Risk and Control Selection Drill
Key Takeaways
Start with the risk and the objective, then choose a control category.
A technical, administrative, or physical control can each be the right answer; the scenario decides.
Name the decision owner for the risk.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 1.2 and 1.4, checked 2026-10-22.
The Drill
Read the scenario for the asset, the threat, and the objective. Decide whether the decision is about treating the risk (subdomain 1.2) and which control category fits the cause (subdomain 1.4). Then name who owns the decision.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 1.2 and 1.4, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 1.2: Risk management lifecycle
- 1.2: Risk management processes
- 1.4: Technical controls
- 1.4: Administrative controls
- 1.4: Physical controls
Common Traps
A common trap is treating a risk decision as finished once it is written. The lifecycle continues: a decision must still be monitored, and a risk that changes needs a new assessment.
A door can be opened by anyone who holds a shared key. Which control category addresses the cause most directly?
Physical
Technical
Administrative
Governance
Working the Drill
Work through one scenario in three moves. First, name the asset and the risk that threatens its objective. Second, choose the control category that addresses the cause. Third, name the owner who accepts the residual decision and record it. A correct answer makes all three moves; an answer that only names a control, with no risk or owner, is incomplete.
Sections you finish are checked off in the contents.