CC sample questions — 25 answered and explained

Integrity protects data from unauthorized modification, whether the data is stored or moving across a network. Tampering with data in transit is a classic integrity attack.

The attacker altered the content of the transaction so the bank received different data than the customer sent. Unauthorized modification is precisely what integrity is meant to prevent. Controls such as hashing and digital signatures allow the receiver to detect this kind of change.

1. Identify the attacker's action: changing the transfer amount in transit.
2. Map unauthorized modification of data to the integrity principle.
3. Distinguish this from eavesdropping alone, which would be a confidentiality concern.
4. Recall that hashing and digital signatures are the controls that detect such tampering.

Exam tip: Tampering with data, in storage or in transit, violates integrity; snooping violates confidentiality; blocking access violates availability.

Shoulder surfing is a low-tech snooping attack in which someone observes a screen, keyboard, or document to learn information they are not authorized to see. Snooping attacks target confidentiality.

Confidentiality is violated whenever information reaches someone who is not authorized to have it, regardless of the method. The passenger gained unauthorized knowledge of salary data simply by looking, so the disclosure is a confidentiality breach even though no system was hacked.

1. Identify what happened: an unauthorized person viewed sensitive data.
2. Unauthorized disclosure maps to confidentiality in the CIA triad.
3. Confirm no data was changed (integrity intact) and no access was blocked (availability intact).
4. Remember countermeasures such as privacy screens and situational awareness.

Exam tip: Any unauthorized viewing of information, including shoulder surfing and other snooping, is a confidentiality violation.

AAA separates three services: authentication proves who you are, authorization determines what you may do, and accounting records what you did.

The user's identity was already confirmed by the successful login, so authentication is complete. The access denied message came from the system checking the user's permissions against the folder, which is authorization. Accounting would merely record the attempt afterward.

1. Break the scenario into stages: login first, then a resource request.
2. The login stage is authentication: proving identity with credentials.
3. The folder permission check is authorization: matching identity and role against allowed actions.
4. The denial came from the permission check, so authorization denied the request.

Exam tip: Authentication answers who you are; authorization answers what you may do; a denial based on permissions is an authorization decision.

The third A in AAA is accounting: capturing records of what users did, when they did it, and what resources they touched. These logs form the audit trail.

Recording activity for later review is the job of accounting, the third A in AAA. Non-repudiation is the tempting choice because good logs help prevent denial, but it is the assurance that results, not the service that produces the record. Authentication and authorization make identity and access decisions; neither is the record-keeping service.

1. Recall the AAA breakdown: authenticate identity, authorize actions, account for activity.
2. The question describes recording activity for later review.
3. Recording and logging map to accounting, the audit-trail service.
4. Eliminate authentication and authorization, which make real-time decisions rather than records.

Exam tip: Accounting means logging what users did; it produces the audit trail that supports investigations and accountability.

The three classic authentication factors are something you know (knowledge), something you have (possession), and something you are (inherence or biometrics).

Classify each credential on its own. The badge is something you have; the PIN, like a password or passphrase, is a secret recalled from memory, so it is something you know. The badge reader beside the keypad makes the possession factor tempting, but that label belongs to the badge, not to the PIN. Biometrics are something you are, and location is an attribute, not the PIN's factor.

1. List the three factor types: know, have, are.
2. Separate the two credentials in the scenario: the badge and the PIN.
3. Ask where the PIN resides: in the employee's memory.
4. Label the PIN as something you know and the badge as something you have.

Exam tip: Passwords and PINs are knowledge factors; badges, cards and tokens are possession factors; biometrics are inherence factors.

Multi-factor authentication requires evidence from at least two different factor types: something you know, something you have, something you are.

A password and a security answer are both memorized, so both are something you know: two instances of one factor, not two factors. The guessability statement is true of security questions and tempting, but it explains weakness, not why the design is single-factor. MFA does not demand a biometric, and the number of devices is not part of the definition.

1. Classify each credential by factor type.
2. Password: something you know. Security answer: something you know.
3. Count distinct factor types, not prompts: only one.
4. Pick the observation that states this, not one about general weakness.

Exam tip: Count factor types, not prompts: two secrets you know are still single-factor.

Audits verify compliance by testing controls and reviewing evidence. Internal audits are performed by the organization's own staff to check itself and fix gaps early; external audits are performed by an independent outside party, and their findings carry formal weight.

The defining difference is who performs the audit. The mirror-image option swaps the two definitions, so only knowing which audit is independent separates them. Both kinds can examine security controls, and neither is defined by being voluntary or required.

1. Recall that audits are classified by who performs them.
2. Internal means the organization's own audit staff.
3. External means an independent outside party such as a regulator or assessor.
4. Select the statement with the definitions the right way round.

Exam tip: Internal audit = your own staff checking yourself; external audit = an independent outsider.

An internal audit is the organization's own check on its controls and policies. It finds and fixes gaps early and prepares for external audits, which provide independent assurance.

Internal audits exist so the organization can confirm its controls work and its policies are followed, and correct problems before an external auditor finds them. Independent assurance accepted by regulators is the job of an external audit, internal audits do not replace required external ones, and setting risk appetite is governance.

1. Recall who performs an internal audit: the organization's own staff.
2. Recognize that self-checking cannot provide independent assurance.
3. Eliminate the governance activity of setting appetite and objectives.
4. Select verifying controls and finding gaps early.

Exam tip: Internal audits find your own gaps early; external audits provide independent assurance.

The purpose of integrating governance, risk and compliance is to avoid silos. Siloed teams duplicate effort, make inconsistent decisions and leave blind spots; an integrated program uses one set of policies, one risk view and one body of evidence.

The scenario describes duplicated effort caused by three teams working as silos. Integration fixes it by collecting evidence once and reusing it across governance, risk and compliance. Spacing the requests or preparing separate packs still makes the owner do the work three times, and dropping the risk reviews cuts duplication by losing oversight, which creates a blind spot.

1. Identify the problem: three teams duplicating the same request.
2. Recognize the cause as siloed GRC functions.
3. Reject fixes that only reschedule or repackage the same work, or that remove a pillar.
4. Select the option that shares one body of evidence across all three teams.

Exam tip: Integrated GRC: collect evidence once, reuse it everywhere.

A GRC platform is software that centralizes the moving parts of a GRC program: policies with versions and approvals, the risk register with owners and treatments, controls mapped to risks and requirements, and evidence for audits.

The manager's problem is scattered GRC records, which is exactly what a GRC platform solves by acting as one system of record. A SIEM, DLP and a vulnerability scanner are all real security tools, but each is a technical control or detection tool rather than a place to manage policies, risks and evidence together.

1. List what the manager needs to combine: policies, risks and audit evidence.
2. Recall what each tool type does.
3. Eliminate the detection and prevention tools (SIEM, DLP, scanner).
4. Select the platform built to centralize GRC records.

Exam tip: A GRC platform is the system of record for policies, risks, controls and evidence.

The Mover event covers any internal role change, such as a promotion or department transfer, that changes what access a person should have.

The employee remains with the organization but their job, and therefore their required access, has changed. That is the Mover case: grant the new role's access and remove the old role's access to prevent privilege creep. A Rejoiner would be a returning former employee, which this person is not.

1. Classify the event: same organization, different role.
2. Rule out Joiner and Rejoiner: the person neither arrived nor returned.
3. Rule out Leaver: the person is still employed.
4. Handle the Mover by adding new-role access and removing old-role access.

Exam tip: Promotions and transfers are Mover events: add the new role's access and remove the old role's access, or privilege creep begins.

Periodic access reviews (recertification or attestation) detect access that has drifted from what a person's current role requires.

The user is a Mover whose old access was never removed: privilege creep. The control built to find it is a periodic access review, in which managers or data owners confirm or revoke each entitlement. Exit-driven deprovisioning is the near-twin, but it fires only when someone leaves; MFA and role-based provisioning each solve a different problem.

1. Classify the scenario: an internal transfer with leftover access, which is privilege creep.
2. Note the stem asks for a control that detects the condition.
3. Rule out controls that act only on leavers, on authentication, or on granting new access.
4. Choose the periodic access review, which compares held access with current need.

Exam tip: Leftover access after a transfer is privilege creep; periodic access reviews find it.

For involuntary terminations, access is disabled at or before the moment the person is informed.

The riskiest period in an involuntary separation is the time between telling the person and revoking their access, because that is when an upset insider is most likely to cause damage. Disabling access at or before the conversation closes that window. Every other option leaves accounts usable after the person knows they are leaving.

1. Recognise the risk: an involuntary termination creates a potentially hostile insider.
2. Find the window that matters: between notification and revocation.
3. Choose the timing that makes that window zero: at or before notification.

Exam tip: Involuntary termination: disable access at or before the moment the person is told.

Deprovisioning disables an account first and deletes it later, so that the account's data and audit history survive for investigations and retention.

Deleting an account at once can destroy evidence and records that the organization may need for an investigation, a legal hold or a handover. Disabling blocks every sign-in immediately while keeping that data. Reassigning the account to a successor is the tempting idea, but it would make one person's actions appear under another person's name.

1. Recall the two goals at separation: stop access now, keep records for later.
2. Disabling achieves both; deletion achieves the first but destroys the second.
3. Reject options that reuse the account for someone else or skip other deprovisioning steps.

Exam tip: Disable at once to block access and keep the evidence; delete later when retention rules allow.

Least privilege at provisioning means granting the access the role definition specifies, no more and no less; exceptions go through separate approval.

The role definition already states what an accounts payable clerk needs, so provisioning should apply that profile. The other options all start from a real profile or account, which is what makes them tempting: a department profile is broader than one job, a manager's access includes approval rights, and a long-serving colleague's access usually includes leftovers from earlier roles (privilege creep).

1. Recall that least privilege means only the access the job requires.
2. Find the source that defines that access for this job: the role definition.
3. Reject sources that are broader than the job (department, manager) or carry accumulated access (a long-serving colleague).

Exam tip: Provision from the job's role definition, not from a department, a manager or a colleague's account.

DNS is the internet's name resolution service, translating domain names like example.com into IP addresses, and it operates on well-known port 53.

DNS servers listen on port 53. Most lookups use UDP on port 53 for speed, with TCP on 53 used for larger responses. Recognizing port 53 as DNS is a standard exam expectation.

1. Identify the service in the question: DNS performs name-to-address resolution.
2. Recall its assigned well-known port: 53.
3. Eliminate the distractor ports: 22 for SSH, 25 for SMTP, 3389 for RDP.

Exam tip: DNS runs on port 53; memorize it alongside 22, 23, 25, 80, 443, and 3389.

Firewalls differ in what they consider when filtering: single packets (stateless), connection state (stateful), the application (application-aware) or a relayed request (proxy).

Stateful inspection means the firewall remembers connections. When an inside host opens a session, the firewall records it in a state table, permits the matching return traffic and drops unsolicited inbound packets. Judging each packet alone is the stateless twin; identifying applications regardless of port is a next-generation feature; relaying connections is what a proxy does.

1. Look for the word that defines stateful: state, meaning memory of connections.
2. Match it to a state table of active sessions.
3. Reject per-packet judgement as the stateless definition.
4. Reject application identification and relaying as other firewall types.

Exam tip: Stateful = remembers connections; stateless = judges each packet alone.

Several legacy protocols send everything, credentials included, in cleartext; each has an encrypted replacement (Telnet to SSH, HTTP to HTTPS, FTP to SFTP).

The requirement is protecting credentials in transit, which needs encryption. SSH on port 22 is the encrypted replacement for Telnet. Moving the port or restricting the source are tempting because they reduce exposure, but Telnet stays cleartext either way, and FTP is both a different service and also cleartext.

1. Identify the risk: Telnet transmits credentials in cleartext.
2. Identify the requirement: protect credentials in transit, which means encryption.
3. Pick the encrypted replacement for remote command-line administration: SSH on 22.
4. Reject options that only reduce exposure while leaving the protocol unencrypted.

Exam tip: Telnet (23) is cleartext; SSH (22) is its encrypted replacement.

Recognizing well-known ports lets analysts infer which service traffic is aimed at. Port 3389 is assigned to Microsoft's Remote Desktop Protocol.

RDP provides graphical remote access to Windows systems on port 3389. Internet-exposed RDP is a well-known attack vector, commonly probed and brute-forced, so inbound attempts on 3389 point directly at RDP.

1. Match the port number in the alert to its well-known service: 3389 is RDP.
2. Eliminate services with other ports: SSH on 22, SMTP on 25, DNS on 53.
3. Recognize the security implication: exposed RDP should be restricted, placed behind a VPN, or protected with strong authentication.

Exam tip: Port 3389 is RDP, a high-value target that should not be exposed directly to the internet.

A VPN creates an encrypted tunnel across an untrusted network; its primary service is confidentiality of data in transit.

On public Wi-Fi anyone nearby can capture traffic. The VPN encrypts everything between the laptop and the company gateway, so captured packets are unreadable. It does not scan for malware, does not make the laptop invisible on the local network, and authenticates the VPN gateway rather than the airport's access point.

1. Identify the threat on public Wi-Fi: eavesdropping on traffic.
2. Recall what a VPN does: an encrypted tunnel to a trusted gateway.
3. Map that to confidentiality in transit.
4. Reject benefits that belong to other controls (anti-malware, host isolation, access point validation).

Exam tip: VPN = encrypted tunnel = confidentiality in transit, not endpoint protection.

Remote access VPNs connect individual devices through client software; site-to-site VPNs connect whole networks through a permanent tunnel between gateways.

The requirement is network-to-network, permanent, encrypted and transparent to users. Only a site-to-site VPN between the office gateways meets all four. A remote access VPN would encrypt but breaks the no-client-software constraint; HTTPS encrypts only web sessions; firewall allow rules control access but encrypt nothing.

1. List the requirements: whole network, permanent, encrypted, no software on users' devices.
2. Recall that site-to-site VPNs run between gateways and are invisible to users.
3. Reject remote access VPN because each user runs a client.
4. Reject per-application HTTPS and plain firewall rules because they do not encrypt the whole link.

Exam tip: One user's device = remote access VPN; two whole networks = site-to-site VPN.

Data exists in three states (at rest, in transit, in use), and each has a characteristic primary protection.

A tape in a vault holds stored data, so it is at rest, and the characteristic protection for data at rest is encrypting the stored data (with access control over the media). Masking is the tempting near-twin because the state is correct, but masking only changes what a screen displays and does nothing for a stolen tape. TLS and endpoint hardening belong to the other two states.

1. Decide the state: stored on media means at rest.
2. Eliminate pairings that name the wrong state.
3. Between the two at-rest options, ask which protects a stolen tape.
4. Choose encryption of the stored data over display masking.

Exam tip: At rest: encrypt the storage. In transit: encrypt the connection. In use: secure the endpoint.

Data in transit is data moving across a network; its main threat is interception, and the classic protection is encrypting the connection, for example with TLS.

While the order travels from browser to server it is in transit, so the protection must work on the network path. TLS encrypts the connection so an eavesdropper sees only ciphertext. Full-disk encryption protects the stored copy, masking only changes a display, and hashing provides integrity, not confidentiality.

1. Identify the state: the data is moving across the internet, so it is in transit.
2. Name the main threat: interception of traffic.
3. Match the control that encrypts the connection itself.
4. Eliminate controls for other states (disk encryption, masking) and hashing, which hides nothing.

Exam tip: Data in transit is protected by encrypting the connection.

Data in use is data being actively processed in memory by an application; it is the hardest state to protect.

The records are loaded and being computed on, which defines data in use. Calling memory storage confuses working memory with storage media, and the copy in the database is a separate copy that is at rest. Moving records into memory is not network transmission, so in transit does not fit.

1. Find what is happening to these specific records: active processing.
2. Recall the definition of data in use: processed in memory.
3. Separate the loaded records from the database copy, which is a different copy at rest.
4. Reject in transit, which means moving across a network.

Exam tip: Being processed in memory = data in use.

Symmetric encryption uses a single shared secret key for both encryption and decryption; AES is the dominant example.

The defining feature of symmetric encryption is one key used in both directions. A public/private pair is asymmetric, a keyless fixed-length digest is hashing, and replacing characters is masking, each the precise definition of a neighbouring term.

1. Recall the defining feature: one shared secret key.
2. Match the key-pair option to asymmetric encryption.
3. Match the digest option to hashing and the substitution option to masking.
4. Choose the single shared key.

Exam tip: Symmetric = one shared key (AES); asymmetric = key pair (RSA); hashing = no key.