CC Exam Flashcards

Q: What do ISC2 CC flashcards cover?

These ISC2 CC flashcards cover security principles, business continuity, disaster recovery, incident response, access controls, network security, and security operations.

Q: Are ISC2 CC flashcards enough for beginners?

Flashcards are helpful for learning cybersecurity vocabulary, but beginners should also read explanations and practice questions to understand how concepts apply in scenarios.

Q: How should I use ISC2 CC flashcards?

Use them to build baseline recall, then group missed cards by domain so you know whether to review access control, network security, operations, or incident response.

Question 1

Confidentiality

Accepted Answer

Protecting information from unauthorized disclosure. It matters because privacy, trade secrets, credentials, and regulated data lose value or create legal risk when exposed.

Question 2

Integrity

Accepted Answer

Keeping data accurate, complete, and protected from unauthorized change. Integrity controls matter when decisions depend on trustworthy records, logs, transactions, or configurations.

Question 3

Availability

Accepted Answer

Ensuring systems and data are accessible to authorized users when needed. Availability matters because outages can stop business operations, patient care, payments, or public services.

Question 4

Non-repudiation

Accepted Answer

Assurance that someone cannot credibly deny an action they performed. Digital signatures, audit logs, and strong identity proofing support accountability in disputes and investigations.

Question 5

Privacy

Accepted Answer

Appropriate collection, use, sharing, retention, and protection of personal information. Privacy matters because security controls must respect legal obligations and individual rights.

Question 6

Risk assessment

Accepted Answer

The process of identifying threats, vulnerabilities, likelihood, and impact. It matters because controls should be selected based on real risk rather than guesswork or fear.

Question 7

Risk mitigation

Accepted Answer

Reducing risk by applying controls such as patching, training, segmentation, or monitoring. Mitigation lowers likelihood, impact, or both when risk is not acceptable.

Question 8

Risk transfer

Accepted Answer

Shifting part of the financial impact of risk to another party, often through insurance or contracts. It does not eliminate the underlying security responsibility.

Question 9

Risk acceptance

Accepted Answer

A formal decision to live with a known risk. It matters because acceptance should be documented by an authorized owner, not quietly ignored by a technician.

Question 10

Administrative control

Accepted Answer

A policy, procedure, standard, training program, or governance process. Administrative controls guide behavior and define what technical and physical controls must enforce.

Question 11

Technical control

Accepted Answer

A technology-based safeguard such as MFA, encryption, firewalls, access control lists, or endpoint protection. Technical controls enforce security decisions through systems.

Question 12

Physical control

Accepted Answer

A safeguard that protects facilities, devices, and people, such as locks, guards, badges, cameras, and fences. Physical access can bypass many logical controls.

Question 13

Preventive control

Accepted Answer

A control designed to stop an incident before it happens, such as MFA, hardening, or deny-by-default firewall rules. Prevention reduces opportunities for attack.

Question 14

Detective control

Accepted Answer

A control that identifies events after or while they occur, such as logs, alerts, IDS, or camera review. Detection matters because prevention is never perfect.

Question 15

Corrective control

Accepted Answer

A control that restores or repairs after an incident, such as backups, reimaging, or incident remediation. Corrective controls reduce impact and recovery time.

Question 16

Business continuity

Accepted Answer

Planning to keep essential business functions operating during disruption. It matters because the organization may need alternate processes before full systems are restored.

Question 17

Disaster recovery

Accepted Answer

Restoring IT systems, data, and infrastructure after a major outage or disaster. Disaster recovery is narrower than business continuity and focuses on technology recovery.

Question 18

Incident response

Accepted Answer

The organized process for handling suspected or confirmed security events. It matters because evidence, containment, communication, and recovery must follow a known plan.

Question 19

RTO

Accepted Answer

Recovery Time Objective: the maximum acceptable time a system or process can be down. RTO guides recovery priority and continuity investment.

Question 20

RPO

Accepted Answer

Recovery Point Objective: the maximum acceptable amount of data loss measured in time. RPO drives backup frequency, replication, and recovery design.

Question 21

Lessons learned

Accepted Answer

A post-incident review that identifies what worked, what failed, and what should change. It matters because response plans improve only when findings become actions.

Question 22

Identification

Accepted Answer

Claiming an identity, such as entering a username or presenting an account number. Identification starts access control but does not prove the claim is true.

Question 23

Authentication

Accepted Answer

Proving an identity with factors such as passwords, tokens, biometrics, or certificates. Authentication matters because access decisions rely on knowing who is requesting access.

Question 24

Authorization

Accepted Answer

Granting permissions after identity is established. Authorization answers what an authenticated user or process is allowed to do.

Question 25

Accountability

Accepted Answer

The ability to trace actions to a responsible subject through unique accounts and logs. Shared accounts weaken accountability and complicate investigations.

Question 26

MFA

Accepted Answer

Multifactor authentication uses two or more different factor types: something you know, have, or are. It reduces account takeover risk if one factor is compromised.

Question 27

Least privilege

Accepted Answer

Giving users and systems only the access needed for their duties. It matters because smaller permissions reduce damage from mistakes, misuse, and compromise.

Question 28

Separation of duties

Accepted Answer

Splitting sensitive tasks among different people or roles. It helps prevent fraud and errors, such as one person both creating and approving payments.

Question 29

RBAC

Accepted Answer

Role-Based Access Control assigns permissions to job roles rather than individual users one by one. RBAC simplifies administration and supports consistent least privilege.

Question 30

MAC

Accepted Answer

Mandatory Access Control enforces access based on labels and central policy, not user discretion. It is common in highly controlled environments with classification requirements.

Question 31

DAC

Accepted Answer

Discretionary Access Control lets resource owners decide who can access their objects. It is flexible but can create risk if owners grant access too broadly.

Question 32

OSI model

Accepted Answer

A seven-layer model for understanding network communication: physical, data link, network, transport, session, presentation, and application. It helps locate where problems or controls apply.

Question 33

TCP vs UDP

Accepted Answer

TCP is connection-oriented and reliable; UDP is connectionless and lower overhead. Security questions often use this distinction when discussing ports, scanning, and service behavior.

Question 34

Firewall

Accepted Answer

A control that filters traffic based on rules such as source, destination, port, protocol, or application. Firewalls reduce exposure but need correct placement and rules.

Question 35

IDS vs IPS

Accepted Answer

An IDS detects and alerts; an IPS can block or prevent traffic inline. The difference matters because prevention can disrupt traffic while detection may require response action.

Question 36

VPN

Accepted Answer

A Virtual Private Network creates an encrypted tunnel over an untrusted network. VPNs protect remote access traffic but still require authentication and endpoint security.

Question 37

Network segmentation

Accepted Answer

Dividing a network into zones or segments with controlled communication paths. Segmentation limits lateral movement and keeps sensitive systems away from broad access.

Question 38

DMZ

Accepted Answer

A demilitarized zone is a network segment for public-facing services separated from internal networks. It limits the impact if an exposed service is compromised.

Question 39

VLAN

Accepted Answer

A Virtual LAN logically separates network traffic on shared infrastructure. VLANs support segmentation but must be paired with routing and access controls.

Question 40

DNS

Accepted Answer

Domain Name System translates names to IP addresses. If a host works by IP but not by name, DNS or name resolution is a likely troubleshooting clue.

Question 41

DHCP

Accepted Answer

Dynamic Host Configuration Protocol assigns IP settings such as address, gateway, and DNS server. DHCP problems can prevent devices from joining a network correctly.

Question 42

Encryption

Accepted Answer

Transforming readable data into unreadable ciphertext using a key. Encryption protects confidentiality for data at rest and in transit when keys are managed properly.

Question 43

Hashing

Accepted Answer

Creating a fixed-length digest from data. Hashing supports integrity checks because a changed file should produce a different hash.

Question 44

Data classification

Accepted Answer

Labeling data by sensitivity, value, or handling requirements. Classification matters because controls should match the importance and risk of the information.

Question 45

Data retention

Accepted Answer

Keeping information for the required period and disposing of it when no longer needed. Retention balances business, legal, privacy, and storage requirements.

Question 46

Secure disposal

Accepted Answer

Destroying or sanitizing data and media so information cannot be recovered. It matters when retired drives, documents, or devices contain sensitive data.

Question 47

Logging and monitoring

Accepted Answer

Collecting and reviewing system activity for errors, attacks, and policy violations. Logs support detection, accountability, troubleshooting, and incident investigation.

Question 48

Patch management

Accepted Answer

Testing, approving, and applying updates that fix vulnerabilities or defects. Patch management reduces known attack paths while managing change risk.

Question 49

Security awareness training

Accepted Answer

Education that helps users recognize threats, handle data correctly, and follow policy. It matters because people are part of the control environment.

Question 50

Change management

Accepted Answer

A controlled process for requesting, reviewing, testing, approving, and documenting changes. It reduces outages and security drift caused by unmanaged modifications.

Free CC Exam Flashcards

Filter by Topic

Jump to Card

About These CC Flashcards

Topics Covered

Frequently Asked Questions

ISC2 Certified in Cybersecurity (CC)

Explore More ISC2 Certifications

CISSP

ISC2 SSCP

ISC2 Certified in Governance, Risk and Compliance (CGRC)

ISC2 Certified Secure Software Lifecycle Professional (CSSLP)

CCSP

ISC2 HealthCare Information Security and Privacy Practitioner (HCISPP)

More From This Family