ISC2 ISC2CC Practice Test

ISC2CC practice test: what's covered

• Entry-Level Cybersecurity Certification

Free ISC2CC sample questions

1. A hospital is selecting controls and wants to anchor every decision to the three core security objectives. Which set correctly names the CIA triad?

   • A. Confidentiality, Integrity, and Availability of information
   • B. Compliance, Identification, and Auditing of all user activity
   • C. Control, Identity, and Accountability across the enterprise
   • D. Cryptography, Isolation, and Authentication of systems
   Show answer

   Correct: A. The CIA triad is Confidentiality, Integrity, and Availability, the foundational objectives every control supports. The other choices are incorrect because they swap in unrelated terms such as compliance, auditing, or cryptography, which are activities or tools rather than the three core security goals themselves.

2. A finance team stores customer account numbers and must keep them secret from anyone not authorized to view them. Which objective and control pair best supports this goal?

   • A. Availability, supported primarily by redundant power supplies
   • B. Confidentiality, supported by encryption and access controls
   • C. Integrity, supported by cryptographic hashing of files
   • D. Non-repudiation, supported by detailed system logging
   Show answer

   Correct: B. Keeping data secret from unauthorized parties is confidentiality, best enforced with encryption plus access controls. Availability and redundancy address uptime, not secrecy; integrity and hashing detect tampering rather than prevent disclosure; logging supports accountability but does not by itself keep data confidential, so those options are incorrect.

3. An auditor needs assurance that financial records have not been altered since they were approved. Which combination of mechanisms best provides integrity?

   • A. Load balancers and clustered failover servers
   • B. Full-disk encryption of the storage volume
   • C. Hashing, digital signatures, and version control
   • D. RAID arrays and offsite tape backups
   Show answer

   Correct: C. Integrity is verified using hashing, digital signatures, and version control, which detect unauthorized changes and prove a record matches its approved state. Load balancing and RAID support availability, not change detection, and encryption protects confidentiality, so they do not directly assure that data has remained unaltered.

4. An e-commerce site must stay reachable during a holiday traffic surge and a possible flood of malicious requests. Which approach best protects availability?

   • A. Encrypting the database with a strong cipher
   • B. Hashing all stored customer passwords
   • C. Requiring multifactor login for shoppers
   • D. Redundancy, fault tolerance, and DDoS protection
   Show answer

   Correct: D. Availability ensures systems are accessible when needed, achieved through redundancy, fault tolerance, and DDoS protection. Encryption and password hashing protect confidentiality, while multifactor authentication strengthens access control; none of these keep a service reachable under load, so they are incorrect for an availability goal.

5. A user enters a username and a one-time code from a token before the system grants any access. This act of confirming the claimed identity is best described as which step?

   • A. Authentication of the claimed identity using factors
   • B. Authorization to specific resources after login
   • C. Identification by presenting a username only
   • D. Accounting that records the user's later actions
   Show answer

   Correct: A. Authentication verifies a claimed identity using one or more factors, such as a token code. Identification is only the initial claim (the username), authorization decides what an already-verified user may do, and accounting logs activity afterward, so those options describe different steps in the access process and are incorrect here.

Last updated: 2026-09-23

ISC2CC practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test