ISC2 CC practice exam — 599 free practice questions

Confidentiality means information is disclosed only to authorized people, processes and systems. Privacy is a related but narrower concept that applies to personal data about individuals.

Preventing unauthorized disclosure of any sensitive information is the definition of confidentiality. Privacy is the tempting near-twin, but it covers only personal data and adds rights over collection and use; business plans fall outside it. Integrity is about unauthorized change and availability about timely access, so neither describes restricting who may see data.

1. Identify what the stem protects against: disclosure to unauthorized people.
2. Note the scope: any sensitive information, including business data that is not about a person.
3. Disclosure control over any sensitive data is confidentiality; privacy is limited to personal data.
4. Rule out integrity (change) and non-repudiation (proof of who acted).

Exam tip: Confidentiality = only authorized eyes, for any sensitive data; privacy = rights over personal data specifically.

GRC is an integrated approach that combines governance (leadership setting direction and accountability), risk management (handling risk within the appetite leadership sets), and compliance (meeting external legal requirements and internal policies).

The acronym GRC expands directly to Governance, Risk, and Compliance. The other options mix in incident response phases, generic management terms, and audit activities that are not the three named disciplines.

1. Expand the acronym: G is governance, R is risk, C is compliance.
2. Recall that each letter is a full discipline, not a single task or project phase.
3. Eliminate options that list incident response steps or audit activities instead of the three disciplines.

Exam tip: GRC is the integration of governance, risk management, and compliance into one coordinated program.

The identity life cycle describes how an identity and its access are managed from creation to removal: roles definition, provisioning, review, and deprovisioning.

Access must be planned before it is granted, checked while it is in use, and removed when it is no longer needed. That logic forces the order: define the role and its required access first, provision an account with exactly that access, review the access periodically to confirm it is still appropriate, and deprovision the account when the person leaves.

1. Roles definition: decide what access each job role requires before anyone is granted anything.
2. Provisioning: create the account and grant only the access the defined role needs.
3. Review: periodically recertify that each user still needs the access they hold.
4. Deprovisioning: remove access promptly when the person separates from the organization.

Exam tip: Remember the life cycle as define, grant, check, remove: roles definition, provisioning, review, deprovisioning.

The OSI reference model is a conceptual framework that divides network communication into seven distinct layers, each with a defined responsibility.

The OSI model defines exactly seven layers. From bottom to top they are Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), and Application (7). The simpler TCP/IP model condenses these functions into four layers, which is a common source of confusion.

1. Recall that OSI stands for Open Systems Interconnection and is the more detailed of the two common models.
2. Count the layers from the bottom up: Physical, Data Link, Network, Transport, Session, Presentation, Application.
3. Distinguish it from the TCP/IP model, which has only four layers covering the same overall functions.

Exam tip: OSI has 7 layers; TCP/IP has 4. Memorize the seven OSI layer names in order.

Data classification sorts information into categories such as public, internal, confidential and restricted according to its sensitivity and value; the class then drives how the data is handled.

Classification exists so that protection is proportional: the label tells people and systems who may access the data, whether it must be encrypted, how it travels and how it is destroyed. Compression and retention are separate data-management activities, and applying one standard uniformly is the opposite of what classification achieves.

1. Ask what problem classification solves: not all data deserves the same defenses.
2. Recall that the assigned class dictates the handling rules.
3. Reject options about storage efficiency or retention timing, which are different activities.
4. Reject uniform treatment, which removes the point of distinguishing sensitivity.

Exam tip: Classification comes first; the strength of protection follows from it.