22 Security Principles & Control Types Practice Questions & Answers

1. 1. A contractor emails a spreadsheet of employee home addresses and national ID numbers to a personal mailbox, where it sits unprotected. The file's contents are unchanged and the HR system stays online. Which pillar of the CIA triad was primarily violated?

   • A.Integrity, because the records left the system that was meant to control them
   • B.Confidentiality, because unauthorized parties can now read the records✓ Answer
   • C.Availability, because HR no longer has sole possession of the records
   • D.Non-repudiation, because the sender could deny transmitting the records

   Confidentiality is the property that information is disclosed only to authorized parties, so moving personal records into an uncontrolled mailbox breaks it even though nothing was edited and no service went down. Integrity concerns unauthorized modification and availability concerns timely access by authorized users; neither was affected here.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (confidentiality)Report a problem with this question

2. 2. An attacker quietly feeds mislabeled transactions into the data used to retrain a bank's fraud-detection model, so the model begins approving a class of fraudulent payments. The training data is still readable and the scoring service stays online. Which pillar is primarily affected?

   • A.Confidentiality, because the attacker interacted with the training data
   • B.Integrity, because the data driving the model was altered without authorization✓ Answer
   • C.Availability, because the model no longer performs the function it was built for
   • D.Privacy, because customer transactions were used in an unintended manner

   Integrity covers unauthorized or improper modification of data, and that includes the data an AI system learns from. Poisoning the retraining set changes what the model outputs without disclosing anything or taking the service offline, so it is an integrity failure rather than a confidentiality or availability failure.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (integrity)Report a problem with this question

3. 3. A flood knocks out the power feed to a distribution center. The order database is intact, nothing was disclosed or modified, but staff cannot reach the application for two days. Which pillar failed, described correctly?

   • A.Non-repudiation, which is about actors being unable to deny their actions
   • B.Integrity, which is about records staying internally and externally consistent
   • C.Confidentiality, which is about limiting disclosure to authorized parties
   • D.Availability, which is about timely, reliable access for authorized users✓ Answer

   Availability means that authorized users obtain timely and reliable access to systems and data. A power loss that leaves the data intact and unmodified but unreachable for two days is a pure availability failure; the other three properties describe disclosure, modification and deniability, none of which occurred.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (availability)Report a problem with this question

4. 4. A hospital flags its donor mailing list for strong protection because publication would embarrass donors, and flags its bed-management system for strong protection because an outage would halt admissions. How do these two judgments map onto security terms?

   • A.The mailing list is a criticality judgment; the bed system is a sensitivity judgment
   • B.The mailing list is a sensitivity judgment; the bed system is a criticality judgment✓ Answer
   • C.Both are criticality judgments, since each drives a protection requirement
   • D.Both are sensitivity judgments, since each concerns harm done to the organization

   Sensitivity measures the harm that would result from disclosure, which is a confidentiality concern, while criticality measures the harm that would result from the resource being unavailable. The donor list is judged on disclosure harm and the bed system on outage harm, and exam items deliberately swap the two labels.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (confidentiality and availability)Report a problem with this question

5. 5. At a kiosk a user types a username, taps a hardware token, is granted read access to a shared folder, and every file she opens is written to a log tied to her account. In order, what are these four steps?

   • A.Authentication, identification, accounting, authorization
   • B.Identification, authentication, authorization, accounting✓ Answer
   • C.Authorization, identification, authentication, accounting
   • D.Identification, authorization, authentication, accounting

   The sequence always begins with identification, where the subject merely claims an identity, followed by authentication that proves the claim, authorization that decides which operations are permitted, and accounting that records the actions against that identity. Each step depends on the one before it, which is why the order cannot be rearranged.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (authentication, authorization, accounting)Report a problem with this question

6. 6. A new analyst says, "The system authenticated him, so he is allowed to open the payroll folder." Why is that reasoning wrong?

   • A.Authentication proves both who he is and what he may open, unless logging is enabled
   • B.Authorization happens before authentication, so the folder decision was already made
   • C.Authentication proves only who he is; authorization decides what he may open✓ Answer
   • D.Authentication and authorization are a single step whenever multifactor login is required

   Authentication establishes only that the presented identity is genuine. A separate authorization decision, based on policy and the entitlements assigned to that identity, determines which resources may actually be used, so a successful login is never by itself permission to open a given folder.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (authentication versus authorization)Report a problem with this question

7. 7. An auditor asks which property lets the organization reconstruct, after the fact, exactly which account performed each privileged change. Which element of AAA delivers this?

   • A.Authentication, which confirms the credential presented at the moment of login
   • B.Authorization, which fixes the set of operations an account is permitted
   • C.Identification, which is the claim of identity the account makes at the start
   • D.Accounting, which records the actions taken and ties each one to an identity✓ Answer

   Accounting, sometimes called accountability, is the AAA element that records what was done and binds each recorded action to the identity that performed it. Without that binding an organization can prove that someone logged in but cannot attribute a specific change to a specific account.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (accounting)Report a problem with this question

8. 8. A login requires a password and then approval of a prompt on the user's enrolled phone. A colleague argues this is only two-step verification, not true multifactor. Who is right, and why?

   • A.It is multifactor, since the phone is a possession factor distinct from the password✓ Answer
   • B.It is only two-step, since a phone prompt is a variant of something you know
   • C.It is only two-step, since both checks are performed by the same login service
   • D.It is multifactor, but only if the second check is changed to a fingerprint or face scan

   Multifactor authentication requires factors drawn from different types. A password is something you know and an enrolled phone that approves the prompt is something you have, so the two checks come from different categories; the fact that one service runs both checks does not change the factor types involved.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (authentication factors)Report a problem with this question

9. 9. A field technician signs in with a fingerprint reader on a laptop and a one-time code from a key fob. Which factor types are in use?

   • A.Something you are and somewhere you are
   • B.Something you know and something you are
   • C.Something you have and something you know
   • D.Something you are and something you have✓ Answer

   A fingerprint is an inherence factor, something you are, while a key fob that generates a one-time code is a possession factor, something you have. No secret is recalled from memory here, so the knowledge factor is not involved at all.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (authentication factors)Report a problem with this question

10. 10. Three claims are made about one signed purchase order: (i) it was not altered in transit, (ii) it genuinely came from the stated supplier, (iii) the supplier cannot later deny sending it. Which terms match (i), (ii) and (iii) in order?

    • A.Integrity, authenticity, non-repudiation✓ Answer
    • B.Non-repudiation, integrity, authenticity
    • C.Integrity, non-repudiation, authenticity
    • D.Authenticity, integrity, non-repudiation

    Integrity answers whether the message was changed, authenticity answers whether the source is genuine, and non-repudiation answers whether the actor can credibly deny having acted. They are three separate properties, even though one digital signature can supply all three at once.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (integrity, non-repudiation)Report a problem with this question

11. 11. A grants office must be able to show later that a specific applicant submitted a specific budget form, and to withstand that applicant's denial. Which combination BEST supplies non-repudiation?

    • A.A shared secret key used by both parties to compute a message digest
    • B.A hash of the form stored alongside it in the same document library
    • C.A digital signature made with the applicant's private key, plus audit logs✓ Answer
    • D.An encrypted channel that protects the form while it is being uploaded

    Non-repudiation requires proof that only one party could have produced, so the signature must be made with a key that only the applicant controls and must be paired with logs binding the submission to that identity. A shared secret fails because either holder could have generated the value, and encryption in transit says nothing about who sent the form.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (non-repudiation)Report a problem with this question

12. 12. A retailer keeps purchase histories encrypted and restricted to a small team, yet sells those histories to advertisers without telling customers or offering any choice. Which statement BEST describes the situation?

    • A.Confidentiality is being maintained, but the customers' privacy is not respected✓ Answer
    • B.Both are intact, because privacy is simply confidentiality applied to personal data
    • C.Privacy is being maintained, but the retailer's confidentiality controls have failed
    • D.Neither applies, because privacy concerns only data that has not been encrypted

    Confidentiality is a control objective, keeping data away from unauthorized parties, and the encryption and access limits meet it. Privacy is the individual's right to control how their personal information is collected, used and disclosed, and selling the histories without notice or choice violates that right even though no unauthorized party ever broke in.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity concepts (privacy)Report a problem with this question

13. 13. A company runs quarterly security awareness training on phishing and password hygiene, with attendance tracked by HR. Under the three control categories, how is this classified?

    • A.Administrative, because it governs how people are expected to behave at work✓ Answer
    • B.Physical, because attendance at the sessions is tracked on site by HR
    • C.None of the three, because training only informs and never constrains anyone
    • D.Technical, because the subject matter it teaches is technical in nature

    Administrative, also called managerial, controls are the people-and-process controls: policies, procedures, background screening and training. The subject being taught is irrelevant to the classification; what decides it is that the control works by directing human behavior rather than through hardware, software or a physical barrier.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (administrative controls)Report a problem with this question

14. 14. A staffed reception desk checks badges at the only entrance to a server floor, and its visible presence also discourages people from trying to slip past. On the category axis and the functional axis, what is this?

    • A.Physical in category; corrective and recovery in function
    • B.Physical in category; deterrent and detective in function✓ Answer
    • C.Administrative in category; deterrent and directive in function
    • D.Technical in category; preventive and compensating in function

    A guard or staffed desk protects the facility itself, which makes it a physical control. Functionally it both deters, because a visible human presence discourages an attempt before it starts, and detects, because the person observes and reports what actually happens, which is why exam items pair the two functions.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (physical controls)Report a problem with this question

15. 15. Full-disk encryption is configured on every laptop so that a thief who takes a device cannot read what is stored on it. How is this control classified on both axes?

    • A.Technical in category, detective in function
    • B.Technical in category, preventive in function✓ Answer
    • C.Physical in category, preventive in function
    • D.Administrative in category, corrective in function

    Encryption is implemented in software or hardware, which makes it a technical, also called logical, control. It acts before any loss of confidentiality can occur, because the stolen data is unreadable from the outset, and a control that stops the harm in advance is preventive rather than detective or corrective.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (technical controls)Report a problem with this question

16. 16. A required control cannot be implemented on a legacy system, so the organization deploys a different safeguard that achieves comparable protection and documents the decision. What is that different safeguard called?

    • A.A compensating control, standing in for a control that is not feasible✓ Answer
    • B.A corrective control, applied after the incident to restore operations
    • C.A deterrent control, discouraging anyone from attempting the attack
    • D.A directive control, instructing staff on the behavior expected of them

    A compensating control is a deliberate substitute deployed when the required primary control is not feasible, and it must deliver protection equivalent to the control it replaces, with the rationale documented and approved. It is defined by the substitution relationship, not by when in the incident timeline it acts.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (compensating controls)Report a problem with this question

17. 17. Nightly backups are written to a separate site so that a corrupted database can be restored. On the functional axis, which pair BEST describes what a backup does?

    • A.Preventive and deterrent, because it stops the loss from ever occurring
    • B.Detective and directive, because it reveals the loss as it is happening
    • C.Corrective and recovery, because it acts after the loss has occurred✓ Answer
    • D.Preventive and compensating, because it substitutes for continuous uptime

    A backup does nothing to stop the damaging event and does not reveal it while it happens; its whole value appears afterward, when the copy is used to correct the damage and recover the data. Functions are classified by when the control acts relative to the incident, which places backups after it.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (control functions)Report a problem with this question

18. 18. A manager proposes removing all badge readers and guards from the data hall because the servers already use encryption, strong authentication and detailed logging. What is the BEST objection?

    • A.Technical controls become invalid once a facility has no physical controls at all
    • B.Technical controls must always be approved by the same committee as physical ones
    • C.Physical controls are the only category that regulators recognize as mandatory
    • D.Technical controls cannot stop someone who physically removes or damages a server✓ Answer

    The three categories address different attack paths and complement rather than replace one another: encryption and logging do nothing against someone who walks in and carries a server out, cuts a cable or tampers with hardware. Layering controls across technical, administrative and physical categories is exactly what defense in depth means.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (defense in depth)Report a problem with this question

19. 19. A badge system consists of card readers and door locks, a server that evaluates and logs each swipe, and a written policy on issuing and revoking cards. How should a candidate classify the badge system?

    • A.It is purely physical, because its purpose is to keep people out of a room
    • B.It is purely technical, because software decides whether each door unlocks
    • C.It is physical, technical and administrative at the same time, part by part✓ Answer
    • D.It is purely administrative, because a written policy governs card issuance

    A single safeguard often decomposes into parts that fall in different categories: the readers and locks are physical, the evaluation and logging software is technical, and the issuance and revocation rules are administrative. The exam asks candidates to classify the component being described, not the overall purpose of the system.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand cybersecurity controls (technical, administrative and physical controls)Report a problem with this question

20. 20. A logistics firm buys cyber insurance covering breach notification costs and legal fees. The board asks what the policy actually changes about the firm's obligations. What is the accurate answer?

    • A.It counts as risk acceptance, since the firm chose to keep operating as it is
    • B.It transfers accountability for the data to the insurer along with the costs
    • C.It counts as risk avoidance, since the firm no longer bears the exposure
    • D.It transfers financial impact; accountability for the data stays with the firm✓ Answer

    Buying insurance is risk transference, and what moves to the third party is the financial impact of the loss. Legal liability and accountability for protecting the data remain with the organization and cannot be outsourced, which is the distinction candidates most often get wrong.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand risk management concepts (risk treatment: transference)Report a problem with this question

21. 21. A hardening document ends with the sentence "teams are encouraged to apply these settings where practical." A new analyst treats the document as binding on every team. Which correction is right?

    • A.The wording makes it a standard, which binds every team without exception
    • B.The wording makes it a procedure, which binds whoever performs the task
    • C.The wording makes it a guideline, which is recommended rather than required✓ Answer
    • D.The wording makes it a policy, which binds the organization as a whole

    In the governance document hierarchy, policies, standards and procedures are all mandatory, while guidelines are recommended, discretionary advice. The phrase "encouraged ... where practical" is the tell that the document is a guideline, and treating a guideline as binding is one of the most common errors in this hierarchy.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — understand governance concepts (policies, standards, procedures)Report a problem with this question

22. 22. Before signing with a cloud provider, a security officer studies the provider's control reports and asks detailed questions; afterward she configures encryption and reviews access monthly. Which terms describe the two activities, in order?

    • A.The research is due diligence; the configuring is due care✓ Answer
    • B.Both activities are due diligence, since both are investigative
    • C.Both activities are due care, since both are reasonable acts
    • D.The research is due care; the configuring is due diligence

    Due diligence is the investigative work of finding out what the right thing to do is and verifying it on an ongoing basis, while due care is acting reasonably and prudently on that knowledge, the prudent person standard. Research comes first and the protective action follows, so the two are sequential rather than interchangeable.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Principles — Maintain professional and ethical conduct (due care and due diligence)Report a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →