How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ISC2 Certified in Cybersecurity CC questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise ISC2 Certified in Cybersecurity CC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

exam code

ISC2

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

Which TWO are true about a differential backup? (Select two.)

A
It copies files changed since the last backup of any type
Why wrong: That describes an incremental backup.
B
It requires a full backup to be restored first
The full backup must be restored before applying the differential.
C
It copies files changed since the last full backup
This is the defining characteristic of differential backups.
D
It resets the archive bit on backed-up files
Why wrong: Resetting the archive bit is done by incremental backups, not differential.
E
It is faster to restore than a full backup
Why wrong: Restoring a differential requires first restoring the full backup, then the differential, so it is slower.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CC topic practice pages

Security Principles practice questions

Business Continuity, Disaster Recovery, and Incident Response practice questions

Access Controls Concepts practice questions

Security Operations practice questions

Network Security practice questions

Business Continuity, DR & Incident Response practice questions

CC fundamentals practice questions

CC scenario practice questions

CC troubleshooting practice questions

Practice scenarios

Which TWO are true about a differential backup? (Select two.)

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Which THREE are differences between a hot site and a cold site? (Select three.)

Which TWO of the following are best practices for password management in a corporate environment?

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Which THREE of the following are essential components of an incident response plan? (Select THREE.)

Which TWO of the following are examples of sensitive PII? (Select TWO.)

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Which THREE of the following are considered risk management strategies? (Select THREE)

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Which THREE elements are essential components of a business continuity plan (BCP)?

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Which TWO of the following are commonly used techniques to detect phishing emails? (Choose two.)

Which TWO of the following are examples of integrity controls? (Select TWO)

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)