Question bank
ISC2 Certified in Cybersecurity
41 ISC2 Certified in Cybersecurity questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Access Control Concepts
8 questions in this domain
- Question 1Single Choice
Which process verifies that a user is who they claim to be?
- AAuthenticationCorrect answer
- BAuthorization
- CAccounting
- DIdentification
Why this is the answer
Authentication verifies the identity claim through factors such as passwords, tokens, or biometrics. It is the first gate before accessing resources.
- Question 2Multiple Select
Which of the following are authentication factors? Select all that apply.
- APasswordCorrect answer
- BSmartcard tokenCorrect answer
- CFingerprintCorrect answer
- DUsername
Why this is the answer
Authentication factors are categories: something you know, something you have, and something you are. A username only claims an identity; it does not prove it.
- Question 3Interactive
Review the items listed in the code block. Which ones are classified as something you have? Select all that apply.
- ASmartcardCorrect answer
- BHardware tokenCorrect answer
- CPassword
- DFingerprint
Why this is the answer
Something you have includes physical objects like smartcards and hardware tokens. Passwords are something you know; fingerprints are something you are.
- Question 4Single Choice
A user enters a username but has not yet supplied a password. What is this action called?
- AIdentificationCorrect answer
- BAuthentication
- CAuthorization
- DAccounting
Why this is the answer
Identification is the act of claiming an identity. Authentication follows when the user proves that claimed identity with a password or other factor.
- Question 5Multiple Select
Which activities are part of the accounting phase in the AAA framework? Select all that apply.
- ALogging user activitiesCorrect answer
- BTracking resource consumptionCorrect answer
- CProviding an audit trailCorrect answer
- DGranting access to files
Why this is the answer
Accounting tracks and logs user activities and resource usage to create audit trails. Granting access is part of authorization, not accounting.
- Question 6Interactive
Refer to the code block. Which items are administrative controls? Select all that apply.
- ASecurity policyCorrect answer
- BOnboarding trainingCorrect answer
- CFirewall
- DPerimeter fence
Why this is the answer
Administrative controls include policies, procedures, and training. Firewalls are technical controls, while fences are physical controls.
- Question 7Single Choice
A locked door, a firewall, and mandatory training are all intended to stop an incident before it occurs. What control function do they represent?
- APreventiveCorrect answer
- BDetective
- CCorrective
- DAdministrative
Why this is the answer
Preventive controls stop incidents before they occur. They can be physical, technical, or administrative, but their function is prevention.
- Question 8Multiple Select
Which of which of these are technical controls? Select all that apply.
- AFirewallCorrect answer
- BEncryptionCorrect answer
- CIntrusion detection systemCorrect answer
- DSecurity awareness training
Why this is the answer
Technical controls use hardware and software, such as firewalls, encryption, and intrusion detection systems. Training is an administrative control.
Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR)
7 questions in this domain
- Question 9Single Choice
In the context of identity management, what is the process of verifying that a user is who they claim to be?
- AAuthenticationCorrect answer
- BAuthorization
- CAccounting
- DIdentification
Why this is the answer
Authentication verifies a claimed identity using factors such as passwords, tokens, or biometrics. Identification only claims an identity, while authorization determines permissions and accounting logs activities.
- Question 10Multiple Select
Which of the following are examples of administrative controls, which are centered on people and processes? Select all that apply.
- ASecurity awareness trainingCorrect answer
- BSeparation of dutiesCorrect answer
- CFirewall rules
- DBiometric door locks
Why this is the answer
Administrative controls are management-directed actions such as policies, training, hiring practices, and separation of duties. Firewalls are technical controls, and biometric locks are physical controls.
- Question 11Interactive
Review the pseudocode. Which type of verification is being performed before access is granted?
- AAuthenticationCorrect answer
- BAuthorization
- CAccounting
- DIdentification
Why this is the answer
Authentication verifies the user's credentials before access is granted. Authorization would check permissions, accounting would log activity, and identification only claims an identity.
- Question 12Single Choice
Which category of security control includes policies, procedures, and awareness training?
- AAdministrative controlCorrect answer
- BTechnical control
- CPhysical control
- DCorrective control
Why this is the answer
Administrative controls are people-and-process centric, including policies, procedures, awareness training, hiring practices, and separation of duties.
- Question 13Multiple Select
Which of the following are preventive controls designed to stop a security incident before it occurs? Select all that apply.
- ALocked doorCorrect answer
- BFirewallCorrect answer
- CSecurity camera footage review
- DMandatory training programCorrect answer
Why this is the answer
Preventive controls block threats before they occur. Locked doors, firewalls, and training help stop incidents, while reviewing camera footage detects incidents after they happen.
- Question 14Interactive
In an incident response scenario, what function does the logic perform when it alerts on suspicious events?
- ADetectiveCorrect answer
- BPreventive
- CCorrective
- DPhysical
Why this is the answer
Detective controls identify and alert personnel to a security incident that is occurring or has already occurred. The pseudocode performs detection by notifying security on suspicious events.
- Question 15Single Choice
What is the difference between a threat and a vulnerability in risk assessment?
- AA threat is a potential cause; a vulnerability is a weaknessCorrect answer
- BA threat is a weakness; a vulnerability is a potential cause
- CThey are equivalent terms
- DThreats are always intentional; vulnerabilities are accidental
Why this is the answer
A threat is a potential cause of an unwanted incident, while a vulnerability is a weakness in an asset or control. Risk occurs when a threat can exploit a vulnerability.
Network Security
9 questions in this domain
- Question 16Single Choice
Which statement best defines authentication in a network security context?
- AThat a user is who they claim to beCorrect answer
- BWhich resources a user may access
- CWhat actions a user can perform
- DThat user activities are logged for review
Why this is the answer
Authentication verifies a claimed identity. Authorization controls resource access, and accounting provides activity logs.
- Question 17Multiple Select
What are the valid technical controls? Select all that apply.
- AFirewallCorrect answer
- BMulti-factor authenticationCorrect answer
- CIntrusion detection systemCorrect answer
- DSecurity awareness training
Why this is the answer
Firewalls, MFA, and intrusion detection systems are technology-based controls. Training is an administrative control.
- Question 18Interactive
In the provided login function, which statement performs the authentication step?
- Averify_password(user, password)Correct answer
- Bfind_user(username)
- Cget_permissions(user)
- Draise AccessDenied()
Why this is the answer
find_user only identifies the account; verify_password authenticates the user, while get_permissions performs authorization.
- Question 19Single Choice
What does authorization enforce after a user is authenticated?
- APrinciple of Least PrivilegeCorrect answer
- BPassword complexity requirements
- CUser identification
- DLogging and monitoring
Why this is the answer
Authorization determines allowed resources and actions and enforces least privilege, not password or logging functions.
- Question 20Multiple Select
Which of the following are detective controls? Select all that apply.
- AReviewing system logsCorrect answer
- BConducting periodic auditsCorrect answer
- CReviewing security camera footageCorrect answer
- DRestoring data from backups
Why this is the answer
Detective controls identify ongoing or past incidents. Restoring backups is a corrective control.
- Question 21Interactive
According to the risk calculation shown, which response strategy is being applied?
- AMitigationCorrect answer
- BTransfer
- CAvoidance
- DAcceptance
Why this is the answer
Mitigation reduces likelihood or impact through controls, as shown by the risk score dropping from 20 to 10.
- Question 22Single Choice
Who defines the amount of risk an organization is willing to take?
- AA management decision about how much risk to acceptCorrect answer
- BA technical decision made by network administrators
- CThe amount of risk remaining after controls are applied
- DThe process of eliminating all risks
Why this is the answer
Risk appetite is set by management to guide strategy. Residual risk is what remains after controls.
- Question 23Multiple Select
Which of which of these are administrative controls? Select all that apply.
- ASeparation of dutiesCorrect answer
- BSecurity policiesCorrect answer
- CAwareness trainingCorrect answer
- DCCTV surveillance
Why this is the answer
Administrative controls are people- and process-focused. CCTV is a physical control.
- Question 24Interactive
Given the firewall rule set shown, which category of controls does this configuration represent?
- ATechnical controlCorrect answer
- BAdministrative control
- CPhysical control
- DPreventive control
Why this is the answer
A firewall rule set is a technical control because it uses technology to enforce security. It is also preventive, but the question asks for category.
Security Operations
7 questions in this domain
- Question 25Single Choice
In the AAA framework, what question does authentication answer?
- AWho are you?Correct answer
- BWhat can you access?
- CWhat actions did you take?
- DWhat resources did you consume?
Why this is the answer
Authentication verifies a user's claimed identity. Authorization later determines what resources that identity may access.
- Question 26Multiple Select
Which authentication factors are classified as something you have?
- AHardware security keyCorrect answer
- BSmart card tokenCorrect answer
- CPassword
- DFingerprint scan
Why this is the answer
Something you have factors are physical or digitally held objects, such as security keys and smart cards. Passwords are knowledge; fingerprints are inherence.
- Question 27Interactive
Review the code block. Which authentication factor is the code checking?
- ASomething you knowCorrect answer
- BSomething you have
- CSomething you are
- DSomething you do
Why this is the answer
The code compares a submitted password to a stored hash. A password is a secret known by the user, so it is a something you know factor.
- Question 28Single Choice
After a user's identity has been authenticated, what does authorization determine?
- AThe resources the user can access and the actions they can performCorrect answer
- BHow the user proves their identity
- CThe user's password history
- DHow many failed logins are allowed
Why this is the answer
Authorization assigns permissions based on the validated identity and enforces least privilege. Authentication, not authorization, proves identity.
- Question 29Multiple Select
Which goals are part of accounting in the AAA framework?
- AAudit trail for user actionsCorrect answer
- BReconstruction of events after an incidentCorrect answer
- CPost-incident forensic analysisCorrect answer
- DCommercial customer billing
Why this is the answer
Accounting logs user activities and resource usage to support auditability and accountability. Commercial billing is not its security purpose.
- Question 30Interactive
Review the log excerpt in the code block. Which AAA phase does it primarily represent?
- AIdentification
- BAuthentication
- CAuthorization
- DAccountingCorrect answer
Why this is the answer
The log records user activity, resource access, and timestamps. Creating these records is accounting, which supports accountability.
- Question 31Single Choice
Which security control is an administrative control?
- ASecurity awareness trainingCorrect answer
- BBiometric door lock
- CIntrusion detection system
- DFire suppression system
Why this is the answer
Administrative controls include policies, procedures, and training. Lock, IDS, and fire suppression are physical or technical controls.
Security Principles
10 questions in this domain
- Question 32Single Choice
What is the primary purpose of authentication in a security framework?
- AVerifies a user's claimed identityCorrect answer
- BDetermines user access rights
- CTracks user activities for audit
- DUser claims an identity with a username
Why this is the answer
Authentication proves a claimed identity using something known, something possessed, or an inherent attribute; access rights are authorization, and tracking is accounting.
- Question 33Multiple Select
Which are valid authentication factors? Select all that apply.
- ASomething you knowCorrect answer
- BSomething you haveCorrect answer
- CSomething you areCorrect answer
- DSomething you prefer
Why this is the answer
Authentication factors include something you know, something you have, something you are, and something you do; preference is not a factor.
- Question 34Interactive
In the code block, a session is granted after credentials match a stored identity. Which security principle is shown?
- AAuthenticationCorrect answer
- BAuthorization
- CAccounting
- DIdentification
Why this is the answer
The code verifies the user's credentials against a stored identity, which is the authentication step.
- Question 35Single Choice
After a user's identity is verified, what does authorization determine?
- AResource access and permitted actionsCorrect answer
- BPassword strength
- CPhysical location
- DPrevious login times
Why this is the answer
Authorization enforces permissions and the principle of least privilege after a user has been authenticated.
- Question 36Multiple Select
Which components make up the AAA framework? Select all that apply.
- AAuthenticationCorrect answer
- BAuthorizationCorrect answer
- CAccountingCorrect answer
- DAvailability
Why this is the answer
AAA stands for Authentication, Authorization, and Accounting; availability is part of the CIA triad, not AAA.
- Question 37Interactive
The code block grants write access only to admin roles and read-only access to others. Which principle is represented?
- AAuthorizationCorrect answer
- BAuthentication
- CIdentification
- DAccounting
Why this is the answer
Role-based access rules determine what actions a user can perform, which is the core of authorization.
- Question 38Single Choice
In cybersecurity, accounting is primarily used for what purpose?
- AAuditing and accountabilityCorrect answer
- BBilling and cost recovery
- CMarketing analytics
- DHardware maintenance
Why this is the answer
In cybersecurity, accounting provides the audit trail for reconstructing events and supporting accountability.
- Question 39Multiple Select
Which statements correctly differentiate identification from authentication? Select all that apply.
- AIdentification claims; authentication provesCorrect answer
- BAuthentication occurs before identification
- CUsername is identificationCorrect answer
- DFingerprint is identification
Why this is the answer
Identification is the initial claim, such as a username, while authentication proves that claim, such as with a fingerprint.
- Question 40Interactive
The code block writes the user, action, and timestamp to a log. Which security principle is demonstrated?
- AAccountingCorrect answer
- BAuthentication
- CAuthorization
- DIdentification
Why this is the answer
Recording the user, action, and timestamp creates the audit trail that supports accounting and accountability.
- Question 41Single Choice
What is the end goal of the AAA framework that links actions to a verified identity?
- AAccountabilityCorrect answer
- BAuthentication
- CAccounting
- DAnonymity
Why this is the answer
Accountability is the end goal: linking actions to a verified identity and specific permissions.
Frequently asked questions
Everything about the ISC2 Certified in Cybersecurity question bank and how to use it.