Practice questions for the ISC2 CC exam objectives
Certified in Cybersecurity (CC) CCDomain 1 · Security Principles
A law firm needs to prove, in court if necessary, that a particular partner approved a settlement document electronically and cannot later deny doing so. The IT lead is choosing a mechanism. Which option provides non-repudiation?
ConfidenceI think so
2 / 3
Practice and timed mocks are free, with right or wrong on every answer and your total score.
About this ISC2 CC practice test
This free ISC2 CC practice test has 60 original questions written from the outline of the ISC2. The real exam has 100 questions and a limit of 2 hours. Practice shows right or wrong on every answer; the full analysis, $39 once, adds each explanation and source. Bank checked 2026-05-22.
These three are published in full. For every other question, practice shows right or wrong and the full analysis adds the answer.
Sample question 1: Security Principles
Which of the following is NOT one of the four canonical risk-treatment options recognized by NIST SP 800-39 and tested on ISC2 CC?
Mitigate
Transfer
Detect
Avoid
Answer: C. Detect is an activity (part of the security operations function), not a risk-treatment strategy. The four canonical treatments are mitigate, transfer, avoid, and accept. The exam will sometimes substitute detect or monitor for one of the four canonical options to test whether candidates know the standard list.
Sample question 2: Business Continuity, Disaster Recovery, and Incident Response
A company's recovery objectives for its order-processing system are RTO 4 hours and RPO 30 minutes. Which backup strategy best meets both objectives?
Daily full backups to off-site tape with a 12-hour shipping window
Continuous database replication to a warm secondary site plus hourly transaction-log snapshots
Weekly full backup, daily differential, no off-site copy
Annual full backup, manual export on demand
Answer: B. Continuous replication keeps the secondary site current within minutes, and hourly transaction-log snapshots ensure the RPO 30-minute requirement is met. The warm secondary enables RTO 4 hours. Daily off-site tape cannot meet RPO 30 minutes; weekly / annual schedules cannot meet either objective.
Which wireless security protocol is the current best practice for new enterprise wireless networks and is the version specifically tested on the ISC2 CC exam blueprint as the current standard?
WEP
WPA
WPA2-Personal
WPA3
Answer: D. WPA3 (released by the Wi-Fi Alliance in 2018) is the current-generation wireless security protocol. WEP and the original WPA are deprecated for known cryptographic weaknesses. WPA2-Personal remains widely deployed but is superseded by WPA3 for new enterprise deployments, which is the current ISC2 CC tested standard.
The questions are drafted with AI (Anthropic's Claude) from the official outline and primary sources, then checked against the source each one cites. A licensed professional has not reviewed them unless this page says so. See the AI disclosure.
Who stands behind this page
Accountable editor
Julian Calvo, Ed.D., founder. Ed.D. in Learning Sciences (University of Miami), MBA (Lynn University), Master's in Organizational Learning and Leadership (Barry University). His credentials are in learning sciences and assessment design, not in the field this exam covers.
Licensed professional review
None on record. No licensed professional has reviewed this question bank. It is drafted with AI and checked against its cited sources by the DecipherU item team.
How the questions are made
Drafted with AI (Anthropic's Claude) from the official outline and primary sources, then checked against the source each question cites by the DecipherU item team. Julian Calvo designed this method. No real exam content is used. Read the AI disclosure and the methodology.
What this bank shows
60 live questions; 60 cite at least one primary source. None carries a scheduled re-check date.