ISC2 CC Matching — 10 Questions

Question 1

Match each security control type to its description.

Accepted Answer

Preventive: Controls that prevent security incidents from occurring. Security controls are categorized by their primary function. Preventive controls stop incidents, detective controls identify them, and corrective controls restore operations. Common confusions involve swapping preventive and detective roles.

Answer

Preventive: Controls that identify security incidents

Answer

Detective: Controls that prevent security incidents

Question 2

Match each risk management term to its meaning.

Accepted Answer

Risk: The potential for loss or harm when a threat exploits a vulnerability.. Risk is the potential for loss when a threat exploits a vulnerability. A threat is a potential cause of harm. A vulnerability is a weakness. Controls are measures to reduce risk.

Answer

Risk: A weakness in a system or its design.

Answer

Threat: The potential for loss or harm.

Answer

Vulnerability: A measure that modifies or reduces risk.

Question 3

Match each security policy type to its focus.

Accepted Answer

Acceptable Use Policy: Defines acceptable behavior for using organizational resources. The correct matches pair each policy type with its primary focus. Common confusions involve swapping definitions between similar policies, such as Acceptable Use with Access Control, or Incident Response with Data Retention.

Answer

Acceptable Use Policy: Defines rules for granting and revoking access to information systems

Answer

Incident Response Policy: Specifies how long data must be stored and when to dispose

Question 4

Match each access control model to its key characteristic.

Accepted Answer

DAC: Access decisions are based on the identity of the user and are at the discretion of the resource owner.. In the ISC2 CC exam, the three main access control models are DAC, MAC, and RBAC. DAC allows resource owners to control access, MAC uses labels and clearances, and RBAC uses roles.

Answer

DAC: Access decisions are based on security labels and clearance levels.

Answer

MAC: Access decisions are based on the roles assigned to users.

Question 5

Match each authentication factor to an example.

Accepted Answer

Something you know: Password. Multi-factor authentication (MFA) requires at least two distinct types of factors. Knowledge (something you know), possession (something you have), inherence (something you are), and location (somewhere you are) are common categories.

Answer

Something you know: Smart card

Answer

Something you have: Password

Question 6

Match each phase of the incident response process to its description.

Accepted Answer

Preparation: Developing procedures, tools, and training before an incident.. The NIST SP 800-61 incident response process includes Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Options A, B, and C are correct; D and E swap definitions between the last two phases.

Answer

Eradication and Recovery: Conducting a post-mortem and applying lessons learned.

Answer

Post-Incident Activity: Removing the root cause and restoring normal operations.

Question 7

Match each type of malware to its primary behavior.

Accepted Answer

Virus: Malware that replicates by attaching to other programs and requires user action to spread.. Common malware types include viruses (need host), worms (self-spreading), and trojans (deceptive). Distractors confuse their replication methods.

Answer

Virus: Self-replicating malware that spreads automatically over networks.

Answer

Worm: Malware that replicates by attaching to other programs and requires user action.

Answer

Trojan Horse: Malware that replicates by attaching to other programs.

Question 8

Match each cryptographic concept to its definition.

Accepted Answer

Symmetric encryption: Uses a single shared key for both encryption and decryption.. Symmetric encryption uses one shared key; asymmetric uses a public-private key pair; hashing is a one-way function; digital signatures use asymmetric cryptography for authentication, integrity, and non-repudiation. Common confusions include mixing up symmetric and asymmetric key usage, or thinking hashing is reversible.

Answer

Symmetric encryption: Uses a pair of keys (public and private) for encryption and decryption.

Answer

Hashing: A reversible process that transforms data into a fixed-size representation.

Question 9

Match each OSI layer to its function.

Accepted Answer

Physical layer: Transmits raw bit stream over physical medium. Correct matches: Physical layer transmits raw bits; Data Link layer provides node-to-node transfer with error control; Network layer routes packets; Transport layer ensures reliable end-to-end delivery. Common confusions include mixing up Data Link and Physical layer functions, or attributing routing to the Data Link layer.

Answer

Physical layer: Provides error detection and correction

Answer

Data Link layer: Routes packets across networks

Question 10

Match each network security concept to its purpose.

Accepted Answer

Firewall: Filters network traffic based on a set of security rules.. The correct matches are: Firewall filters traffic, IDS monitors and alerts, IPS blocks threats, VPN encrypts connections. Common confusions include swapping firewall and IPS functions, or confusing IDS with firewall capabilities.

Answer

Firewall: Detects and blocks suspicious activity.

Answer

IDS: Filters traffic based on rules.