10 beginner questions on the CC domains: security principles (availability, control types, the ISC2 Code of Ethics), security governance (disaster recovery), IAM concepts (separation of duties, least privilege), networking and cloud security (IaaS, zero trust) and security operations and incident response (tabletop exercises, hashing).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A distributed denial-of-service (DDoS) attack makes a company's online store unreachable for several hours. Which security principle is most directly affected?

    • A. Confidentiality
    • B. Integrity
    • C. Non-repudiation
    • D. Availability ✔ correct

    Answer: D. Availability means timely and reliable access to information and systems. A DDoS attack overwhelms the service so legitimate users cannot reach it; no data is necessarily disclosed or altered.

    Source: csrc.nist.gov/glossary/term/availability · Domain: Security Principles

  2. An organization installs badge readers and posts security guards at its building entrance. Which category of security control are these?

    • A. Technical
    • B. Physical ✔ correct
    • C. Administrative
    • D. Logical

    Answer: B. Physical controls protect buildings, rooms and equipment, for example badge readers, locks, fences and guards. Technical (logical) controls are implemented in systems, and administrative controls are policies and procedures.

    Source: csrc.nist.gov/glossary/term/physical_safeguards · Domain: Security Principles

  3. Which of the following is one of the canons of the ISC2 Code of Ethics?

    • A. Put the employer's financial interests ahead of every other professional duty and obligation
    • B. Share every discovered vulnerability publicly at once so that all users can learn about it
    • C. Protect society, the common good, necessary public trust and confidence, and the infrastructure ✔ correct
    • D. Use any technique, including unauthorized access, to prove that a client's system is weak

    Answer: C. The first canon is to protect society, the common good, necessary public trust and confidence, and the infrastructure. The others: act honorably, honestly, justly, responsibly and legally; serve principals diligently; advance the profession.

    Source: www.isc2.org/ethics · Domain: Security Principles

  4. After a flood destroys its server room, a company follows a written plan to recover its key IT systems at an alternate facility. Which plan is this?

    • A. Disaster recovery plan ✔ correct
    • B. Acceptable use policy
    • C. Change management plan
    • D. Data retention policy

    Answer: A. A disaster recovery plan (DRP) is a written plan for recovering information systems, often at an alternate site, after a major failure or destruction of facilities. It supports the wider business continuity plan.

    Source: csrc.nist.gov/glossary/term/disaster_recovery_plan · Domain: Security Governance

  5. A tabletop exercise is a discussion-based exercise in which team members talk through their roles and the plan during a simulated incident.

    • A. True ✔ correct
    • B. False

    Answer: A. True. In a tabletop exercise, people with roles in a plan meet and discuss how they would respond to a scenario. It tests the plan and roles without touching production systems.

    Source: csrc.nist.gov/glossary/term/tabletop_exercise · Domain: Security Operations and Incident Response

  6. A company requires that the employee who creates a vendor payment cannot also approve that payment. Which principle does this apply?

    • A. Least privilege
    • B. Need to know
    • C. Separation of duties ✔ correct
    • D. Defense in depth

    Answer: C. Separation of duties means no single person has enough privileges to misuse a process alone, such as creating and approving the same payment. Least privilege limits each person's rights to what the job needs.

    Source: csrc.nist.gov/glossary/term/separation_of_duty · Domain: Identity And Access Management (IAM) Concepts

  7. Which two actions follow the principle of least privilege? (Select TWO)

    • A. Give a new analyst only the permissions the role requires ✔ correct
    • B. Add all IT staff to the domain administrators group for convenience
    • C. Share one administrator account among the whole support team
    • D. Remove temporary admin rights as soon as the task is finished ✔ correct
    • E. Grant extra permissions in advance in case they are needed later

    Answer: A, D. Least privilege limits access to the minimum needed for assigned tasks, and only for as long as needed. Broad admin groups, shared admin accounts and just-in-case permissions all grant more than required.

    Source: csrc.nist.gov/glossary/term/least_privilege · Domain: Identity And Access Management (IAM) Concepts

  8. A company rents virtual machines, storage and networks from a cloud provider and installs and manages its own operating systems and applications on them. Which cloud service model is this?

    • A. Infrastructure as a service (IaaS) ✔ correct
    • B. Platform as a service (PaaS)
    • C. Software as a service (SaaS)
    • D. Function as a service (FaaS)

    Answer: A. In IaaS the consumer provisions processing, storage and networks and controls the operating systems and applications, while the provider manages the underlying hardware. In PaaS and SaaS the provider manages the OS.

    Source: nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf · Domain: Networking and Cloud Security Concepts

  9. Which statement best describes the zero trust approach?

    • A. Devices on the internal network are trusted once they pass the firewall
    • B. No user or device is trusted by default based only on its network location ✔ correct
    • C. Only external users need to authenticate before using company systems
    • D. A strong perimeter firewall removes the need for internal access checks

    Answer: B. Zero trust grants no implicit trust to users or devices based only on their network location. Each request is authenticated and authorized, which moves security from the network perimeter to users, assets and resources.

    Source: csrc.nist.gov/pubs/sp/800/207/final · Domain: Networking and Cloud Security Concepts

  10. Which cryptographic function produces a fixed-length output that can be used to check whether data has changed, and is designed so that the original data cannot be recovered from that output?

    • A. Symmetric encryption
    • B. Asymmetric encryption
    • C. Digital certificate
    • D. Hash function ✔ correct

    Answer: D. A cryptographic hash function maps data of any size to a fixed-length value and is one-way. Comparing hashes shows whether data changed. Encryption, by contrast, is designed to be reversed with the right key.

    Source: csrc.nist.gov/glossary/term/hash_function · Domain: Security Operations and Incident Response

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public ISC2 exam objectives (CC exam outline effective 2026-09-01), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by ISC2; exam names are trademarks of their owners. Official exam page: www.isc2.org/certifications/cc/cc-certification-exam-outline.

Last modified: Sunday, 25 October 2026, 9:57 PM