Free CC practice questions

The CIA triad is the foundation of information security: Confidentiality, Integrity, and Availability. Confidentiality means only authorized people, processes, or systems can access information.

Restricting access to authorized viewers is the textbook definition of confidentiality. Integrity concerns accuracy and protection from tampering, and availability concerns timely, reliable access, so neither matches the question. Non-repudiation is a separate assurance concept outside the triad.

1. Recall the three elements of the CIA triad: Confidentiality, Integrity, Availability.
2. Match the phrase 'accessible only to authorized people' to the definition of each element.
3. Only confidentiality is defined by controlling who can view or access information.
4. Eliminate integrity (modification), availability (uptime), and non-repudiation (denial of actions).

Exam tip: Confidentiality means only authorized parties can access information; think of it as protection against unauthorized disclosure.

GRC is an integrated approach that combines governance (leadership setting direction and accountability), risk management (handling risk within the appetite leadership sets), and compliance (meeting external legal requirements and internal policies).

The acronym GRC expands directly to Governance, Risk, and Compliance. The other options mix in incident response phases, generic management terms, and audit activities that are not the three named disciplines.

1. Expand the acronym: G is governance, R is risk, C is compliance.
2. Recall that each letter is a full discipline, not a single task or project phase.
3. Eliminate options that list incident response steps or audit activities instead of the three disciplines.

Exam tip: GRC is the integration of governance, risk management, and compliance into one coordinated program.

The identity life cycle describes how an identity and its access are managed from creation to removal: roles definition, provisioning, review, and deprovisioning.

Access must be planned before it is granted, checked while it is in use, and removed when it is no longer needed. That logic forces the order: define the role and its required access first, provision an account with exactly that access, review the access periodically to confirm it is still appropriate, and deprovision the account when the person leaves.

1. Roles definition: decide what access each job role requires before anyone is granted anything.
2. Provisioning: create the account and grant only the access the defined role needs.
3. Review: periodically recertify that each user still needs the access they hold.
4. Deprovisioning: remove access promptly when the person separates from the organization.

Exam tip: Remember the life cycle as define, grant, check, remove: roles definition, provisioning, review, deprovisioning.

The OSI reference model is a conceptual framework that divides network communication into seven distinct layers, each with a defined responsibility.

The OSI model defines exactly seven layers. From bottom to top they are Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), and Application (7). The simpler TCP/IP model condenses these functions into four layers, which is a common source of confusion.

1. Recall that OSI stands for Open Systems Interconnection and is the more detailed of the two common models.
2. Count the layers from the bottom up: Physical, Data Link, Network, Transport, Session, Presentation, Application.
3. Distinguish it from the TCP/IP model, which has only four layers covering the same overall functions.

Exam tip: OSI has 7 layers; TCP/IP has 4. Memorize the seven OSI layer names in order.

Data classification labels information by its sensitivity, for example public, internal, confidential, and restricted, so that the level of protection applied is proportional to the harm its disclosure or loss would cause.

The whole point of classification is matching protection to value: restricted data gets encryption, strict access control, and careful handling, while public data needs little. Without labels, an organization either overprotects everything at great cost or underprotects its most sensitive assets. Compression, encryption, and deletion are separate activities that classification may guide but does not perform.

1. Recall that classification assigns sensitivity labels such as public, internal, confidential, and restricted.
2. Connect the label to its consequence: the label drives how strongly the data is protected and handled.
3. Eliminate options describing compression, encryption, or deletion, which are distinct activities that classification informs rather than performs.

Exam tip: Classification labels data by sensitivity, and the label drives how strongly the data is protected.