ISC2 Certified in Cybersecurity (CC) - Blueprint Practice Exam 1

1. A board approves the amount of cyber risk the business is willing to take. What is being established?
2. A browser validates a server certificate before sending a password over TLS. What does validation help establish?
3. A business lists threats, weaknesses and likely consequences before choosing controls. What activity is this?
4. A clinic encrypts patient exports before sending them to an approved processor. Which objective is primarily supported?
5. A cloud service adds capacity quickly as demand rises and releases it afterward. Which characteristic is illustrated?
6. A company rents cloud virtual machines. Who ordinarily patches the guest operating systems under the standard IaaS model?
7. A contractor's engagement ends today. Which action best closes their identity lifecycle?
8. A dashboard shows fewer alerts after a sensor fails. What should management conclude?
9. A dataset contains personal identifiers unnecessary for an analytics task. What is the best initial handling choice?
10. A factory's legacy sensor cannot be patched safely during production. Which compensating measure is suitable pending approved remediation?
11. A firewall is placed between guest devices and internal finance systems. What is its main purpose?
12. A guard checks employee badges before opening a restricted door. Which combination best describes the control?
13. A manager approves temporary elevated access for a repair. Which lifecycle measure is most suitable?
14. A payroll clerk transfers to marketing. What should the access change include?
15. A printed document is shredded before disposal. Which stage of data handling is illustrated?
16. A provider runs the operating system and runtime, while the customer deploys application code. Which model is this?
17. A quarterly review finds a shared administrator account used by an entire team. What is the main concern?
18. A remote worker needs protected connectivity through an untrusted network. Which control is most appropriate?
19. A service bot needs to read one dataset nightly. What authorization is appropriate?
20. A service must be restored within four hours. Which requirement is this?
21. A signed change record links a named administrator to an approved action. Which objective does this support?
22. A standard requires multifactor authentication; a document explains the enrollment steps. What is the second document?
23. A tabletop exercise reveals nobody can authorize isolating a critical host. What should be improved?
24. A team scans an application before release and records remediation decisions. Which objective is supported?
25. A team suspects credentials leaked through an AI assistant's logs. What is the appropriate response?
26. A technician discovers a serious weakness during authorized work. Which response best follows professional ethics?
27. A user knows a valid password but has no permission to open payroll records. Which distinction explains the denial?
28. A zero trust policy evaluates each resource request instead of trusting a user solely because they are on the LAN. What principle is applied?
29. An analyst correlates failed logins across several applications. Which platform typically supports this analysis?
30. An approved control reduces risk but cannot eliminate it. What remains after implementation?
31. An assistant modifies training labels without permission, causing bad model decisions. Which objective is most directly violated?
32. An endpoint alert could be a benign maintenance script. What should happen before declaring a confirmed incident?
33. An online booking service survives a server failure using a redundant instance. Which objective is supported?
34. An organization routinely reviews supplier controls before renewal. Which concept is most directly demonstrated?
35. Employees keep falling for AI-generated voice impersonation. What is the best governance improvement?
36. One employee can request, approve and pay a supplier invoice. Which principle would reduce this risk?
37. The business can lose at most 15 minutes of transaction data. Which recovery measure expresses this?
38. Which activity should establish the recovery priority of payroll versus a public marketing site?
39. Which pair represents distinct authentication factor categories?
40. Why are network segmentation and endpoint protection used together?

Comments — 0