How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the CC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ISC2 Certified in Cybersecurity CC questions

Scenario-based practice

Hard Difficulty Questions

Practise ISC2 Certified in Cybersecurity CC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

exam code

ISC2

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A small e-commerce company hosts its web application on a single server with a public IP address. The server runs a Linux OS with Apache, MySQL, and PHP. The company recently experienced a data breach where an attacker gained access to the customer database. The investigation reveals that the attacker exploited a vulnerability in the PHP application to execute arbitrary commands. The server logs show that the attacker used an unauthenticated HTTP POST request to a legacy script that should have been removed. Additionally, the server had default firewall rules allowing all inbound traffic on ports 80 and 443. The company wants to prevent future breaches without redesigning the entire application. Which course of action is the most effective?

A
Move the database to a separate internal server and require VPN access for administration.
Why wrong: This addresses database exposure but does not prevent the initial command injection attack on the web server.
B
Upgrade the PHP version to the latest release and enable SELinux.
Why wrong: Upgrading PHP may not fix the specific vulnerability if it is application-level, and SELinux would not prevent command injection in the web context.
C
Remove the legacy script and update the firewall to block all traffic except necessary IPs.
Why wrong: While removing the script helps, blocking all traffic except necessary IPs is impractical for a public web server and does not prevent future application-level attacks.
D
Implement a web application firewall (WAF) with virtual patching for the vulnerability.
A WAF can block the exploit and similar attacks without requiring code changes, providing immediate protection.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related CC topic practice pages

Security Principles practice questions

Business Continuity, Disaster Recovery, and Incident Response practice questions

Access Controls Concepts practice questions

Security Operations practice questions

Network Security practice questions

Business Continuity, DR & Incident Response practice questions

CC fundamentals practice questions

CC scenario practice questions

CC troubleshooting practice questions

Practice scenarios

A financial institution requires that no single employee can both initiate and approve a wire transfer. This policy enforces which security principle?

A security incident report indicates that an employee used their access to view confidential records unrelated to their job. Which security principle was most likely violated?

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

A company is implementing a data loss prevention (DLP) solution. Which strategy BEST balances security and productivity when monitoring outgoing email?

An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?

Which THREE are differences between a hot site and a cold site? (Select three.)

A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Which THREE of the following are essential components of an incident response plan? (Select THREE.)

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Which of the following is the best practice for managing cryptographic keys in a large organization?

Which THREE of the following are considered risk management strategies? (Select THREE)

During an incident, the IR team identifies that the root cause is a zero-day vulnerability. Which of the following is the best immediate action?

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?