22 Data Security & Security Operations Practice Questions & Answers

1. 1. An organization is writing rules for how each type of business record must be stored, shared and eventually disposed of. Why is assigning a classification the FIRST step?

   • A.Classification sets the sensitivity level from which storage, sharing and disposal rules follow.✓ Answer
   • B.Classification converts stored records into a form that unauthorized readers cannot interpret.
   • C.Classification records where each file physically resides, so it can be located for disposal.
   • D.Classification transfers responsibility for the records from the business owner to the IT team.

   Classification is the decision about how sensitive the data is, and every later handling rule is derived from that decision: what encryption is required, who may access it, how long it is retained and how the media must be sanitized. That is why it comes first in the data lifecycle. Classification does not itself encrypt or inventory data, and accountability stays with the data owner while custodians implement the controls.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — data handling (classification, labeling)Report a problem with this question

2. 2. A document is assessed as "Confidential" under the company's scheme, and the word "Confidential" is then placed in its header and in its metadata. Which statement BEST describes these two acts?

   • A.Both acts are classification, because applying a marking is what assigns the sensitivity level.
   • B.The assessment is labeling, and the stamp and metadata are the classification of record.
   • C.Both acts are labeling, because the sensitivity decision is made by the storage system itself.
   • D.The assessment is classification, and the stamp and metadata are the label conveying it.✓ Answer

   Classification is the judgement that assigns a sensitivity level; labeling is the visible or machine-readable marking that communicates that level so people and systems can apply the correct handling rules. The marking never creates the level, and a storage platform does not decide sensitivity — the data owner does.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — data handling (classification, labeling)Report a problem with this question

3. 3. A finance database is encrypted on disk, and its records travel to a reporting server over an encrypted channel. Which data state remains the LEAST protected by these two measures?

   • A.Data in use, because records must be decrypted in memory for the application to use them.✓ Answer
   • B.Data at rest, because disk encryption leaves the database backup copies entirely unprotected.
   • C.Data in transit, because an encrypted channel protects the headers but never the payload.
   • D.Data in archive, because archived records form a fourth state that encryption cannot cover.

   Data exists in three states: at rest, in transit and in use. Disk encryption covers the first and a protected channel covers the second, but data in use must be decrypted in memory before an application can process it, which is why that state is the hardest to protect and needs application-level or confidential-computing controls. Archive is a lifecycle stage, not a fourth state.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — data handling and data states (at rest, in transit, in use)Report a problem with this question

4. 4. Developers need a realistic copy of the customer database to test a billing feature, but they have no business need to see real account numbers. What is the PRIMARY purpose of data masking here?

   • A.It compresses the real values into a smaller data set so the test copy loads faster.
   • B.It replaces real values with realistic substitutes that keep the data usable for testing.✓ Answer
   • C.It deletes the customer records from the test copy so that the tables are left empty.
   • D.It encrypts the entire test database so that only developers holding the key can open it.

   Masking (obfuscation) substitutes realistic but fictitious values for sensitive fields so the data keeps its format and usefulness while the real values are never exposed to people without a business need. Encrypting the copy would still give key holders the real values, and emptying the tables destroys the test's value.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — data handling (masking, obfuscation)Report a problem with this question

5. 5. A laptop is being reassigned to another employee. A technician deletes the previous user's files and empties the recycle bin. Which statement BEST describes the result?

   • A.The data is rendered unrecoverable, because emptying the recycle bin clears those sectors.
   • B.The data is overwritten a single time, which meets the accepted standard for purging a drive.
   • C.The data remains recoverable because only the pointers were removed; this is not sanitization.✓ Answer
   • D.The data is re-encrypted by the file system, which makes any later recovery attempt infeasible.

   Deleting a file or quick-formatting removes only the file system's pointers; the blocks still hold the original content, which is data remanence. Sanitization requires at least Clear — a logical overwrite through normal read/write commands — and Purge or Destroy for higher assurance.

   Source: NIST SP 800-88, Guidelines for Media Sanitization — Clear, Purge, Destroy; ISC2 CC Exam Outline, Security Operations and Incident ResponseReport a problem with this question

6. 6. An organization must sanitize a batch of solid-state drives that held confidential records; the drives will then be reused inside the company. Which method is appropriate?

   • A.Degaussing each drive with a strong magnetic field, which erases flash cells as it does platters.
   • B.Running a cryptographic erase or the vendor's purge command, which makes recovery infeasible.✓ Answer
   • C.Performing a quick format on each drive, which clears the flash translation layer and its data.
   • D.Shredding each drive physically, because media that held confidential records must be destroyed.

   Degaussing works only on magnetic media; an SSD stores data in flash cells and is unaffected by a magnetic field. Because the drives must stay usable, destruction is ruled out and a quick format leaves remanence, so the correct Purge technique is a cryptographic erase or the manufacturer's sanitize command.

   Source: NIST SP 800-88, Guidelines for Media Sanitization — Purge techniques for flash memory devicesReport a problem with this question

7. 7. A records policy states how long each category of record must be kept and requires disposal once that period ends. Which statement BEST describes the security value of a retention schedule?

   • A.Data kept past its required period adds exposure in a breach, so timely disposal cuts the risk.✓ Answer
   • B.Data kept indefinitely is safest, because deleting anything could destroy evidence needed later.
   • C.Data retention periods are set by the storage team, based on how much disk space is available.
   • D.Data retention applies only to paper records, since digital copies are covered by the backups.

   Retention limits both directions of risk: records must exist long enough to satisfy legal and business requirements, and must not survive beyond that, because every extra copy is more material an attacker can steal and more scope in a breach notification. Retention periods come from law, regulation and business need, not from available disk space.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — data handling (retention and destruction)Report a problem with this question

8. 8. A team must encrypt a large nightly database export and must also let dozens of partners exchange keys safely. Which statement BEST compares symmetric and asymmetric cryptography?

   • A.Symmetric is slower but scales to many parties, while asymmetric is fast and suits bulk data.
   • B.Symmetric uses a key pair for each partner, while asymmetric uses one shared secret for all.
   • C.Symmetric provides integrity only, while asymmetric provides confidentiality for stored data.
   • D.Symmetric is fast and suits bulk data, while asymmetric is slower but solves key distribution.✓ Answer

   Symmetric cryptography uses one shared secret key for both operations, which makes it fast enough for bulk data but leaves the problem of distributing that key safely. Asymmetric cryptography uses a mathematically related public/private key pair and is far slower, so in practice it is used to exchange or protect a symmetric session key that then carries the payload.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — encryption (symmetric and asymmetric)Report a problem with this question

9. 9. A supplier wants to send a quotation file that only the buying company can read. Which key should the supplier use to encrypt the file?

   • A.The buying company's public key, because only its matching private key can decrypt the file.✓ Answer
   • B.The supplier's own private key, because only the supplier's public key could then open the file.
   • C.The supplier's own public key, because the buying company already holds a copy of that key.
   • D.The shared password from the previous order, because both sides already hold the same secret.

   For confidentiality you encrypt with the recipient's public key, because only the matching private key — which the recipient alone holds — can reverse it. Encrypting with the sender's private key does the opposite job: anyone can undo it with the freely published public key, which is why that direction is used for signing, not for secrecy.

   Source: ISC2 CC Exam Outline, Security Operations and Incident Response — encryption (asymmetric key pairs)Report a problem with this question

10. 10. A contract is sent with a digital signature created from a hash of the document encrypted with the sender's private key. Which assurances does the signature itself provide?

    • A.Confidentiality, integrity and availability, which together cover the whole document lifecycle.
    • B.Integrity, authentication and non-repudiation, but not confidentiality of the contract text.✓ Answer
    • C.Confidentiality and authentication, because signing also encrypts the text for the recipient.
    • D.Integrity and availability, because the signature keeps a verified copy of the contract on file.

    Verifying the signature with the sender's public key proves the hash was produced by the holder of the private key (authentication and non-repudiation) and that recomputing the hash still matches (integrity). The document text travels unchanged and unhidden, so confidentiality requires separately encrypting the message.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — encryption, hashing and digital signaturesReport a problem with this question

11. 11. A backup system stores a digest of every archived file and recomputes it at restore time. Which statement BEST explains how hashing differs from encryption?

    • A.Hashing is reversible with the correct key, so it can rebuild the file if the archive is lost.
    • B.Hashing hides the content from anyone without the digest, so it provides confidentiality too.
    • C.Hashing produces output as long as the input, so the digest can be decrypted back to the file.
    • D.Hashing is one-way and fixed-length, so it verifies integrity rather than hiding the content.✓ Answer

    A hash function maps any input to a fixed-length digest and cannot be reversed, so it supports integrity: if one bit of the file changes, the recomputed digest no longer matches. Encryption is designed to be reversed with a key and is what provides confidentiality; the two solve different parts of the CIA triad.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — encryption and hashingReport a problem with this question

12. 12. An application team is deciding how to store user passwords in its database. Which approach is correct?

    • A.Store each password as a salted hash produced by a key-derivation function built for passwords.✓ Answer
    • B.Store each password hashed without a salt, since identical hashes make lookups more efficient.
    • C.Store each password in a restricted plaintext table, since database access is already limited.
    • D.Store each password encrypted with AES so an administrator can decrypt it if a user forgets.

    Passwords are hashed, not encrypted, because the system never needs to read them back — it only needs to compare digests at login, and anything reversible means a stolen key exposes every password. A unique random salt per password defeats precomputed rainbow tables, and a purpose-built key-derivation function makes each guess deliberately slow.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — encryption and hashing (password protection of stored credentials)Report a problem with this question

13. 13. A government agency plans to migrate to quantum-resistant cryptography although no available quantum computer can break its current algorithms. Which reasoning BEST supports acting now?

    • A.Quantum-resistant algorithms run much faster, so the migration pays for itself in server capacity.
    • B.Quantum computers already break AES-256, so symmetric encryption has to be retired immediately.
    • C.Encrypted traffic captured today can be stored and decrypted later, once such a machine exists.✓ Answer
    • D.Hashing stops providing integrity as soon as quantum computers reach a usable scale of qubits.

    The driving risk is "harvest now, decrypt later": an adversary can record protected traffic today and decrypt it years later when a capable quantum computer exists, so data with a long secrecy lifetime must be re-protected before that point. The threat falls hardest on asymmetric algorithms such as RSA and ECC; symmetric encryption and hashing are weakened but remain usable with larger sizes, which is why NIST has standardized post-quantum key-establishment and signature algorithms.

    Source: NIST post-quantum cryptography standards (key encapsulation and digital signature); ISC2 CC Exam Outline, Security Operations and Incident Response — quantum-resistant encryptionReport a problem with this question

14. 14. A manager asks why the company should collect logs from servers, firewalls and authentication systems when those systems already enforce their own controls. What is the PRIMARY security purpose of logging and monitoring?

    • A.To record activity so the organization can detect, investigate and reconstruct events.✓ Answer
    • B.To replace preventive controls, since an event that is recorded can no longer cause harm.
    • C.To show auditors that the security budget was spent on the tools that were purchased.
    • D.To improve system performance by moving old transactions off the production servers.

    Logging is a detective control: it produces the record of who did what, where and when, which is what makes detection, investigation and after-the-fact reconstruction possible. It does not prevent anything on its own, which is why it complements rather than replaces preventive controls.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security operations (logging and monitoring security events)Report a problem with this question

15. 15. An investigator building a timeline finds that three servers report different times for the same login. Which practice MOST directly prevents this problem?

    • A.Extending the log retention period so that older records are still available for comparison.
    • B.Raising the logging level on each server so that every entry captures more detail.
    • C.Synchronizing every system's clock to a common time source before the logs are collected.✓ Answer
    • D.Keeping logs on the server that generated them so no transfer delay is introduced.

    Correlating records from different systems depends on a common, accurate time base, so every host must synchronize its clock to the same trusted time source. Without that, ordering events across systems is unreliable and the timeline may not hold up as evidence; more detail or longer retention does not fix a skewed clock.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security operations (logging and monitoring security events)Report a problem with this question

16. 16. An attacker with administrative rights on a compromised server edits that server's local log files to remove traces of the intrusion. Which control BEST protects log integrity?

    • A.Compressing the local log files so that any edit damages the archive and becomes obvious.
    • B.Granting read access to every administrator so that more people may notice a change.
    • C.Forwarding logs to a central, write-once store whose access is restricted to log custodians.✓ Answer
    • D.Rotating the local log files more often so that an altered file is overwritten sooner.

    Logs held only on the system that produced them are under the control of whoever compromises that system. Sending them immediately to a separate central collector that is append-only and access-restricted means the attacker's local privileges no longer reach the copy that matters, which preserves the evidence.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security operations (log integrity and centralized monitoring)Report a problem with this question

17. 17. A monitoring system records a failed login, a firewall rule match and a service restart; one of them proves to be an attacker's successful privilege escalation. Which statement BEST distinguishes an event from an incident?

    • A.An event is one an analyst has confirmed, while an incident is an unvalidated automated alert.
    • B.An event is produced by a security tool, while an incident is always reported by an affected user.
    • C.An event happens outside business hours, while an incident happens during core business hours.
    • D.An event is any observable occurrence; an incident threatens confidentiality, integrity or availability.✓ Answer

    An event is simply something observable in a system — most events are entirely benign. An alert is an event a rule has flagged, and an incident is the subset that actually or imminently harms confidentiality, integrity or availability, or violates policy. The distinction matters because only an incident triggers the incident response plan.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security event triage; NIST SP 800-61, Computer Security Incident Handling GuideReport a problem with this question

18. 18. Several alerts that analysts have already validated as real are waiting in the queue at the same time. Which basis for prioritizing them is MOST appropriate?

    • A.The order in which the alerts arrived, so that the oldest item is always handled first.
    • B.The impact on business functions, the sensitivity of the data affected and recoverability.✓ Answer
    • C.The technical sophistication of the attack, so the most interesting case is studied first.
    • D.The number of duplicate alerts raised, so the noisiest detection rule is cleared first.

    Triage prioritizes by consequence, not by arrival order or technical novelty: functional impact on the business, the sensitivity of the information at risk, and how difficult recovery will be. Handling strictly first-in-first-out lets a high-impact compromise sit behind minor items.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security event triage (prioritization); NIST SP 800-61, incident prioritizationReport a problem with this question

19. 19. Taken alone, a failed VPN login, a password reset and a large file upload each look routine, but together they describe one account takeover. Which SIEM function BEST addresses this?

    • A.Normalization, which rewrites each source's records into one common field format.
    • B.Correlation, which links related records across sources and time into one meaningful alert.✓ Answer
    • C.Retention, which keeps the records long enough for an analyst to return to them later.
    • D.Aggregation, which counts how many times an identical record appeared in a period.

    Correlation is the step that applies rules across normalized records from different sources and time windows, so a set of individually low-signal entries becomes a single higher-confidence alert describing one story. Normalization prepares the data for that step, and aggregation and retention do not establish the relationship between events.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security event triage (correlation, use cases)Report a problem with this question

20. 20. A threat briefing lists threat actor types alongside their motivations. Which pairing is correct?

    • A.Hacktivist — financial gain from reselling stolen customer records on criminal markets.
    • B.Script kiddie — sustained espionage against a foreign government's defense supply chain.
    • C.Nation-state actor — intelligence collection that advances a government's strategic aims.✓ Answer
    • D.Organized crime group — spreading a political message by defacing a government website.

    Actor types are distinguished by motivation and resources. Nation-state actors are funded and patient, and their aim is espionage and strategic advantage rather than immediate money. Hacktivists pursue an ideological message, organized crime pursues profit, and script kiddies use other people's tools for curiosity or notoriety and lack the capability for a sustained espionage campaign.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — security operations (threat actors: types and motivations)Report a problem with this question

21. 21. A security team subscribes to feeds that report adversary campaigns and indicators. What is the PRIMARY purpose of cyber threat intelligence?

    • A.To supply courtroom evidence identifying the individual attacker so they can be prosecuted.
    • B.To inform defensive decisions with timely, relevant knowledge of who may attack and how.✓ Answer
    • C.To replace the organization's own logging, since the feed reports incidents as they happen.
    • D.To guarantee that every attack named in the feed is blocked automatically at the firewall.

    Cyber threat intelligence is evidence-based knowledge about adversaries that is turned into decisions: which detections to build, which vulnerabilities to patch first, what to tell executives about risk. To be useful it must be timely, relevant, accurate and actionable; it neither replaces the organization's own telemetry nor performs attribution for prosecution.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — cyber threat intelligenceReport a problem with this question

22. 22. A defender wants a catalogue of the tactics and techniques adversaries use, so the team can measure which behaviours it is able to detect. What does such a threat framework provide?

    • A.It provides a live feed of malicious addresses and file hashes for immediate blocking.
    • B.It provides a legal standard setting out the penalties that apply to each technique.
    • C.It provides a certified product list naming the tools an organization is required to buy.
    • D.It provides a shared vocabulary for adversary behaviour, so detection gaps can be measured.✓ Answer

    A threat framework such as MITRE ATT&CK is a structured knowledge base of adversary tactics (the goal) and techniques (the method), giving defenders common language to map their detections against and expose coverage gaps. It is not an indicator feed, a legal instrument or a product list; the Cyber Kill Chain, by contrast, describes an attack as a sequence of stages, and the Diamond Model relates adversary, capability, infrastructure and victim.

    Source: ISC2 CC Exam Outline, Security Operations and Incident Response — threat frameworks; MITRE ATT&CK knowledge base; Lockheed Martin Cyber Kill ChainReport a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →