct answer: C. Disabled or isolated into a quarantine area until it can be checked and updated

A device that fails to meet security baselines should be disabled or isolated in a quarantine area until it is remediated. Placing it in a demilitarized zone exposes it to the internet, and a virus scan alone does not guarantee baseline compliance.

Correct answer: D. TCP

The Transmission Control Protocol uses a three-way handshake to establish a reliable connection between two devices. UDP is a connectionless protocol that does not use handshakes, while SMTP and SNMP are application-layer protocols.

Correct answer: B. Cross-Site Scripting

Cross-site scripting is a web application vulnerability that exploits poor input validation to inject malicious client-side scripts. Phishing relies on social engineering, while rootkits and trojans are types of malicious software.

Correct answer: C. Community cloud

A community cloud is shared by several organizations with similar needs, such as specific regulatory or security requirements. Private clouds serve a single organization, while hybrid clouds mix different environments.

Correct answer: A. It floods a victim with traffic by abusing broadcast addresses

A smurfing attack is a distributed denial-of-service technique that abuses IP broadcast addresses to flood a victim with traffic. The other options describe malware, social engineering, or ransomware.

Correct answer: B. Physical Control

A biometric reader that grants access to a building is considered a physical security control because it restricts facility entry. Technical controls protect computer systems, while administrative controls guide human behavior.

Correct answer: C. Procedures

Procedures provide the mandatory, step-by-step actions required to implement organizational policies. Policies establish high-level rules, whereas procedures detail the exact operational execution. Standards offer specific benchmarks, leaving procedures as the clear choice for detailed task completion.

Correct answer: B. Business Impact Analysis

A Business Impact Analysis focuses entirely on identifying and prioritizing critical business processes following a disruption. Disaster recovery and business continuity plans dictate the actual technical and operational recovery steps, making them incorrect options here.

Correct answer: B. They will not intervene or investigate private disputes or conflicts of interest

ISC2 does not act as an arbitrator or legal authority for private, contractual disputes between certified professionals. The organization only reviews ethics violations based on established legal or factual findings, eliminating the distractors about suspensions and legal counsel.

Correct answer: D. Acceptable Use Policies

Acceptable use policies represent administrative security controls because they dictate human behavior and governance rules. Badge readers and signs are physical controls, while access lists are technical, meaning only the policy correctly identifies an administrative function.

Correct answer: D. Phishing

Phishing relies on social engineering, using fraudulent messages to manipulate users into surrendering private data. Trojans and cross-site scripting rely on technical exploits or malware execution rather than direct human deception to harvest information.

Correct answer: C. Denial of Service

Denial of Service attacks target system availability by overwhelming resources with illegitimate traffic until legitimate users are locked out. Phishing and cross-site scripting primarily compromise confidentiality or integrity, completely missing the availability target.

Correct answer: D. Side-channel Attack

A side-channel attack extracts cryptographic secrets by monitoring physical device emissions or timing rather than targeting network traffic. Man-in-the-middle, oversized, and fragmented packet attacks explicitly disrupt or intercept standard IP network communications.

Correct answer: D. NIDS

A network intrusion detection system is purpose-built to monitor traffic and alert administrators about malicious activity across the entire network. Firewalls and routers focus on traffic filtering, and host-based systems only monitor individual endpoints.

Correct answer: A. Backdoors

A backdoor bypasses standard authentication to provide remote attackers with ongoing unauthorized control over a compromised system. While rootkits or trojans might install backdoors, the backdoor itself is the mechanism enabling external command execution.

Correct answer: D. Locks

Locks directly secure doors by requiring authorized keys or credentials for entry. While turnstiles and fences manage perimeter traffic, locks provide the most targeted defense against unauthorized physical access at the entry point itself.

Correct answer: B. 7

The Simple Mail Transfer Protocol operates at layer seven, the application layer of the OSI model, which interfaces directly with end-user software. The numerical options like twenty-five and twenty-three are port numbers, not network layers.

Correct answer: B. Simulations

Simulations are the most effective method because they involve full-scale re-enactments of emergency procedures, testing the plan under realistic conditions. Walkthroughs and reviews are valuable but remain static preparation steps that do not actively stress-test operational readiness.

Correct answer: C. 2 – 3

Industry best practices state that two or three data classification labels are manageable for most organizations. Maintaining a simple system prevents confusion and reduces administrative overhead. Implementing more than four categories often becomes overly complex and challenging to enforce consistently.

Correct answer: A. Destroy

Destroy is the final phase of the data handling lifecycle, requiring the secure elimination of data so it cannot be recovered. The other options relate to general data processing or transformation, but they are not official data handling phases used in security policies.

Correct answer: C. IPv6 address

An IPv6 address is represented as eight groups of four hexadecimal digits separated by colons. The length and format clearly distinguish it from 32-bit IPv4 addresses, 48-bit MAC addresses, and standard web URLs.

Correct answer: B. To influence and change employee behavior regarding security risks

The primary purpose of an information security awareness program is to influence employee behavior and foster a security-conscious culture. Technical controls are handled by systems, and eliminating all incidents or phishing responses is impossible.

Correct answer: B. Restore company operation to the last-known reliable operation state

The primary objective of a Disaster Recovery Plan is to restore operations to the last-known reliable state after an incident. Maintaining crucial operations during a disaster is the goal of a Business Continuity Plan.

Correct answer: D. … importance assigned to information by its owner, or the purpose of representing its need for protection

Sensitivity measures the importance assigned to information by its owner to represent its need for protection. This concept directly dictates how data is classified and safeguarded against unauthorized access.

Correct answer: A. Side Channels

A side-channel attack extracts information from the physical implementation of a system, such as power consumption or electromagnetic leaks. The other options represent different threat categories that do not rely on passive hardware emissions to gather data.

Correct answer: A. A previously unknown system vulnerability

A zero-day vulnerability is an unknown system flaw that attackers can exploit because no patch or signature exists yet. These vulnerabilities do not fit recognized patterns, making them difficult to detect and prevent using standard security tools.

Correct answer: D. Change the contents of existing files

An editing account is designed specifically to modify file content while lacking administrative or ownership-level control. Assigning permissions requires administrative rights, and accessing or sharing files typically requires owner or contributor privileges.

Correct answer: C. External Worker

External workers are less likely to have privileged accounts due to the increased risk of misuse and lack of oversight. Help desk staff, security analysts, and system administrators require elevated privileges to manage endpoints, infrastructure, and data environments.

Correct answer: A. Rollback

A rollback component addresses the procedures and actions needed to undo changes if monitoring suggests a failure or inadequate performance. A request for change formalizes the initial proposal, but only the rollback phase plans the reversal procedure.

Correct answer: C. The respondent, alleged behavior, breached canon, complainant's standing, and corroborating evidence

An ethics complaint must include the respondent, alleged behavior, breached canon, complainant's standing, and corroborating evidence. This provides the necessary jurisdiction and context, whereas the distractors omit mandatory elements or suggest non-required steps.

Correct answer: B. The frequency of occurrence is low, and the expected impact value is high

Risk management prioritizes scenarios with high impact, even if the probability or frequency is low. This focus ensures resources mitigate severe consequences to critical assets, rather than routine low-impact issues.

Correct answer: B. Identifying inefficient performing systems, detecting compromises, and providing a record of how systems are used

Logging and monitoring systems are essential for identifying inefficient performance, detecting security compromises, and providing an audit trail. Logging detects and records incidents rather than actively preventing them, which eliminates options that promise prevention.

Correct answer: C. Piggybacking

Piggybacking occurs when an unauthorized individual enters a secure area with the knowledge and consent of an authorized person. Tailgating is the trap to avoid here because it implies the authorized user is completely unaware of the person following them inside.

Correct answer: A. Confidentiality

Confidentiality is the most distinctive property of Protected Health Information because preventing unauthorized disclosure is the primary concern. While integrity, authentication, and non-repudiation apply to general data, strict privacy rules uniquely govern health records.

Correct answer: D. Test patches before applying them

Testing patches before applying them to production systems is a core best practice to prevent unexpected downtime or stability issues. Rushing deployment based on arbitrary schedules or vendor reputation introduces operational risk.

Correct answer: A. BYOD

A Bring Your Own Device policy establishes the rules for using personal tablets or phones in the workplace. The acceptable use policy governs how organizational systems are used, while change and privacy policies cover different areas.

Correct answer: B. Governance

Governance is a broad organizational concept rather than a specific change management component. Change management relies on requests for change, approvals, and rollbacks to manage system modifications safely.

Correct answer: D. Storage controls

Control frameworks categorize safeguards into common, system-specific, and hybrid controls. Storage controls represent a hardware location, not a distinct administrative or technical control category, making it the correct outlier.

Correct answer: A. Reversible

Cryptographic hashes are one-way mathematical operations, meaning the original plaintext cannot be derived from the hash output. Reversibility directly contradicts this core security principle, ensuring that stolen hashes remain computationally secure.

Correct answer: C. Submit a sworn affidavit in writing with a second copy in PDF format

Formal ethics complaints must be submitted in writing with supporting evidence attached. This requirement ensures due process, traceability, and fairness during the investigation. Anonymous reports or verbal updates lack the verifiable accountability required by the ethics committee.

Correct answer: E. Residual Risk

Residual risk is the portion of threat exposure that remains after management implements and accepts the limitations of security controls. Risk appetite and tolerance define strategic willingness, but neither describes the concrete leftover risk itself.

Correct answer: A. To build proficiency in a set of skills or actions in security subjects

Security training is designed to build practical skills, enabling employees to recognize and respond to threats effectively. The distractors describe unrealistic outcomes, as eliminating policies or granting administrative access would severely weaken security.

Correct answer: D. Mantrap

A mantrap provides physical access control by using two interlocking doors, ensuring only authenticated users enter. The distractors fail because cameras only record intrusion, an IPS is a network control, and Faraday cages block electromagnetic fields.

Correct answer: D. Encrypting backups to protect data confidentiality and integrity

Encrypting backups protects the confidentiality and integrity of the stored data if it is lost or stolen. The other options represent poor practices, as backups require regular testing, defined schedules, and off-site storage to ensure recovery.

Correct answer: A. Risk acceptance

Risk acceptance occurs when leadership acknowledges a risk but chooses not to implement controls because the cost outweighs the benefit. Avoidance removes the threat entirely, mitigation reduces it, and transference shifts the impact to a third party.

Correct answer: A. An attack previously unknown to the security community

A zero-day vulnerability is an unknown security flaw in software or hardware that developers have had zero days to patch. The term does not refer to novice attackers or literal date manipulation.

Correct answer: B. Parallel test

A parallel test activates the alternate processing facility while keeping the primary site operational. The trap options are checklist, tabletop, and full interruption tests because they do not involve running both sites concurrently.

Correct answer: C. To provide secure access to a network

The primary objective of a Virtual Private Network is to provide secure access to a network. While VPNs do provide device access, options like subnetting or cloud connectivity are secondary functions rather than the main security goal.

Correct answer: A. Service pack

A service pack is a large collection of unrelated patches released together to update software efficiently. Eliminate hotfix and security fix because those terms refer to individual, targeted vulnerability patches.

Correct answer: A. Directive

Directive access control is an administrative control that issues policies or guidelines, which does not involve a physical lock. Physical, preventive, and deterrent controls often rely on physical barriers or devices to function.

Correct answer: A. Cold site

A cold site is a facility equipped with basic infrastructure like HVAC, power, and communications, but lacks active hardware. Eliminate warm and hot sites because they include pre-installed equipment and data replication capabilities.

Correct answer: B. Smart Card

Biometric data refers to physical characteristics used for identification, such as voice records, retina scans, and fingerprints. A smart card is a physical authentication token, not an inherent physical or behavioral trait.

Correct answer: B. Regulations

Regulations are developed by governments or industry regulators to enforce legally binding cybersecurity requirements. Eliminate policies and procedures because they are internal documents created by the organization itself.

Correct answer: C. Advance and protect the profession

The advance and protect the profession canon requires members to maintain their competence and keep skills current. The other canons focus on protecting society, acting legally, and providing diligent service.

Correct answer: A. Physical

Dogs, guards, and fences are physical controls designed to prevent or deter unauthorized physical access. Detective controls identify incidents, recovery controls restore operations, and administrative controls manage policies.

Correct answer: B. Confidentiality, Integrity, Availability

The CIA Triad is the foundational security model encompassing confidentiality, integrity, and availability. Accessibility, identity, and concealment are distractors that sound similar but do not form the standard triad.

Correct answer: A. Separation of duties

Separation of duties requires multiple individuals to complete sensitive tasks, preventing one person from creating and elevating an account. Least privilege limits access, but separation specifically divides these conflicting duties.

Correct answer: C. Availability

Availability ensures that information and systems remain accessible to authorized users when needed. Confidentiality protects against unauthorized access, while integrity prevents unauthorized data alteration.

Correct answer: C. Protect society, the common good, necessary public trust and confidence, and the infrastructure

The first canon of the ISC2 Code of Ethics prioritizes protecting society, the common good, and public infrastructure. This overarching duty ranks above responsibilities to principals, ethical behavior, or advancing the profession.

Correct answer: B. Change management

Change management is the formal process of controlling modifications to systems, policies, or procedures to minimize disruption. It requires logging, assessing, approving, and communicating changes, distinguishing it from incident response or business continuity.

Correct answer: C. Treat the file as untrusted and analyze it in a secure environment

Files with unusual extensions from external sources must be treated as untrusted and analyzed in a secure environment like a sandbox. Forcing applications to open files, renaming extensions, or disabling validation prioritizes convenience over security and weakens your defense-in-depth posture.

Correct answer: D. Data link Layer

The data link layer is part of the OSI model, not the four-layer TCP/IP architecture. The TCP/IP model consists of the Application, Transport, and Internet layers, plus a Network Access layer, which eliminates the other options.

Correct answer: D. Protected health information (PHI) in the United States

HIPAA is a United States law that regulates the use and disclosure of Protected Health Information. It applies to covered entities like healthcare providers, eliminating options that reference European data or social media.

Correct answer: C. Risk appetite

Risk appetite is the broad amount and type of risk an organization is willing to accept to achieve its objectives. Risk tolerance refers to operational thresholds, while residual risk remains after controls are applied, eliminating the distractors.

Correct answer: B. A software company developing a malware detection system

A software company developing a malware detection system is a cybersecurity defender, not a threat actor. Nation-states, corporate competitors, and cyberterrorists are all malicious entities that exploit vulnerabilities, which validates the other options.

Correct answer: C. A passive, noninvasive attack to observe the operation of a device

A side-channel attack is a passive, noninvasive technique where attackers observe the physical operation of a device, such as power consumption or timing. Options describing spoofing, phishing, or botnets target software or users instead.

Correct answer: B. Account review

Account review verifies that employees have only the necessary privileges for their current roles, directly preventing privilege creep. Revocation removes access entirely, while re-provisioning happens during role changes, eliminating the distractors.

Correct answer: B. Recognizing and reporting phishing attempts

Recognizing and reporting phishing attempts is a core focus of security awareness training because it directly reduces human risk. Disabling antivirus, sharing passwords, and granting admin access to everyone all introduce critical vulnerabilities.

Correct answer: B. Procedures

Procedures provide the mandatory, step-by-step technical instructions required to complete specific tasks securely. Policies establish high-level rules, standards define technical requirements, and regulations are legal mandates, which eliminates those options.

Correct answer: A. Checklist review

A checklist review is a paper-based exercise that validates recovery documentation without touching production systems. The other options involve actual system disruption or resource usage, with a full interruption test being the most disruptive approach.

Correct answer: C. A document outlining the lessons learned

Once an incident is resolved, organizations create a lessons learned document to identify process improvements. The distractors apply to different lifecycle phases, as risk assessments happen beforehand and remediation actions occur during active mitigation.

Correct answer: C. Gaining access to a target system

The primary goal of spoofing is gaining system access by impersonating a legitimate user or device to bypass authentication. While spoofing can support malicious code delivery or redirection, those are secondary effects rather than the core objective.

Correct answer: A. Informs users of company expectations when they use computer systems and networks

An Acceptable Use Policy outlines the rules and expectations for how employees may use organizational systems and networks. Password guidelines and network monitoring are separate administrative controls, making them incorrect distractors here.

Correct answer: D. An attack involving numerous unsuspecting secondary victim systems used to flood the target system

A Distributed Denial of Service attack uses multiple compromised systems to flood a target with traffic, disrupting service for legitimate users. The other options describe spoofing, phishing, or specific HTTP floods rather than the distributed nature of the attack.

Correct answer: C. Need to know

The need to know principle limits access to sensitive data strictly to what is required for a specific job function. Separation of duties splits tasks to prevent fraud, while context-dependent controls rely on system state.

Correct answer: C. DLP

Data Loss Prevention identifies, monitors, and protects sensitive data at rest, such as on hard drives. Intrusion detection and prevention systems focus on network traffic analysis, while Transport Layer Security encrypts data in transit.

Correct answer: C. Record retention

Record retention refers to the practice of maintaining and storing information for its required lifespan. Data storage policies dictate security guidelines, whereas asset maintenance deals with physical or virtual inventory tracking.

Correct answer: A. The CISO's public key

To ensure confidentiality in public key infrastructure, the sender encrypts the message using the recipient's public key. This guarantees that only the intended recipient, who holds the matching private key, can decrypt and read the message.

Correct answer: D. Security Awareness Training

Security awareness training is an administrative control because it focuses on educating personnel and managing human risk through policies. Physical controls deter physical access, while technical controls enforce rules digitally.

Correct answer: C. Using CCTV cameras to monitor unauthorized access

Closed-circuit television cameras are physical controls because they monitor and record physical access to deter unauthorized entry. Acceptable use and training are administrative controls that manage human behavior.

Correct answer: A. PII is personal information, while PHI is health-related information

Personally identifiable information identifies an individual, while protected health information specifically relates to their medical care and health status. Protected health information is a specialized subset of personally identifiable information.

Correct answer: B. The code applies to all members of the information security profession

The ISC2 Code of Ethics applies specifically to ISC2 members and certified professionals, not every member of the information security industry. Adherence is mandatory for certification, breaches must be reported, and violations can result in certification revocation.

Correct answer: D. Data integrity and non-repudiation

Digital signatures provide data integrity and non-repudiation by uniquely linking the sender to the message. Any changes made after signing invalidate the signature, and the sender cannot deny sending it, whereas confidentiality requires encryption.

Correct answer: D. The Transport layer

The Transport layer manages reliable or unreliable end-to-end data transmission between hosts using protocols like TCP and UDP. The Network layer handles routing between networks, while the Session and Presentation layers manage dialog and data formatting.

Correct answer: D. Three

The scenario uses three authentication factors: something you know, something you have, and something you are. The trap is counting the username and PIN as two separate items, but a username is an identity identifier, not an authentication factor.

Correct answer: A. … a mathematical function that generates a fixed-size string of characters

A hash function is a mathematical function that generates a fixed-size string of characters from an input. Eliminate data compression and encryption because hashing specifically ensures data integrity rather than confidentiality.

Correct answer: A. NAC

Network Access Control enforces security policies by checking device compliance before granting network access. SIEM aggregates logs, NAT translates addresses, and VLANs segment traffic, but none actively block non-compliant devices.

Correct answer: B. Authorization

Authorization grants or denies specific rights to a logged-in user, dictating what actions they can perform. Logins verify identity, while roles and groups simply organize users to make assigning those permissions easier.

Correct answer: D. A distributed denial-of-service attack

A distributed denial-of-service attack floods a target with traffic from multiple compromised systems across various locations. Viruses and worms are malware types, while a smurf attack is a specific ICMP-based local flood.

Correct answer: D. To understand how the privacy laws apply to your organization

Data protection teams must understand how privacy laws apply to their specific organization. Interpreting, drafting, or enacting laws falls to legal professionals, judges, and legislators, not internal security staff.

Correct answer: D. Protecting data from unauthorized modification

Digital signatures provide non-repudiation and protect data from unauthorized modification by ensuring integrity. Encryption protects confidentiality, authentication verifies identity, and hashing secures password storage.

Correct answer: D. Containment

The containment phase minimizes the impact and extent of a security incident by isolating affected systems. Detection identifies the incident, response stops it, and recovery restores normal operations, but containment specifically limits the damage.

Correct answer: A. Within 30 days

Under GDPR, organizations must respond to data subject access requests without undue delay and within one month. The other durations are incorrect because they either fall short of the standard or incorrectly apply complex case extensions.

Correct answer: A. Non-repudiation

Non-repudiation proves the origin of a message so the sender cannot deny sending it. Authentication verifies identity, confidentiality protects data from unauthorized viewing, and integrity ensures the message remains unaltered during transmission.

Correct answer: A. Baseline

A baseline defines the standard initial permissions assigned to a user account upon creation. Entitlement refers to rights granted later based on role, while aggregation and transitivity involve data collection and domain trust relationships, respectively.

Correct answer: D. Rule-Based Access Control (RuBAC)

Rule-Based Access Control uses specific conditions, like access control lists, to determine access permissions. Discretionary control relies on owner discretion, Role-Based uses job functions, and Mandatory Access Control relies on classification labels.

Correct answer: B. Baseline configuration

A baseline configuration provides secure configuration templates for operating systems and applications. Security guidelines are general recommendations, while a running configuration is simply the current active state, making baseline the only proven template.

Correct answer: C. Determine the value of each asset

After creating an asset list in a business impact analysis, the immediate next step is determining the value of each asset. Evaluating risks and identifying vulnerabilities belong to the risk assessment process, not the initial business impact valuation.

Correct answer: B. To ensure employees stay up to date with the latest security threats and best practices

Regular security awareness training ensures employees stay up to date with the latest threats and best practices. The other options describe actively bypassing security or decreasing critical security measures, which are never valid training goals.

Correct answer: D. Ransomware

Ransomware is malware that holds a user's data hostage by encrypting it until a ransom is paid. Trojans create backdoors, and denial of service attacks disrupt availability through traffic floods, eliminating the other options.

Correct answer: D. Labels are assigned to objects and subjects

In a mandatory access control model, labels are assigned to both objects and subjects based on classification levels. Options suggesting only one receives a label or that all share the same label misrepresent the required subject and object pairing.

Correct answer: C. Username

A username is used for identification, claiming an identity, but it is not an authenticator. Passwords, tokens, and biometrics like retinal scans prove that identity, making them true authentication factors.

Correct answer: B. Least privilege

The principle of least privilege grants users only the minimum access required to perform their official duties. Need to know is a valid related concept, but least privilege specifically focuses on restricting administrative rights to appropriate roles.

Correct answer: A. Confidentiality

When a device is physically lost or stolen, the primary security concern is unauthorized access to sensitive data. This directly impacts confidentiality, as the theft exposes private information to unauthorized individuals.

Correct answer: B. Promptly report security vulnerabilities to relevant authorities

Promptly reporting vulnerabilities is a best practice but is not explicitly listed as one of the four ISC2 Code of Ethics Canons. The four actual canons focus on protecting society, acting legally, serving principals, and advancing the profession.

Correct answer: A. Dumpster Diving

Dumpster diving involves physically searching through trash to find discarded sensitive information or documents. Tailgating involves following someone through a secure door, whereas whaling and eavesdropping target executives and communications.

Correct answer: C. Rule-based access controls (RuBAC)

Rule-based access control, or RuBAC, uses specific conditions like IP addresses and ports to allow or deny actions. Firewalls rely heavily on these configured rule sets to filter network traffic, unlike role-based or discretionary models.

Correct answer: A. On Path

An on-path attack, formerly known as a man-in-the-middle attack, occurs when an attacker secretly intercepts and possibly alters communication between two parties. The other options describe software, internal actors, or prolonged network invasions.

Correct answer: A. Need to know

The need to know principle restricts access even from cleared personnel if they lack a specific business requirement. Least privilege grants the minimum necessary permissions, but need to know directly enforces business justification for sensitive data.

Correct answer: B. Multiple processing sites

Multiple processing sites provide redundancy by distributing workloads across different geographic locations to ensure availability. Warm and cold sites are standby facilities for disasters, while a honeynet serves as a decoy network to trap attackers.

Correct answer: C. Platform as a Service (PaaS)

Platform as a Service provides developers with a framework to build, test, and deploy applications without managing the underlying infrastructure. Infrastructure as a Service requires managing virtual machines, while Software as a Service delivers finished applications.

Correct answer: B. Subject, Object, and Rules

Access control fundamentally relies on the relationship between a subject, an object, and the rules that govern their interaction. Permissions are derived from rules, while layers refer to network architecture rather than core access components.

Correct answer: A. To segment a network into multiple subnets

A Virtual Local Area Network segments a larger physical network into multiple distinct broadcast domains to improve traffic management. Secure access to external providers uses VPNs, not local VLAN segmentation.

Correct answer: B. To protect data from unauthorized access

Encryption primarily protects data confidentiality by transforming readable plaintext into unreadable ciphertext. While it supports secure storage, its defining technical purpose is preventing unauthorized access, not processing or analyzing data.

Correct answer: C. Establish a standard for security configurations

Security baselines establish a uniform standard for system and application configurations to ensure a minimum level of protection. While baselines indirectly support data protection and threat monitoring, their primary purpose is to provide a measurable configuration standard.

Correct answer: C. Human resources

Mandatory vacations, job rotation, and two-person control are administrative controls specifically designed to prevent and detect internal fraud. Human resources is a department, not a specific anti-fraud control mechanism.

Correct answer: D. Data classification

Data classification is an administrative control because it involves defining policies and procedures for handling data based on its sensitivity. Technical controls are technology-based safeguards like firewalls, access control lists, and encryption.

Correct answer: A. Destruction phase

Destruction is the final phase of the data handling lifecycle, ensuring that data is securely disposed of when it is no longer needed. This prevents unauthorized recovery of sensitive information.

Correct answer: B. 0.01

The annual likelihood of an event occurring is calculated by dividing one by the frequency of occurrence in years. A 100-year event yields a probability of 0.01 per year.

Correct answer: B. Lattice based

Mandatory Access Control uses a lattice-based model to determine access based on subject clearance and object sensitivity labels. Discretionary access control allows owners to set permissions, while group-based and rule-based methods describe implementation rather than the underlying model.

Correct answer: C. Non-repudiation

Non-repudiation provides undeniable proof that a sender transmitted a message, preventing them from denying the action. Authentication only validates identity for the recipient, while integrity proves the message was unaltered, but neither concept alone prevents the sender from later denying it.

Correct answer: A. To control and monitor visitor access to the facility, ensuring only authorized individuals are granted entry

A visitor management policy tracks and restricts guest access to ensure only authorized individuals enter the facility. The remaining options describe weakening physical security, which directly contradicts the goal of safeguarding the facility and its physical assets.

Correct answer: D. A proxy

A proxy server acts as an intermediary, forwarding client requests while masking the original IP address for anonymity. Standard gateways, routers, and firewalls focus on routing and filtering traffic rather than deliberately rewriting source addresses.

Correct answer: A. DAC, for enabling individual administrators to make decisions and achieve scalability and flexibility

Discretionary Access Control, or DAC, is more flexible because it allows individual resource owners to make access decisions. Eliminate Mandatory Access Control because adding security labels actually increases administrative rigidity, not scalability.

Correct answer: C. Combination of quantitative and qualitative risk assessment

Assessing both tangible and intangible assets requires a combination of quantitative and qualitative risk assessments. Quantitative methods calculate financial loss, while qualitative methods evaluate subjective impacts like reputation.

Correct answer: C. MDM

Mobile Device Management provides organizations with the tools to enforce security policies and manage mobile devices. Intrusion detection, intrusion prevention, and Security Information and Event Management systems focus on network threat detection rather than device configuration enforcement.

Correct answer: C. Security safeguards

Security controls are commonly referred to as safeguards to protect the confidentiality, integrity, and availability of data. The other terms are informal or describe specific software agents rather than the broad administrative, technical, or physical measures used.

Correct answer: B. Conducting an unauthorized vulnerability scan

An unauthorized vulnerability scan qualifies as an incident because it threatens system confidentiality and integrity through active probing. Routine administrative tasks, like updating signatures or completing backups, are standard operational events.

Correct answer: D. TCP port 21

File Transfer Protocol control traffic operates over TCP port 21. An intrusion detection system monitors this specific port to identify unencrypted FTP connections, distinguishing it from Telnet on port 23 or TFTP on UDP port 69.

Correct answer: D. 12.123.23.23

A valid public IP address must fall outside private ranges and contain octets no higher than 255. Option D is public, while option A is private, and options B and C contain invalid octets or syntax, quickly eliminating them.

Correct answer: D. An attack that attempts to intercept the communication between two devices in order to modify the information.

An on-path attack places a threat actor between two communicating devices to intercept or modify transmitted data. Eliminate the other options because passive observation does not include modification, and DDoS attacks use secondary victim systems.

Correct answer: C. Infrastructure-as-a-Service (IaaS)

Infrastructure as a Service provides the highest level of flexibility and customization among cloud models by allowing organizations to manage operating systems, applications, and virtualized hardware. While on-premises offers maximum control, it is not categorized as a cloud service.

Correct answer: D. …To identify, assess, and prioritize risks, and implement appropriate controls to minimize their potential impact

Risk management is a proactive process of identifying, assessing, and prioritizing risks. Appropriate controls are then selected and implemented to reduce their potential impact. Eliminating all risks is impractical, while minimizing costs or relying on reactive measures leaves an organization exposed to unnecessary threats.

Correct answer: B. II and III only

Natural disasters such as tsunamis and forest fires are naturally occurring events considered during disaster recovery planning. Hacking and terrorism are intentional, man-made security incidents, making them separate threat categories that require different preventive controls.

Correct answer: A. Change log

The change log records all modifications made to a system, including security settings. Security logs track events like logon attempts, while application and server logs capture software and operating system errors.

Correct answer: B. … a formal agreement between two or more parties outlining the terms of their working relationship

A Memorandum of Understanding or Agreement is a formal document outlining the working relationship between parties. It differs from strict contracts by often lacking legal binding, focusing instead on mutual expectations.

Correct answer: B. To outline the services provided by an MSP

A Service-Level Agreement defines the expected services and obligations between a service provider and a customer. It establishes measurable performance standards, unlike network segmentation, secure network access, or cloud access configuration.

Correct answer: C. NAC is used to control network access based on a determined policy, while VPN is used to create a secure connection

Network Access Control restricts network access based on endpoint compliance with defined policies. A Virtual Private Network creates an encrypted tunnel for secure remote connections, which distractors oversimplify by isolating the encryption feature.

Correct answer: C. Advanced persistent threat attack

An Advanced Persistent Threat is a stealthy, continuous computer intrusion process targeting a specific entity. While the other options represent valid attack vectors, the acronym APT literally stands for Advanced Persistent Threat, making it the only correct choice.

Correct answer: D. Salt

A salt is a random value added to a password before it is hashed to ensure unique outputs and prevent rainbow table attacks. MD5 is a weak hashing algorithm, while an extender is irrelevant, making Salt the only correct option.

Correct answer: D. Allow list

An allow list ensures only explicitly approved applications can run on a system, blocking everything else by default. A deny list only blocks known malicious software, which fails to prevent unknown threats.

Correct answer: B. Data Loss Prevention (DLP)

Data Loss Prevention tools are specifically designed to detect and block the unauthorized transmission of sensitive data. A network intrusion detection system only detects malicious activity, whereas a firewall simply controls traffic flow.

Correct answer: C. By identifying the critical systems and processes that must be prioritized

A Business Impact Analysis identifies critical systems and processes to prioritize recovery efforts during a disaster. It does not prevent disasters or ignore impacts, but rather forms the foundation of continuity planning.

Correct answer: D. To prevent tailgating or piggybacking

A mantrap prevents tailgating or piggybacking by using two interlocking doors that allow only one person to pass at a time. It mitigates unauthorized physical entry rather than serving as an authentication factor.

Correct answer: A. Protect society, the common good, necessary public trust and confidence, and the infrastructure

The first canon requires protecting society, the common good, public trust, and infrastructure. This canon sits above all others, meaning public safety always supersedes personal or organizational interests.

Correct answer: D. Act honorably, honestly, justly, responsibly, and legally

Refusing a bribe demonstrates the requirement to act honorably, honestly, justly, responsibly, and legally. The other canons address public infrastructure, employer service quality, or advancing the profession, none of which directly cover personal integrity.

Correct answer: A. Encapsulating Security Payload

The Encapsulating Security Payload, or ESP, provides confidentiality by encrypting IP packet payloads. A common trap is Authentication Header, which provides integrity but does not encrypt data.

Correct answer: C. Authentication

Authentication is the process of verifying user identity before granting access. The other options represent security controls like encryption or traffic monitoring that protect data rather than directly verifying identity.

Correct answer: A. To make the training more engaging and help employees better understand the practical implications of security best practices

Real-life examples make security awareness training more engaging and help employees understand practical applications. The remaining options represent negative outcomes that actively harm an organization's security posture.

Correct answer: B. To grant users access to resources based on their job responsibilities

Role-based access control grants users access to resources based on their job responsibilities. The other options describe physical security, encryption, and network monitoring, which are distinct concepts. The exam cue here is that RBAC maps permissions to job functions rather than individual identities.

Correct answer: B. 802.1x

802.1x is the best technology for port-based authentication, ensuring network clients authenticate before gaining access. The trap is picking a standard like 802.3 or 802.11g, which simply define Ethernet and wireless transmission rather than enforcing network access control.

Correct answer: C. Whaling attacks

Whaling attacks are highly targeted phishing campaigns aimed at high-level executives and administrators. The other options are simply made up distractors designed to test your knowledge of social engineering terminology.

Correct answer: A. Worm

Worms replicate independently across networks without user action. Viruses require host execution, distinguishing them from autonomous worms.

Correct answer: D. Right to be forgotten

The right to be forgotten allows individuals to request data erasure under privacy laws. Data portability involves moving data, not deleting it.

Correct answer: B. Regularly performing backups

Performing regular backups is a disaster recovery practice, not a system hardening technique. Hardening reduces an attack surface by disabling unnecessary services, patching software, and implementing strong passwords.

Correct answer: D. Risk tolerance

Risk tolerance defines the acceptable range of variation within an organization's overall risk appetite. Risk appetite is a broad high-level statement, while risk capacity is the absolute maximum risk an organization can survive.

Correct answer: B. Full-disk encryption

Full-disk encryption protects data at rest by making it unreadable without the proper decryption key. Firewalls and antivirus software protect against network threats and malware, but they do not prevent a thief from directly reading the physical drive.

Correct answer: A. Regularly backing up data and using redundant systems

Regularly backing up data and using redundant systems directly ensures timely access to information, fulfilling the availability principle of the CIA Triad. Encryption and authentication primarily protect confidentiality, while monitoring protects integrity and detects threats.

Correct answer: A. Reducing the number of elements of a system

Reducing the number of system elements removes unnecessary software and services to minimize the attack surface. Patch management focuses on fixing vulnerabilities, while configuration management tracks system changes rather than eliminating unnecessary components.

Correct answer: C. By protecting data at rest and in transit from unauthorized access

Encryption hardens a system by protecting data at rest and in transit from unauthorized access, ensuring confidentiality even if other defenses fail. Managing permissions and patching software are separate administrative controls that do not directly secure the data itself.

Correct answer: C. To stop or block attacks

A firewall primarily functions to stop or block network attacks. While they can detect threats or filter malware, the other options describe secondary features or specific technologies rather than the core purpose of network filtering.

Correct answer: C. According to business needs and requirements

Business Continuity Plan testing frequency should be determined by business needs and requirements. Fixed schedules like annual or biannual testing are traps because they ignore the changing risk environment.

Correct answer: C. SaaS

A ready-to-use email service is Software as a Service, or SaaS. You can eliminate IaaS and PaaS because they provide infrastructure or development environments rather than finished, fully managed end-user applications.

Correct answer: D. To ensure the security and privacy of patients' health information

HIPAA establishes rules to ensure the security and privacy of patient health information. The other options target different sectors, like credit card security or financial data, which fall under PCI DSS or GLBA.

Correct answer: C. Inconsistent control

The primary problem with decentralized access control is inconsistent policy enforcement. Because different locations manage their own access, security rules often vary widely, leading to dangerous gaps in coverage.

Correct answer: B. A nation-state-sponsored hacking group

Threat actors are the individuals or groups orchestrating cyberattacks. A nation-state group is an actor, whereas a phishing email is a vector, a vulnerability is a weakness, and a denial-of-service attack is an event.

Correct answer: A. Availability

Availability ensures that authorized users have reliable and timely access to data and systems when needed. Confidentiality protects against unauthorized disclosure, and integrity ensures data remains unaltered.

Correct answer: A. Electronic access control

Electronic access control relies on electronic cards or key fobs containing unique identifying data to manage facility entry. Mechanical locks require physical keys, and biometrics rely on biological traits.

Correct answer: D. To implement controls and countermeasures that reduce the likelihood or impact of identified risks

Risk mitigation applies proactive controls to reduce the likelihood or impact of identified risks. Disregarding risks or relying purely on reactive measures fails to minimize potential organizational damage.

Correct answer: B. Due care

Due care is the legal standard of practicing the level of reasonable responsibility a prudent person would exercise in similar circumstances. Due diligence is the ongoing practice of ensuring these required safeguards are actually maintained.

Correct answer: D. Provide diligent and competent service to principals

The ISC2 Code of Ethics mandates providing diligent and competent service to principals, which means delivering quality work to employers and clients. The other options represent separate canons focused on society, integrity, and advancing the profession.

Correct answer: D. UPS

An uninterruptible power supply provides immediate backup power to systems during an electrical outage. While redundant servers and RAID arrays improve availability, they cannot function without electricity, making a UPS the direct safeguard.

Correct answer: A. Intrusion Detection System (IDS)

An intrusion detection system monitors network traffic to detect potential threats using predefined rules or signatures. Firewalls actively block traffic based on rules, while proxy servers and VPN gateways serve different networking and security functions.

Correct answer: D. Acknowledging that certain risks are too costly or impractical to mitigate and accepting the potential consequences

Risk acceptance means acknowledging that certain risks are too costly or impractical to mitigate and accepting the potential consequences. The trap is that implementing controls to eliminate all risk is impossible, while ignoring risks or avoiding the process entirely represents negligence, not informed acceptance.

Correct answer: B. Something you are

Voice pattern recognition is a biometric factor classified as something you are, because it relies on unique physical or behavioral characteristics. The trap is confusing this with something you know, like a password, or something you have, like a physical token.

Correct answer: C. To gain unauthorized access to sensitive data and maintain a long-term presence in the target network

An Advanced Persistent Threat aims to gain unauthorized access to sensitive data and maintain a long-term, undetected presence in the target network. The trap is confusing APTs with denial of service attacks, which disrupt services, or malware designed to spread quickly.

Correct answer: B. Providing proof that a specific sender sent a specific message

Non-repudiation provides undeniable proof that a specific sender sent a specific message, preventing them from denying the action. The distractors map to other security principles, such as confidentiality for unreadable messages and integrity for unaltered messages.

Correct answer: C. Storage phase

The second phase of the secure data handling lifecycle is storage, where generated or received data is securely saved to servers or databases. The creation phase comes first, while sharing and destruction occur later in the data lifecycle.

Correct answer: C. Spear Phishing Attack

Spear phishing uses highly targeted, deceptive emails that appear to come from a trusted source to trick users into revealing sensitive data or downloading malware. Denial-of-service attacks disrupt availability, while on-path attacks intercept live network traffic.

Correct answer: A. Specify which users have access to resources

An access control list specifies exactly which users or groups have access to specific system resources. It does not actively monitor unauthorized access, nor does it dynamically adjust permissions or set default configurations without administrative input.

Correct answer: B. Virtual Private Network (VPN)

A virtual private network securely connects remote users to a private network over the public internet by encrypting their communications. Firewalls filter traffic, intrusion detection systems monitor for threats, and proxy servers act as intermediaries.

Correct answer: C. Discretionary

Discretionary access control empowers the owner or creator of a resource to decide who gets access and what actions they can perform. Role-based and non-discretionary models rely on system administrators or central organizational policies.

Correct answer: A. To detect and block malicious attacks

An intrusion detection and prevention system actively monitors network traffic to detect and block malicious attacks in real time. Stopping malicious code or detecting connections are specific secondary functions rather than the primary overarching purpose.

Correct answer: A. A next-generation firewall (NGFW)

A next-generation firewall integrates traditional traffic filtering with advanced features like application awareness and intrusion prevention. The other options handle isolated tasks like encryption or blocking exploits but cannot replace comprehensive firewall functionality.

Correct answer: D. Policies

Policies establish strategic direction and priorities by outlining high-level organizational rules and expectations. Standards mandate specific technical requirements, while procedures provide the granular steps needed to implement those policies.

Correct answer: B. Developing strategies to maintain essential operations during and after a major incident

A business continuity plan develops strategies to maintain essential operations during and after a major disruption. The negative distractors are dangerous assumptions because ignoring alternate facilities or focusing solely on prevention guarantees operational failure.

Correct answer: C. SaaS

Software as a Service places the most security responsibility on the provider because they manage everything from the underlying infrastructure to the application itself. Infrastructure and Platform models leave the customer managing applications or operating systems.

Correct answer: C. The risk that remains after all possible controls and countermeasures have been applied

Residual risk is the portion of risk that remains after all selected controls and countermeasures have been applied. Total elimination of risk is impossible, and the initial risk before controls is simply the inherent risk.

Correct answer: D. Self-service password reset

Implementing self-service password reset directly decreases help desk tickets by empowering users to securely unlock their own accounts. Alternative authentication methods improve security but fail to address the volume of password reset requests.

Correct answer: D. Integrity

Integrity ensures data remains accurate and unaltered during its lifecycle. While authentication verifies access, it does not prevent modifications once access is granted.

Correct answer: D. Bring Your Own Device (BYOD) Policy

A bring your own device policy governs personal equipment use for business. Acceptable use dictates behavior, not hardware permissions.

Correct answer: A. Asymmetric-key cryptography

Digital signatures rely on asymmetric cryptography, using public and private key pairs. Symmetric cryptography uses shared keys, making non-repudiation impossible.

Correct answer: C. Rainbow Table Attack

Rainbow table attacks use pre-computed hashes to reverse passwords quickly. Dictionary attacks guess passwords using word lists rather than hash databases.

Correct answer: B. To prevent unauthorized access to facilities and protect sensitive information and resources

Physical access controls prevent unauthorized facility entry to protect assets. Public access and unrestricted entry defeat security goals, while technical controls remain necessary.

Correct answer: A. …that employs multiple layers of security measures for comprehensive protection

Defense in depth employs multiple layers of security controls to protect systems and data. Relying on a single layer leaves vulnerabilities, so this layered approach provides comprehensive protection against various threats.

Correct answer: A. Provide diligent and competent service to principals

Withholding crucial vulnerability information violates the canon to provide diligent and competent service to principals. Failing to inform the client prevents them from making informed decisions and securing their environment.

Correct answer: B. HIDS

A Host-based Intrusion Detection System monitors and detects malicious behavior on an individual device. A Network Intrusion Detection System monitors network traffic, while a firewall blocks unauthorized traffic.

Correct answer: B. To collect evidence and maintain its chain of custody for potential legal proceedings

Forensic investigations during incident response focus on collecting and preserving evidence to maintain a strict chain of custody for legal proceedings. Identifying attacker motivation or updating risk registries are secondary tasks that depend on properly preserved evidence.

Correct answer: D. Public relations coordinator

The public relations coordinator manages consistent and accurate communication with external parties, including media and law enforcement. The technical and incident leads focus on operational containment, while legal advisors handle liability and compliance guidance.

Correct answer: A. National Institute of Standards and Technology (NIST)

The National Institute of Standards and Technology is a U.S. government agency that publishes free cybersecurity frameworks and technical standards. ISO, IEEE, and IETF are international or professional organizations that typically charge for their published standards.

Correct answer: A. To establish a minimum level of protection that can be used as a reference point

Baselines establish a minimum level of protection and standard operating conditions to serve as a reference point for future security comparisons. Identifying threats or monitoring events are functions of risk assessment and security tools, not the baselines themselves.

Correct answer: D. An external hacker breaching the company's firewall

An insider threat originates from someone with authorized access, such as an employee or vendor. External hackers do not have authorized internal access, which clearly eliminates employees, contractors, and vendors as examples of insiders.

Correct answer: D. Something you have

A mobile phone callback is a possession-based authentication factor. The system verifies that the user has the registered physical device. It does not rely on biometric traits, knowledge, or location.

Correct answer: A. Symmetric encryption uses the same key for encryption and decryption, while asymmetric encryption uses different keys for encryption and decryption

Symmetric encryption uses the same secret key for both encryption and decryption. Asymmetric encryption uses a public and private key pair, rendering the other options incorrect regarding speed and fundamental mechanics.

Correct answer: B. Policy

Access control consists of three layers: technical, physical, and administrative. Policies govern administrative controls, but the policy itself is not categorized as a standalone fourth layer.

Correct answer: D. Post-incident Activity

Post-incident activity focuses on long-term fixes and lessons learned after an event is resolved. Containment and eradication handle immediate threats, whereas preparation establishes baseline readiness.

Correct answer: C. Alice's private key

In asymmetric encryption, a sender encrypts a confidential message using the recipient's public key. The recipient must then use their matching private key to decrypt it, ensuring only the intended party can read the message.

Correct answer: C. Authentication

Authentication proves a user's identity, typically by verifying credentials like a username and password. Authorization determines what resources an authenticated user can access, making the latter a distinct subsequent step.

Correct answer: A. A threat is a potential source of harm, while a vulnerability is a weakness in a system

A threat is any potential event or actor capable of causing harm, whereas a vulnerability is an actual flaw or weakness that a threat can exploit. Identifying this distinction is fundamental to assessing organizational risk.

Correct answer: A. Requiring password and sms token

Requiring a password alongside an SMS token implements multi-factor authentication by combining something you know with something you have. Options like personal answers or PIN codes remain single-factor, lacking the necessary hardware verification.

Correct answer: C. Service-level agreement (SLA)

A Service-Level Agreement is a formal contract between a provider and a customer that defines specific performance metrics like uptime and response times. Internal departments use Operational Level Agreements, which differ from customer-facing commitments.

Correct answer: B. Access controls and encryption

Access controls and encryption are primary measures to protect the confidentiality of the CIA Triad by ensuring only authorized users can read sensitive data. Backups protect availability, while checksums and digital signatures protect data integrity.

Correct answer: A. It does not interact directly with servers and other infrastructure devices

Privileged accounts are specifically designed to interact directly with servers and infrastructure devices to perform critical administrative tasks. Requiring multi-factor authentication, assigning permissions, and enabling high-level logging are all required attributes of privileged accounts.

Correct answer: A. To prevent tailgating

A mantrap is designed to prevent tailgating by creating a small space with two interlocking doors, ensuring only one person enters at a time. It does not replace security personnel or grant unrestricted access, but strictly controls physical entry.

Correct answer: D. Access control list (ACL)

An access control list is a technical control that enforces security policies by specifying system access permissions. Stop signs, acceptable use policies, and emergency procedures are administrative controls, as they govern human behavior and organizational processes.

Correct answer: A. Public cloud

In a public cloud model, customers share computing infrastructure without knowing the identity of other tenants. Private clouds dedicate infrastructure to a single organization, while community clouds are shared among known organizations with common requirements.

Correct answer: D. Establishing clear roles and responsibilities for personnel during disaster recovery efforts

A disaster recovery plan must establish clear roles and responsibilities for personnel to ensure effective response during a crisis. The other options describe ignoring backups and offsite facilities, which directly contradict disaster recovery best practices.

Correct answer: B. Mandatory vacation

Mandatory vacation is a primary detective control used to uncover fraudulent behavior by requiring another employee to cover the perpetrator's duties. Separation of duties prevents fraud, but mandatory vacation detects ongoing malicious activity.

Correct answer: C. Application, Presentation, and Session

The Application layer of the TCP/IP model maps directly to the top three layers of the OSI model: Application, Presentation, and Session. A common trap is assuming a one-to-one mapping across all layers, but TCP/IP consolidates upper-layer functions.

Correct answer: C. QoS

Quality of Service, or QoS, is the technology that prioritizes critical network traffic like voice and video over less important traffic. VLANs separate networks, TLS provides encryption, and VPNs create secure connections, but none of these directly manage traffic prioritization.

Correct answer: C. A user's date of birth

Personally Identifiable Information includes data that can identify a specific individual, such as a user's date of birth. The elimination cue is that corporate policies, public posts, and topology diagrams do not directly identify a living person.

Correct answer: B. To enforce the use of strong, complex passwords and periodic password changes

A password policy primarily enforces strong, complex passwords and periodic changes to reduce unauthorized access. Option C is a trap, as while unique passwords are a good practice, policy enforcement primarily targets complexity and lifecycle management rather than strict cross-system uniqueness.

Correct answer: B. Procedures

Procedures provide the step-by-step, granular actions required to implement a specific security measure or technical process. Policies set the high-level organizational direction, while regulations are external legal requirements and standards provide mandatory baseline controls.

Correct answer: B. Identifying and evaluating potential risks based on their likelihood and impact

Identifying and evaluating potential risks based on their likelihood and impact is the core goal of a risk assessment. The distractors describe bad security practices, such as ignoring threats or avoiding frameworks, which defeat the purpose of risk management.

Correct answer: A. On Path Attack

An on-path attack, formerly known as a man-in-the-middle attack, involves secretly intercepting and potentially altering communication between two parties. DDoS attacks overwhelm resources, and SQL injection targets web application databases.

Correct answer: A. Restoring the business to full last-known reliable operations

A disaster recovery plan aims to restore systems and operations to their last known reliable state after a disruption. A business continuity plan keeps critical functions running during a crisis, while emergency response plans guide immediate physical safety actions.

Correct answer: C. Phishing

Phishing attacks frequently abuse URLs and hyperlinks in emails to misdirect users to fraudulent websites. Spoofing only fakes an identity, while a denial-of-service attack disrupts availability rather than stealing credentials.

Correct answer: D. Buffer Overflow Attack

A buffer overflow occurs when malicious data exceeds allocated memory, causing crashes. Denial of service uses request flooding, while on-path attacks intercept traffic.

Correct answer: C. Key cards

Key cards authenticate users by matching embedded data against an authorized database. Surveillance and sign-in sheets monitor activity but lack identity verification.

Correct answer: C. Privilege creep

Privilege creep occurs when users accumulate outdated permissions after changing roles. Excessive provisioning happens initially, whereas creep develops over time.

Correct answer: A. Privilege creep

Privilege creep occurs when a user accumulates system privileges that exceed their job requirements over time. However, the term excessive privileges also accurately describes this state, making the options potentially ambiguous. Excessive privileges can result from privilege creep.

Correct answer: D. Reusing passwords for multiple systems

Reusing passwords across multiple systems increases the risk of credential stuffing attacks. Using a password manager and maintaining unique credentials are fundamental security practices that prevent a single breach from compromising multiple accounts.

Correct answer: D. The right to be forgotten

The right to be forgotten allows individuals to request the erasure of their personal data. Data portability and access rights grant visibility or movement of data, but they do not mandate its deletion.

Correct answer: D. To ensure the organization can continue to operate during and after a disaster or major incident

A Business Continuity Plan ensures critical business operations continue during and after a disruption. Distractors suggesting the avoidance of recovery strategies or ignoring coordinated responses represent the exact opposite of continuity planning goals.

Correct answer: C. A cryptographic key is required

Hashing provides integrity by creating a fixed-length digital fingerprint from variable-length data without using a cryptographic key. Options mentioning irreversibility and collision resistance describe essential hash properties, making the key requirement the false attribute.

Correct answer: A. Stop Sign in a Parking Lot

A stop sign is an administrative control because it directs human behavior through a rule rather than physically blocking access. Physical controls are tangible barriers like bollards, turnstiles, and door locks that physically restrict entry.

Correct answer: D. Synchronous

Synchronous tokens generate one-time passwords at fixed time intervals, relying on internal clocks rather than a server challenge. Asynchronous tokens require a challenge-response mechanism, while smart cards and RFID use different hardware methods.

Correct answer: A. Degaussing

Degaussing is the most effective method to destroy data on magnetic tapes or disks, using a strong magnetic field to permanently erase data. Disk zeroing, formatting, and encryption do not physically destroy the magnetic media, leaving potential for data recovery.

Correct answer: D. Voiceprint

Biometric authentication relies on unique biological characteristics, proving a voiceprint is the correct answer. The other options represent something you know, like a password or PIN, or something you have, like a physical key or token.

Correct answer: C. Identify risks

The risk management process begins with identifying risks, as you cannot analyze or mitigate a threat without first discovering it. Analyzing, assessing, and mitigating risks are subsequent phases that rely entirely on accurate initial identification.

Correct answer: D. Regression

Change management relies on a structured process to minimize disruptions. The core components include requesting a change, obtaining approval, and having a rollback plan, making regression the correct choice. The distractors represent actual phases or required actions in the standard workflow.

Correct answer: C. Advanced Persistent Threat

An Advanced Persistent Threat refers to a long-term, highly resourced attack. Threat actors use continuous and stealthy techniques to gain unauthorized access to a target network. The other options are fabricated terms designed to test your knowledge of security acronyms.

Correct answer: B. When two or more individuals collaborate to circumvent segregation of duties for fraudulent purposes

Collusion defeats segregation of duties controls. It happens when multiple people coordinate their efforts to bypass security measures and commit fraud. The remaining options merely describe normal workplace collaboration or shift coverage without any malicious circumvention of controls.

Correct answer: B. Provide active and diligent service to principals

The ISC2 Code of Ethics canon is to provide diligent and competent service to principals. This option incorrectly states active and qualified service, making it the false choice. The remaining options accurately reflect the mandatory ethical canons.

Correct answer: C. Create, Store, Use, Share, Archive, Destroy

The standard data lifecycle components are create, store, use, share, archive, and destroy. The distractors swap in synonyms like delete or save, but ISC2 expects these exact terms.

Correct answer: C. Regular backup of data and systems in multiple dispersed geographical locations

Regular backups stored across multiple dispersed geographic locations directly mitigate data loss from localized disasters or system failures. The distractors represent physical security, awareness, or financial transfers rather than actual data preservation.

Correct answer: C. Incident Response

Incident response is the structured sequence of activities required to properly handle a security incident from detection through recovery. Incident management is a broader IT service desk concept, and investigation is just one specific phase.

Correct answer: B. Which information is considered personally identifiable information (PII)

A privacy policy stipulates how an organization collects, uses, and protects personally identifiable information. Breach notification steps belong in an incident response plan, weakening the other options.

Correct answer: B. SFA uses one authentication method, while MFA uses two or more authentication methods

Single factor authentication relies on one method, while multi factor authentication requires two or more distinct factors. The distractors simply reverse the definitions or incorrectly limit the maximum number of allowed factors.

Correct answer: B. Within 72 hours

Under GDPR, organizations must notify the relevant supervisory authority of a qualifying personal data breach within seventy two hours. The other timeframes are incorrect regulatory variations and serve as pure memorization traps.

Correct answer: B. Business Continuity Plan is about maintaining critical business functions, while Disaster Recovery Plan is about restoring IT and communications back to full operations

A Business Continuity Plan maintains overall critical business functions during a disruption, while a Disaster Recovery Plan specifically focuses on restoring IT and communications to full operation. Remember that BCP keeps the business running, whereas DRP brings the technical systems back online.

Correct answer: C. Hot site

A hot site is a fully equipped facility that allows an organization to immediately resume operations after a disaster. Warm and cold sites require additional time, equipment, or configuration before operations can safely resume.

Correct answer: D. To provide a clear and consistent process for handling security incidents and minimizing their impact

A documented incident response plan provides a clear, consistent process for handling security incidents and minimizing their overall impact. The alternative options suggest ignoring incidents or reducing security training, which directly violate foundational security principles.

Correct answer: D. Recovery of the system to the state it was in before the change was made

A rollback plan provides a predefined procedure to restore a system to its previous state if a change causes unexpected failures. This ensures business continuity, unlike options related to testing patches or introducing updates.

Correct answer: B. Security of the personnel

The primary consideration when selecting physical access controls is always the safety and security of personnel. While protecting equipment, buildings, and networks is important, human life and safety are paramount in security design.

Correct answer: C. The cost of implementing the controls to the value of what is being protected

When implementing physical access controls, the cost of the controls must be proportional to the value of the assets being protected. Security measures should be cost-effective, avoiding excessive spending on low-value items.

Correct answer: A. Compares the individual's badge against a verified database

Access control systems commonly authenticate individuals by comparing their presented credentials, such as a badge, against a verified database. The remaining options are invalid because access times, clothing, and unrelated biometric comparisons do not provide reliable identity verification.

Correct answer: A. Using a rogue interactive voice response system

Vishing is a social engineering attack that uses voice communication, often through a rogue interactive voice response system, to steal information. The other options describe different concepts like tailgating or general authority impersonation rather than voice-based fraud.

Correct answer: C. Data breach

A data breach is the resulting compromise of a successful cyber attack, not an attack technique itself. The other options are active methods or actions used by threat actors to compromise systems and facilitate those breaches.

Correct answer: A. A policy uniformly enforced across all subjects and objects within the system boundary

Mandatory Access Control enforces a strict security policy uniformly across all subjects and objects within a system boundary using classification labels. The other options describe discretionary control, physical security, or unrestricted access, which contradict the MAC framework.

Correct answer: A. Automatically installed through phishing emails or by visiting an infected website

Ransomware primarily relies on social engineering to compromise systems. Attackers often deliver malicious payloads through phishing emails or compromised websites. The remaining options fail to represent the most common and realistic infection vectors used by threat actors.

Correct answer: D. GDPR

The General Data Protection Regulation is a law with significant multinational implications. It affects any organization handling the personal data of individuals within the European Union. The other options are globally recognized standards or frameworks rather than enforceable laws.

Correct answer: D. Packet analysis

Side-channel attacks gather information from the physical implementation of a system. Attackers exploit timing, power consumption, or fault analysis rather than standard network data. Packet analysis is a network diagnostic tool and not a characteristic indicator of physical system compromise.

Correct answer: B. Employee well-being programs

Business continuity plans prioritize operational resilience and emergency response procedures, making employee well-being programs out of scope. The distractors are core elements because they address communication and operational recovery during a crisis.

Correct answer: D. Access to physical premisses

Acceptable use policies govern digital resources like networks, systems, and data, rather than physical building access. Facilities access is managed by physical security controls and policies, making it the clear outlier here.

Correct answer: D. More than four

Maintaining more than four data classification tiers becomes administratively difficult and resource intensive. Lower tier counts offer adequate protection without overwhelming administrative overhead, making this the threshold.

Correct answer: A. Yes, because it poses a risk to individuals' rights and freedoms

A Data Protection Impact Assessment is required when processing poses a high risk to individuals rights and freedoms, such as public surveillance. Public collection and privacy policies do not waive this requirement, and the assessment must happen before deployment to be effective.

Correct answer: B. Ensure everyone knows what is expected of them

Awareness training ensures everyone understands security expectations and their role in protecting the organization. Testing technologies or providing breaks are not the educational goals of a security awareness program.

Correct answer: A. A flaw causing an application to produce an unintended or unexpected result that may be exploitable

A bug is a flaw causing an application to produce an incorrect or unexpected result that may be exploitable. A bug creates a vulnerability, but the terms are not interchangeable, and a risk is a potential negative event.

Correct answer: D. 64°F to 81°F (18°C to 27°C)

The recommended temperature range for a data center is 64 to 81 degrees Fahrenheit, or 18 to 27 degrees Celsius. Maintaining this specific range optimizes hardware lifespan while preventing failures caused by overheating or excessive cooling.

Correct answer: C. IDS

Intrusion detection systems are detective controls because they monitor traffic and alert administrators after malicious activity occurs. Firewalls and intrusion prevention systems are preventative controls, while turnstiles act as physical deterrents.

Correct answer: C. Risk

Risk is the combination of likelihood and impact when a threat exploits a vulnerability. A breach is an event, a zero-day is a specific unknown vulnerability, and a vulnerability is merely a weakness.

Correct answer: B. Access to software applications

Software as a Service provides consumers with access to software applications over the internet. Hardware, network, and security components belong to infrastructure, network, and security as a service models.

Correct answer: C. Router

A router determines the most efficient path for traffic based on network topology and IP addresses. Switches use MAC addresses, firewalls filter traffic, and hubs simply broadcast to all ports.

Correct answer: C. Grant the appropriate level of access to authorized personnel and processes

Access control primarily ensures that authorized personnel and processes receive the appropriate access levels. Options A, B, and D act as distractors by describing secondary effects or focusing only on insiders or outsiders.

Correct answer: D. … the protection against an individual falsely denying having performed a particular action

Non-repudiation proves that a specific individual performed an action, preventing them from falsely denying it. Privacy rights and general security measures act as distractors, while non-repudiation is a principle, not a law.

Correct answer: D. A possible event that can negatively impact the organization

Risk is defined as a possible event that negatively impacts an organization. The other options define core risk components like threat actors, vulnerabilities, and exploits, but do not represent the overall concept of risk.

Correct answer: B. Trojan

A Trojan disguises itself as legitimate software to trick users into executing its malicious payload. Worms self-replicate, viruses attach to files, and spyware collects data covertly without relying on deceptive disguises.

Correct answer: D. The results of a site assessment

A site assessment provides the primary data needed to determine where security controls are required. Evaluating the work area is important, but a comprehensive assessment considers all physical and operational risks.

Correct answer: A. Only properly designated security administrators

In Mandatory Access Control, designated security administrators strictly control access using classification labels. Standard users and executives cannot alter these permissions, distinguishing MAC from discretionary models.

Correct answer: D. Reduce the potential of security breaches to an acceptable level

The primary goal of a well-designed security policy is to reduce the potential of security breaches to an acceptable level. Security is never about absolute guarantees, so any option implying zero risk is a trap on the exam.

Correct answer: D. A group of computers sharing data, information or resources

A network is fundamentally a group of computers that share data, information, or resources. Any option describing a single machine or a group of disconnected computers acts as a distractor because connectivity and resource sharing are the defining characteristics.

Correct answer: A. It is a type of attack used to disrupt normal operations

A Denial of Service or DoS attack is specifically designed to disrupt normal operations by making a system unavailable. Options mentioning bypassing authentication or gaining system access describe entirely different attack vectors, such as spoofing or unauthorized access.

Correct answer: D. The subject who created the object

Discretionary Access Control allows the subject who created the object, or the owner, to dictate access control rules. The owner has the discretion to decide who gets access. This differs from mandatory access control, where a central authority enforces strict rules.

Correct answer: C. Duplicate components as a backup in case of failure

Redundancy in system design involves including duplicate components as a backup to ensure continued operation if a primary component fails. The goal is maintaining availability and preventing downtime, rather than using diverse suppliers or saving costs by reducing parts.

Correct answer: D. They proceed only after a competent court or authority has made a factual determination

ISC2 relies on the findings of a competent legal or regulatory authority before taking disciplinary action for alleged illegal acts. This ensures due process, because ISC2 is not a law enforcement agency and lacks the mandate to conduct forensic investigations or act on unproven accusations.

Correct answer: A. A minimum level of protection that can be used as a reference point

A security baseline is a minimum level of protection used as a reference point. Any system changes should not reduce security below this baseline, making maximum protection and validation processes distractors.

Correct answer: B. A firewall

A firewall is a preventative network security control that actively monitors and filters traffic. Access logs and user credentials are not controls themselves, but rather configuration elements or records used for identification and monitoring.

Correct answer: A. Issuing a badge with the employee's credentials, possibly including biometrics

High-security enrollment often involves issuing a badge embedded with credentials and biometric data. This ensures accurate authentication, whereas letting users choose identifiers or collecting irrelevant religious history weakens security and violates privacy.

Correct answer: A. Protect the assets of a company, including its personnel

Physical access controls are primarily designed to protect company assets and personnel by preventing unauthorized entry. While they may track movement, features like easy entry or open facility access defeat their core security purpose.

Correct answer: A. The attempt is logged, and the user is blocked

Standard security practice dictates that unauthorized access attempts should be logged and blocked immediately to prevent potential data breaches. Issuing warnings or deleting accounts are not typical automated responses, and promoting access violates the principle of least privilege.

Correct answer: B. The ends of a network communications link