10 ISC2 CC Practice Questions: Security Principles — With Explanations

Summary

This lesson works through ten original practice questions on Domain 1, Security Principles — confidentiality, integrity, and availability; authentication and non-repudiation; vulnerability; the definition of risk; and the outline's three control categories. The format is pause-and-score: pause before each answer, say your answer out loud, and keep score. Every question is followed by its answer and a short, source-cited explanation, and all ten are listed below with their answers and sources. These are original practice questions written for this series from the concepts in the exam outline; they are not exam questions.

Chapters

• 0:00 Intro — ten questions, Domain 1 only, how the pause-and-score format works
• 0:27 Question 1 — Confidentiality
• 1:19 Question 2 — Integrity
• 2:07 Question 3 — Availability
• 2:58 Question 4 — Authentication (AAA)
• 3:42 Question 5 — Non-repudiation
• 4:46 Question 6 — Vulnerability
• 5:35 Question 7 — Risk definition, two-statement format
• 6:48 Question 8 — Likelihood and impact, prioritization
• 8:00 Question 9 — Administrative control, worked example
• 8:55 Question 10 — Sorting the three control categories, worked example
• 10:05 Final score tally
• 10:23 End-card — like-and-subscribe, checklist, newsletter, series tease

The ten questions, with answers and sources

1. Question 1 — Confidentiality. An employee emails a customer spreadsheet to her personal email account so she can work on it at home. The file was not changed, and the mail system stayed up the whole time. Which leg of the CIA triad has primarily been put at risk? Answer: B — Confidentiality. Confidentiality is about preserving authorized restrictions on access and disclosure — sending the data outside authorized channels breaks exactly that. Nothing was altered (not integrity) and nothing became unavailable to authorized users (not availability). Source: NIST SP 800-12 Rev. 1 §1.4 · ISC2 CC Outline §1.1
2. Question 2 — Integrity. A clerk discovers that the totals on several sent invoices no longer match the amounts originally entered, although nobody with authorization edited them. Which security objective has most clearly failed? Answer: C — Integrity. Integrity means guarding against improper modification of information — data that changed without authorized editing is the textbook case. The invoices were still readable and reachable, so confidentiality and availability are not the primary failure. Source: NIST SP 800-12 Rev. 1 §1.4 · ISC2 CC Outline §1.1
3. Question 3 — Availability. Ransomware encrypts a small clinic's scheduling files. No data was viewed by the attacker, but staff cannot open the schedules they need to do their jobs. Which leg of the CIA triad is most directly harmed? Answer: A — Availability. Availability is ensuring timely and reliable access to and use of information — the files exist and are unaltered, but authorized users cannot use them when they need them. Accounting is part of AAA, not a CIA leg. Source: NIST SP 800-12 Rev. 1 §1.4 · ISC2 CC Outline §1.1
4. Question 4 — Authentication (AAA). In the AAA framework, which element is responsible for verifying the identity of a user, process, or device before access is granted? Answer: D — Authentication. Authentication is the identity-verification step; authorization and accounting come after it in the AAA sequence the outline names. Availability is a CIA objective, not part of AAA. Source: NIST SP 800-12 Rev. 1 Glossary · ISC2 CC Outline §1.1
5. Question 5 — Non-repudiation. A manager approves a purchase using a digital signature tied to her private key. Later she claims she never approved it. Which concept is designed to prevent a sender or approver from falsely denying an action they actually took? Answer: B — Non-repudiation. Non-repudiation is the property that lets an action be tied back to its actor so it cannot credibly be denied afterward. Least privilege limits access scope — it does not prove who performed an action. Source: NIST SP 800-12 Rev. 1 §1.4 · ISC2 CC Outline §1.1
6. Question 6 — Vulnerability. A web server is still running software with a known, publicly documented flaw because patches were never applied. In risk terminology, the unpatched flaw itself is best described as a: Answer: C — Vulnerability. A vulnerability is a weakness in a system or its implementation that could be exploited by a threat source — the unpatched flaw is precisely that weakness. A threat is the circumstance or event that could exploit it; the flaw sitting on the server is not itself the threat. Source: NIST SP 800-12 Rev. 1 §4 and Glossary · ISC2 CC Outline §1.2
7. Question 7 — Risk definition, two-statement format. Statement I: Risk is typically a function of the adverse impact that would arise if an event occurs and the likelihood of the event occurring. Statement II: If a system has a vulnerability, a risk exists at the same level even when no threat could ever exploit that vulnerability. Which option is most correct? Answer: A — Statement I is true; Statement II is false. Statement I restates NIST's definition of risk, so it is true. Statement II fails because risk depends on a threat being able to exploit the weakness and cause harm — a weakness no threat can reach does not carry the same risk, which is why assessors weigh threats, vulnerabilities, impact, and likelihood together. Source: NIST SP 800-12 Rev. 1 Ch. 6 · NIST SP 800-30 Rev. 1 Ch. 2 · ISC2 CC Outline §1.2
8. Question 8 — Likelihood and impact, prioritization. Two risks are assessed. Risk 1: high likelihood, high impact. Risk 2: low likelihood, low impact. Using the likelihood-and-impact view of risk, which risk should be addressed first, all else being equal? Answer: D — Risk 1, because risk grows with both likelihood and impact. Risk is a function of likelihood and adverse impact — "likelihood × impact" is shorthand for that, not a literal formula — so the pairing that is high on both dimensions outranks the pairing that is low on both. The other options invent rules about cost or audit order that this model does not contain. Source: NIST SP 800-30 Rev. 1 Ch. 2 · NIST SP 800-12 Rev. 1 Ch. 6
9. Question 9 — Administrative control, worked example. Which of the following is the best example of an administrative control as that category is used in the CC outline? Answer: A — A written acceptable-use policy that employees must acknowledge. Treat this as a worked example applying the outline's three categories — technical, administrative, and physical. A policy is a management, direction-setting measure, so it files as administrative; the firewall rule and disk encryption are implemented in technology (technical), and the locked server-room door protects physical access (physical). Source: ISC2 CC Outline §1.4
10. Question 10 — Sorting the three control categories, worked example. A security officer is sorting controls into the three categories named in the CC outline. Which sorting is correct? Answer: C — Firewall = technical; security guard = physical; security policy = administrative. This is also a worked sorting example applying the outline's categories: firewalls operate in technology, so they are technical; guards control physical access to facilities, so they are physical; and policies direct behavior through management decisions, so they are administrative. Source: ISC2 CC Outline §1.4

Sources

Sources: ISC2 — Certified in Cybersecurity (CC) Certification Exam Outline, v01/2026 ↗ · NIST SP 800-12 Rev. 1 — An Introduction to Information Security ↗ · NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments ↗