ISC2 CC · ISC2 · Security Governance · Bank updated 2026-11-03
ISC2 CC practice questions: Security Governance
5 free questions from 22 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Security Governance section of our ISC2 CC bank (22 questions on this area, which carries 17.3% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 22 Security Governance questions and the full ISC2 CC bank: $15 one-time.
1/5 · Security Governance
The business impact analysis for a city's traffic-camera archive sets a maximum tolerable downtime (MTD) of four hours. The continuity planner proposes an RTO of three hours and an RPO of 24 hours, and the archive's owner signs off on both. According to NIST SP 800-34 Rev. 1, how should the 24-hour RPO be assessed against the four-hour MTD?
AConsistent: the RPO is not counted as part of the MTD
BConsistent: the three-hour RTO stays inside the MTD
CInconsistent: the RPO has to fit inside the four-hour MTD
DInconsistent: a day-old backup makes the restore run past four hours
Answer: A. NIST SP 800-34 Rev. 1, Section 3.2.1, describes the RPO as the point in time, prior to a disruption or system outage, to which mission/business process data can be recovered, given the most recent backup copy, and states: 'Unlike RTO, RPO is not considered as part of MTD. Rather, it is a factor of how much data loss the mission/business process can tolerate during the recovery process.' The MTD limits how long the archive may be down, while the RPO limits how much footage may be lost. A 24-hour RPO is therefore consistent with a four-hour MTD when the owner accepts losing up to a day of data.
Source: ISC2 CC Exam Outline
2/5 · Security Governance
A security awareness team is rewriting the company's password guidance so that the training slides and the sign-in system both follow NIST SP 800-63B-4. Four rules from the old guidance are under review. Which one may the new guidance keep?
ARequire new passwords to mix upper case, lower case, digits and symbols
BAllow users to store a reminder that is shown on the sign-in page
CRequire users to answer three security questions when setting a password
DReject new passwords that appear on breach or common-password lists
Answer: D. NIST SP 800-63B-4, Section 3.1.1.2 (Password Verifiers), requires verifiers to compare a prospective password against a blocklist that contains known commonly used, expected or compromised passwords, for example passwords obtained from previous breach corpuses and dictionary words. The same section states that verifiers SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types), SHALL NOT permit a hint accessible to an unauthenticated claimant and SHALL NOT prompt subscribers to use knowledge-based authentication or security questions when choosing passwords. Only the blocklist rule survives the rewrite. Source: https://pages.nist.gov/800-63-4/sp800-63b.html
Source: ISC2 CC Exam Outline
3/5 · Security Governance
A bank's system management team reviews its own payment platform every quarter and reports no significant findings. The board still commissions an outside review, noting that the internal team knows the platform best. What is the essential difference the outside review provides?
ADeeper technical inspection of the platform's configuration and code
BReviewers with no professional stake in how the platform was built or run
CAuthority to order corrective changes on the platform without management approval
DWider coverage that includes managerial and procedural aspects of security
Answer: B. Audits can be administered internally or externally. Both can provide good information, but reviews by system management staff carry an inherent conflict of interest, because they may have little incentive to report poor design or careless operation. The independent auditor is organizationally independent and free of personal or external constraints. Objectivity is the essential difference.
Source: NIST SP 800-12 Rev. 1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf, SP80012r1-p52 (7.3.2), p. 52
Source: ISC2 CC Exam Outline
4/5 · Security Governance
A new HR system holds payroll records rated high for confidentiality, low for integrity and moderate for availability. A second information type on the same system is rated moderate, moderate and low for the same three objectives. Which security control baseline should the team start from for the system as a whole?
AModerate baseline, using the rating that appears most often
BLow baseline, using the lowest rating recorded for any objective
CHigh baseline, using the highest rating recorded for any objective
DHigh baseline for payroll data and moderate baseline for the rest, applied side by side
Answer: C. Three security control baselines correspond to low-impact, moderate-impact and high-impact systems and are chosen using the high-water mark. The potential impact for each security objective is the highest value among the categories determined for the information types on the system. With a high rating present, the high baseline is the starting point, which can then be tailored.
Source: NIST SP 800-12 Rev. 1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf, SP80012r1-p53 (7.3.2.3), p. 53
Source: ISC2 CC Exam Outline
5/5 · Security Governance
A legal team proposes that staff approve contracts by pasting a scanned image of their handwritten signature into each electronic document. The security architect objects. What is the main weakness of this approach?
AThe image files are too large for document systems to process quickly
BA scanned image cannot be encrypted, leaving the signed text exposed in transit
CThe image can be copied between documents and its legitimacy cannot be checked
DThe image can be validated only on the workstation of the original signer
Answer: C. Simply taking a digital picture of a written signature does not provide adequate security, because it can easily be copied between documents with no way to check legitimacy. Electronic signatures, by contrast, can be validated uniquely for one message and only for that message, and they add integrity protection.
Source: NIST SP 800-12 Rev. 1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf, SP80012r1-p63 (9.1.3), p. 63
Source: ISC2 CC Exam Outline
Other ISC2 CC areas
The same kind of free sample for every other section of the ISC2 CC bank:
Practise ISC2 CC with instant feedback
6 free questions in study mode · no card · full ISC2 CC bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start ISC2 CC free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by ISC2. ISC2 CC and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official ISC2 materials (as of October 2026); always confirm current details with the vendor before booking.