View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 1

What is the primary purpose of cybersecurity risk management?

1. Identify, assess, and treat security risks
2. Increase employee productivity
3. Replace organizational policies
4. Eliminate every possible threat

Correct Answer: 1

Explanation:

Cybersecurity risk management focuses on understanding potential risks and making informed decisions about how those risks should be handled. Organizations typically identify assets and threats, assess the likelihood and impact of adverse events, and then select appropriate treatments such as mitigation, transfer, avoidance, or acceptance. The objective is not to eliminate every possible threat because complete elimination is generally impractical. Instead, organizations establish an acceptable level of risk while protecting important systems and information. Effective risk management also supports business objectives by helping leadership prioritize security resources according to the organization’s actual exposure and operational requirements.

Question 2

Which security principle gives users only the access required for assigned duties?

1. Defense in depth
2. Least privilege
3. Separation of duties
4. Open access

Correct Answer: 2

Explanation:

Least privilege means granting an individual, process, or system only the permissions necessary to perform its authorized responsibilities. Limiting privileges reduces the potential damage caused by compromised credentials, accidental misuse, or malicious activity. For example, an employee responsible for reviewing reports may need read access but not permission to modify production databases. Defense in depth uses multiple security layers, while separation of duties divides sensitive responsibilities among different people or roles. Open access follows the opposite approach and generally increases exposure. Least privilege is therefore a fundamental access-control principle for reducing unnecessary authorization.

Question 3

Which security control is primarily intended to discourage unauthorized behavior?

1. Preventive control
2. Detective control
3. Deterrent control
4. Corrective control

Correct Answer: 3

Explanation:

A deterrent control is designed to discourage individuals from attempting unauthorized or harmful actions. Warning banners, visible security personnel, and clearly communicated disciplinary consequences can serve as deterrents because they influence behavior before an incident occurs. Preventive controls actively block unwanted events, detective controls identify events that have occurred or are occurring, and corrective controls help restore systems after an incident. A deterrent may not technically prevent an attack, but it can reduce the likelihood that someone will attempt prohibited activity. Security programs often combine deterrent controls with preventive and detective mechanisms.

Question 4

What does confidentiality protect against?

1. Unauthorized modification
2. Unauthorized disclosure
3. Service interruption
4. Hardware failure

Correct Answer: 2

Explanation:

Confidentiality is the protection of information from unauthorized access or disclosure. It ensures that sensitive information is available only to individuals, systems, or processes that have legitimate authorization to view it. Access controls, encryption, data classification, and secure communication channels are common confidentiality safeguards. Integrity addresses unauthorized modification or destruction of information, while availability focuses on reliable access to systems and data when needed. Hardware failure can affect availability but does not specifically define a confidentiality concern. Protecting confidentiality is particularly important for sensitive personal, financial, proprietary, and operational information.

Question 5

Which document formally defines acceptable employee behavior when using organizational technology?

1. Incident response plan
2. Business continuity plan
3. Acceptable use policy
4. Disaster recovery procedure

Correct Answer: 3

Explanation:

An acceptable use policy establishes expectations for how employees and other authorized users may use organizational systems, networks, applications, and information resources. It can address activities such as personal use, prohibited software, internet usage, credential handling, removable media, and protection of organizational information. An incident response plan focuses on handling security incidents, a business continuity plan addresses continued operations during disruptions, and a disaster recovery procedure focuses on restoring technology and services. The acceptable use policy therefore provides the behavioral framework users are expected to follow while interacting with organizational technology.

Question 6

Which authentication factor category includes a fingerprint?

1. Something you know
2. Somewhere you are
3. Something you have
4. Something you are

Correct Answer: 4

Explanation:

A fingerprint is an example of the something you are authentication factor because it represents a biometric characteristic of the individual. Other biometric examples include facial characteristics, iris patterns, and voice characteristics. Something you know includes information such as passwords or PINs. Something you have refers to possession of an item such as a hardware token or smart card. Somewhere you are can represent a location-based factor. Multifactor authentication becomes stronger when different factor categories are combined rather than relying exclusively on one authentication characteristic.

Question 7

What is the main purpose of security awareness training?

1. Teach users to recognize and respond to security risks
2. Configure network routing
3. Replace technical security controls
4. Approve software licenses

Correct Answer: 1

Explanation:

Security awareness training helps users understand common security risks and the behaviors expected when handling organizational information and technology. Training may cover phishing, password protection, social engineering, reporting procedures, removable media, physical security, and safe handling of sensitive information. Users are an important part of an organization’s security environment because attackers may target human behavior rather than technical vulnerabilities. Awareness training does not replace firewalls, endpoint protection, identity controls, or other technical safeguards. Instead, it complements those controls by helping personnel recognize suspicious situations and respond according to established procedures.

Question 8

Which principle requires critical responsibilities to be divided among multiple individuals?

1. Least functionality
2. Separation of duties
3. Data minimization
4. Secure defaults

Correct Answer: 2

Explanation:

Separation of duties divides sensitive responsibilities so that one individual cannot independently complete an entire high-risk process. For example, one employee might create a financial transaction while another approves it. This reduces opportunities for fraud, abuse, or undetected mistakes because multiple people participate in the process. Least functionality limits systems to necessary functions, data minimization reduces unnecessary collection or retention, and secure defaults establish safer initial configurations. Separation of duties is especially valuable for privileged administrative activities, financial processes, and other operations where concentrated authority could create significant risk.

Question 9

Which control category identifies suspicious activity after it occurs?

1. Detective
2. Preventive
3. Deterrent
4. Recovery

Correct Answer: 1

Explanation:

Detective controls are designed to identify security events, policy violations, or suspicious activity. Examples include intrusion detection systems, security monitoring, audit logs, and certain alerting mechanisms. These controls do not necessarily stop an event from occurring, but they provide visibility that can help security personnel recognize and investigate problems. Preventive controls attempt to stop unwanted activity before it succeeds, deterrent controls discourage harmful behavior, and recovery controls help restore operations after an incident. Effective security architectures commonly combine all these control categories so that prevention, detection, response, and recovery work together.

Question 10

Which asset classification normally requires the strongest protection?

1. Public information
2. Internal information
3. Restricted information
4. Published marketing material

Correct Answer: 3

Explanation:

Restricted information generally represents highly sensitive information whose unauthorized disclosure, alteration, or loss could cause significant harm to an organization or its stakeholders. Examples might include sensitive personal information, critical intellectual property, regulated records, or confidential security information, depending on the organization’s classification scheme. Public information is intended for unrestricted disclosure, while internal information is generally limited to organizational use. Marketing material may also be publicly distributed. Security controls should be aligned with the sensitivity and business impact associated with each classification rather than applying identical protections to every type of information.

Question 11

What does integrity ensure about information?

1. It remains accurate and protected from unauthorized alteration
2. It is accessible to everyone
3. It is stored indefinitely
4. It is always publicly available

Correct Answer: 1

Explanation:

Integrity ensures that information remains accurate, complete, and protected against unauthorized modification or destruction. Controls supporting integrity include access restrictions, hashing, digital signatures, version controls, audit trails, and change-management processes. These mechanisms help organizations determine whether information has been altered improperly and establish accountability for changes. Confidentiality limits unauthorized disclosure, while availability concerns timely and reliable access. Information does not need to be publicly available or retained indefinitely to maintain integrity. The essential requirement is that authorized information remains trustworthy and that unauthorized changes can be prevented or detected.

Question 12

Which process determines whether a security event has become an incident?

1. Asset disposal
2. Incident classification
3. Software deployment
4. Capacity planning

Correct Answer: 2

Explanation:

Incident classification evaluates a reported security event against established criteria to determine its significance and appropriate response. Not every unusual event is automatically treated as a security incident. Organizations may consider factors such as affected assets, business impact, scope, severity, and evidence of unauthorized activity. Classification helps response teams prioritize resources and follow the appropriate escalation procedures. Asset disposal concerns the secure retirement of equipment or information, software deployment introduces applications or updates, and capacity planning addresses resource requirements. Incident classification therefore helps determine how a security event should be handled operationally.

Question 13

Which principle focuses on keeping systems limited to necessary capabilities?

1. Least functionality
2. Defense in depth
3. Failover
4. Redundancy

Correct Answer: 1

Explanation:

Least functionality means configuring systems, applications, and devices to provide only the capabilities necessary for their intended purpose. Removing unnecessary services, applications, ports, protocols, and features reduces the attack surface and limits opportunities for exploitation. Defense in depth uses multiple layers of protection, while failover and redundancy focus primarily on resilience and continued operation. For example, a server that does not require an unused network service should have that service disabled rather than leaving it available unnecessarily. Least functionality is therefore an effective way to reduce unnecessary exposure within an environment.

Question 14

Which activity verifies that an employee still requires assigned system access?

1. Log rotation
2. Access review
3. Vulnerability scanning
4. Network segmentation

Correct Answer: 2

Explanation:

An access review examines assigned permissions to determine whether users still require them for their current responsibilities. Regular reviews can identify excessive privileges, outdated accounts, inappropriate group memberships, and access that remained after a role change. This supports least privilege and reduces the risk associated with stale authorization. Log rotation manages the lifecycle of recorded events, vulnerability scanning identifies weaknesses, and network segmentation separates systems or traffic zones. Access reviews are therefore an important administrative control for maintaining appropriate authorization over time.

Question 15

Which attack attempts to manipulate people into revealing protected information?

1. Social engineering
2. Disk fragmentation
3. Packet routing
4. Data compression

Correct Answer: 1

Explanation:

Social engineering attacks exploit human behavior rather than relying exclusively on technical vulnerabilities. Attackers may impersonate trusted individuals, create urgency, exploit authority, or use deceptive communication to persuade victims to reveal information or perform unsafe actions. Phishing, pretexting, baiting, and impersonation are common examples. Organizations reduce social-engineering risk through awareness training, verification procedures, strong authentication, and reporting mechanisms. Disk fragmentation affects storage organization, packet routing determines network paths, and data compression reduces file size. None of those activities describes manipulation of people for unauthorized access or information disclosure.

Question 16

Which security objective focuses on keeping services operational when needed?

1. Confidentiality
2. Integrity
3. Availability
4. Accountability

Correct Answer: 3

Explanation:

Availability means that authorized users can access systems, services, and information when they need them. Availability controls include redundancy, backups, resilient architecture, capacity management, monitoring, disaster recovery, and protection against service-disruption attacks. Confidentiality protects information from unauthorized disclosure, integrity protects information from unauthorized modification, and accountability supports tracing actions to responsible entities. An organization may have highly confidential and accurate data, but if authorized personnel cannot access it when required, availability has not been adequately maintained. Availability is therefore a core component of the cybersecurity triad.

Question 17

Which document describes how an organization should respond to cybersecurity incidents?

1. Incident response plan
2. Procurement policy
3. Password standard
4. Data retention schedule

Correct Answer: 1

Explanation:

An incident response plan establishes the organization’s approach to handling cybersecurity incidents. It typically defines roles, responsibilities, communication paths, escalation requirements, investigation activities, containment strategies, evidence handling, recovery steps, and post-incident activities. Having a documented plan allows responders to act more consistently during stressful situations and reduces uncertainty about responsibilities. A procurement policy governs purchasing activities, a password standard establishes credential requirements, and a data retention schedule defines how long information should be retained. The incident response plan specifically addresses coordinated actions during security incidents.

Question 18

Which practice helps ensure security requirements are considered before a new system is deployed?

1. Secure disposal
2. Security-by-design
3. Log archival
4. Account deactivation

Correct Answer: 2

Explanation:

Security-by-design integrates security considerations into the planning, architecture, development, and implementation of a system rather than treating security as an afterthought. Requirements such as authentication, authorization, encryption, logging, privacy, resilience, and secure configuration can be addressed early in the lifecycle. Early consideration generally makes security requirements easier to incorporate into system architecture and development processes. Secure disposal applies when assets are retired, log archival concerns preservation of records, and account deactivation removes access when it is no longer required. Security-by-design therefore emphasizes security throughout system development.

Question 19

Which physical control restricts unauthorized entry into a secured facility?

1. Encryption
2. Password policy
3. Badge-controlled door
4. File integrity monitoring

Correct Answer: 3

Explanation:

A badge-controlled door is a physical access control that restricts entry to authorized individuals. Access badges can be associated with identities and may generate records showing when personnel enter or leave protected areas. Physical controls are important because unauthorized physical access can allow attackers to reach systems, devices, storage media, or sensitive documents directly. Encryption protects information, password policies govern authentication requirements, and file integrity monitoring detects changes to digital files. A badge-controlled door directly addresses the physical boundary of a protected facility and helps prevent unauthorized entry.

Question 20

Which security process removes access promptly when an employee leaves an organization?

1. Account deprovisioning
2. Vulnerability assessment
3. Risk acceptance
4. Configuration baselining

Correct Answer: 1

Explanation:

Account deprovisioning removes or disables a user’s access when employment or authorization ends. Prompt deprovisioning is important because inactive accounts can become targets for attackers and may retain access to sensitive systems if they are not properly managed. An effective offboarding process can include disabling accounts, revoking sessions and credentials, recovering organizational devices, removing group memberships, and reviewing privileged access. Vulnerability assessment identifies technical weaknesses, risk acceptance documents an intentional decision to tolerate a risk, and configuration baselining establishes approved system settings. Deprovisioning directly addresses access removal during employee separation.