How many Drag and Drop Matching Questions questions are on this page?

This page has 5 Drag and Drop Matching Questions scenario questions for the CC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ISC2 Certified in Cybersecurity CC questions

Scenario-based practice

Drag and Drop Matching Questions

Practise ISC2 Certified in Cybersecurity CC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

exam code

ISC2

vendor

Scenario guide

How to approach drag and drop matching questions

Matching questions give you two columns — concepts, commands, or protocols on the left, and their definitions or use-cases on the right. You drag each left item to its correct match. These appear on most certification exams and punish superficial memorisation.

Quick answer

Drag and Drop Matching Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummatching

Full question →

Match each security policy type to its focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Rules for using company assets

How long data is kept

Steps to restore IT after a disaster

Maintain operations during disruptions

A
Acceptable Use Policy: Defines acceptable behavior for using organizational resources
The Acceptable Use Policy focuses on proper use of organizational assets.
B
Data Retention Policy: Specifies how long data must be stored and when to dispose
The Data Retention Policy defines data lifecycle and disposal timelines.
C
Access Control Policy: Defines rules for granting and revoking access to information systems
The Access Control Policy governs who can access what resources.
D
Incident Response Policy: Outlines procedures for detecting, responding to, and recovering from security incidents
The Incident Response Policy guides the organization's response to security events.
E
Acceptable Use Policy: Defines rules for granting and revoking access to information systems
Why it fails: Incorrect — this describes Access Control Policy, not Acceptable Use Policy.
F
Incident Response Policy: Specifies how long data must be stored and when to dispose
Why it fails: Incorrect — this describes Data Retention Policy, not Incident Response Policy.

Full breakdown with real-world context →

Question 2mediummatching

Full question →

Match each security control type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Discourages potential attackers

Blocks unauthorized access

Identifies and logs incidents

Restores after an incident

Alternative control when primary is not feasible

A
Preventive: Controls that prevent security incidents from occurring
Preventive controls are proactive measures like firewalls and access controls that stop incidents before they happen.
B
Detective: Controls that identify and log security incidents
Detective controls monitor and alert on suspicious activities, such as intrusion detection systems and audit logs.
C
Corrective: Controls that restore systems after an incident
Corrective controls like backups and incident response plans help recover normal operations after a security event.
D
Preventive: Controls that identify security incidents
Why it fails: Incorrect — identifying incidents is the role of detective controls, not preventive.
E
Detective: Controls that prevent security incidents
Why it fails: Incorrect — preventing incidents is the role of preventive controls, not detective.

Full breakdown with real-world context →

Question 3mediummatching

Full question →

Match each risk management term to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Weakness in a system

Potential cause of harm

Likelihood and impact of a threat exploiting a vulnerability

Control to mitigate risk

A
Risk: The potential for loss or harm when a threat exploits a vulnerability.
Correct definition of risk in information security.
B
Threat: A potential cause of an unwanted incident that may result in harm to a system or organization.
Correct definition of a threat.
C
Vulnerability: A weakness in a system or its design that can be exploited by a threat.
Correct definition of a vulnerability.
D
Risk: A weakness in a system or its design.
Why it fails: Incorrect — this describes vulnerability, not risk.
E
Threat: The potential for loss or harm.
Why it fails: Incorrect — this describes risk, not threat.
F
Vulnerability: A measure that modifies or reduces risk.
Why it fails: Incorrect — this describes a control, not vulnerability.

Full breakdown with real-world context →

Question 4mediummatching

Full question →

Match each phase of the incident response process to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Train and equip the team

Identify and scope the incident

Stop the spread and restore systems

Lessons learned and reporting

A
Preparation: Developing procedures, tools, and training before an incident.
Preparation involves establishing plans, assembling tools, and training staff to ensure readiness for incidents.
B
Detection and Analysis: Identifying and investigating potential incidents.
Detection and analysis focuses on recognizing signs of incidents and analyzing data to confirm them.
C
Containment: Limiting the impact and spread of an incident.
Containment aims to stop the incident from causing further damage and to isolate affected systems.
D
Eradication and Recovery: Conducting a post-mortem and applying lessons learned.
Why it fails: Incorrect — this describes Post-Incident Activity, not Eradication and Recovery, which involves removing the root cause and restoring operations.
E
Post-Incident Activity: Removing the root cause and restoring normal operations.
Why it fails: Incorrect — this describes Eradication and Recovery, not Post-Incident Activity, which involves reviewing the incident and improving processes.

Full breakdown with real-world context →

Question 5mediummatching

Full question →

Match each network security concept to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters traffic based on rules

Segments public-facing servers

Maps private to public IPs

Encrypts data over public networks

Monitors for suspicious activity

A
Firewall: Filters network traffic based on a set of security rules.
Correct: A firewall is a security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
B
IDS: Monitors network traffic for suspicious activity and alerts administrators.
Correct: An Intrusion Detection System (IDS) passively monitors traffic and generates alerts when suspicious patterns are detected.
C
IPS: Detects and prevents suspicious activity by blocking traffic.
Correct: An Intrusion Prevention System (IPS) actively monitors and blocks suspicious traffic in real time.
D
VPN: Establishes an encrypted connection over a public network.
Correct: A Virtual Private Network (VPN) creates a secure, encrypted tunnel between a device and a network over the internet.
E
Firewall: Detects and blocks suspicious activity.
Why it fails: Incorrect: This describes an Intrusion Prevention System (IPS), not a firewall. Firewalls filter traffic based on rules, not primarily detect and block suspicious activity.
F
IDS: Filters traffic based on rules.
Why it fails: Incorrect: This describes a firewall, not an IDS. An IDS monitors and alerts, it does not filter traffic.

Full breakdown with real-world context →

These CC practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style CC questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Drag and Drop Matching Questions

How to approach drag and drop matching questions

Quick answer

Related CC topic practice pages

Security Operations practice questions

Network Security practice questions

Security Principles practice questions

Business Continuity, Disaster Recovery, and Incident Response practice questions

Access Controls Concepts practice questions

Business Continuity, DR & Incident Response practice questions

CC fundamentals practice questions

CC scenario practice questions

CC troubleshooting practice questions

Practice scenarios

Match each security policy type to its focus.

Match each security control type to its description.

Match each risk management term to its meaning.

Match each phase of the incident response process to its description.

Match each network security concept to its purpose.