ISC2 Certified in Cybersecurity (CC) Certification Exam Practice Test
The ISC2 Certified in Cybersecurity (CC) practice page covers foundational security decisions involving identity, data protection, system maintenance, application input, and physical safeguards. Its question bank uses workplace scenarios to connect security concepts—such as authentication factors, encryption, integrity checks, and separation of duties—to practical actions.
Exam overview
About the ISC2 Certified in Cybersecurity (CC) Certification Exam
The scenarios exercise judgment about matching a security objective to an appropriate control. They cover verifying identity during account recovery, removing access during employee offboarding, and adding an independent authentication factor to reduce password-only risk. Other questions address using cryptographic hashes to detect document changes, encrypting stored files on a lost device, and applying operating-system updates to reduce exposure to known vulnerabilities. Application-security items focus on parameterized queries that keep untrusted input from altering database command structure. Physical-security decisions consider where critical systems are placed and who can reach them. Together, these examples build familiarity with basic control selection, confidentiality, integrity, authentication, vulnerability reduction, and checks that limit unilateral changes to sensitive configurations.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A company must provide an external auditor with evidence that a particular document has not been altered since it was approved. Which technique can help detect changes to the document?
Show answer
Correct answer: AA cryptographic hash produces a fixed-length value derived from the document. A changed document will ordinarily produce a different hash, allowing integrity checks.
A company needs to ensure that a user who leaves the organization can no longer use their former work account. What should the organization do as part of offboarding?
Show answer
Correct answer: APromptly disabling the account and revoking related access prevents the former user from continuing to use organizational credentials and permissions. Offboarding should also account for other issued access mechanisms as appropriate.
A company is deciding whether to place a critical system in a publicly accessible area of its data center. Which consideration is most relevant to physical security?
Show answer
Correct answer: APhysical placement should account for exposure to unauthorized access, tampering, and environmental or accidental damage. The other considerations do not address physical security risk.
An organization wants to confirm that a person requesting a password reset is the account holder. Which action best supports that goal?
Show answer
Correct answer: BA password reset can transfer control of an account, so the requester’s identity should be verified using the organization’s approved process before making the change.
A company wants to reduce the chance that a single stolen password will let an attacker access a remote account. Which measure provides an additional independent authentication factor?
Show answer
Correct answer: AA hardware security key provides a separate authentication factor based on possession. Using it with a password is multifactor authentication, which can make password theft alone insufficient for access.
A company needs to protect sensitive files if a laptop is lost. Which measure most directly helps keep the files unreadable to someone who obtains the device?
Show answer
Correct answer: AFull-disk encryption makes stored data unreadable without the required cryptographic key or authentication. Screen locks and privacy filters help against viewing an active display but do not by themselves protect data on a removed drive.
An organization wants to reduce the chance that attackers can use an old, publicly known flaw in a workstation operating system. Which ongoing practice is most appropriate?
Show answer
Correct answer: AA managed patching process helps remediate known vulnerabilities while allowing updates to be assessed and deployed in a controlled way. The other actions do not address the operating system flaw.
How to use this practice test
Access is free. A session presents up to 20 randomly selected questions from the 50-question bank, and results appear after the session. Use the explanations in each scenario to check whether you can distinguish controls by purpose—for example, encryption for confidentiality versus hashing for detecting changes.
Preparation tips
- For each scenario, identify the security goal first—confidentiality, integrity, authentication, or access control—then select a control that directly supports it.
- Compare password-only login with multifactor authentication, and distinguish identity verification during password recovery from authentication at sign-in.
- Review how encryption protects readable data, how hashes can reveal changes, and how a public-key recipient decrypts information with the corresponding private key.
- Practice recognizing parameterized queries as a way to separate database commands from user-supplied input, and software patching as a response to known flaws.
- For access and change-control scenarios, consider account deprovisioning, least access, physical exposure, and separation of duties.