Free ISC2 Certified in Cybersecurity (CC) Sample Questions

Correct answer: B — Administrative control

• A. Incorrect. Technical controls are implemented through hardware or software mechanisms such as firewalls, encryption, and access control systems. Security awareness training is not a technology-based safeguard.
• B. Correct. Security awareness training is an administrative control because it is a policy- and people-based measure designed to influence user behavior and reduce risk. It helps ensure users understand security responsibilities and procedures.
• C. Incorrect. Physical controls protect facilities and assets through tangible measures like locks, guards, and badges. Training does not directly protect the physical environment.
• D. Incorrect. Detective controls are designed to identify and alert on incidents or suspicious activity after they occur, such as intrusion detection systems or audits. Training is a preventive and administrative measure, not primarily detective.

Correct answer: B — Cable locks

• A. Incorrect. Full disk encryption is a technical/logical control that protects data confidentiality if a laptop is stolen, but it does not physically prevent the device from being taken.
• B. Correct. Cable locks are a physical control that secures a laptop to a desk or fixed object, deterring opportunistic theft. This directly addresses physical theft in open office areas.
• C. Incorrect. Security awareness posters are an administrative/awareness control that educates users, but they do not provide physical prevention of theft.
• D. Incorrect. Antivirus software is a technical control that protects against malware, not against physical theft of devices.

Correct answer: B — Physical control

• A. Incorrect. Technical controls are technology-based mechanisms such as firewalls or encryption used to protect systems and data. Fences, guards, and access controls at a storage facility are not technical in nature.
• B. Correct. Physical controls are tangible measures, including fences, guards, locks, and access controls, designed to protect physical assets and facilities. The off-site storage protections described are exemplars of physical controls.
• C. Incorrect. Administrative controls encompass policies, procedures, and guidelines (e.g., security training, audits) that direct how security is managed. The listed protections are physical safeguards, not administrative.
• D. Incorrect. Recovery controls are measures intended to restore systems or data after an incident, such as backups and disaster recovery plans. While the tapes support recovery, the facility protections (fences, guards, access controls) themselves are physical controls.

Correct answer: B — Report the observed behavior to management or an appropriate body.

• A. Incorrect. Directly confronting the coworker may escalate the situation and bypasses proper reporting channels. The ISC2 Code of Ethics emphasizes professionalism and using appropriate procedures to address potentially unauthorized activity.
• B. Correct. Reporting the observed behavior to management or an appropriate body aligns with the ISC2 Code of Ethics, which requires acting in the best interest of the organization and the public. This ensures proper investigation and adherence to ethical standards.
• C. Incorrect. Disregarding unethical behavior violates the ISC2 Code of Ethics, which mandates taking action to protect the organization and the public from harm. Professionals are expected to report or escalate concerns proactively.
• D. Incorrect. Sending an anonymous tip bypasses internal processes and may not provide sufficient context or accountability. The Code of Ethics encourages transparency and reporting through authorized internal channels, especially when a coworker is involved.

Correct answer: B — Immediately inform the client of the finding so they can take action.

• A. Incorrect. While findings should be documented, delaying action by waiting until the final report does not align with the duty to protect the public and the organization. Immediate notification is often required for critical vulnerabilities to mitigate risk promptly.
• B. Correct. The ISC2 Code of Ethics requires professionals to act honorably and protect society and the common good. Immediately informing the client through proper channels allows the organization to take swift action to mitigate the risk, fulfilling the ethical duty of responsible disclosure.
• C. Incorrect. Anonymously alerting customers bypasses the client’s authority and can cause confusion, panic, or legal issues. Ethical security professionals should not independently disclose findings to third parties unless explicitly authorized or legally required.
• D. Incorrect. Delaying disclosure until the end of the test could leave the client exposed to unnecessary risk if the vulnerability is significant. Ethical practice requires timely reporting of serious issues through proper channels rather than waiting to avoid disruption.

Correct answer: C — Report the violation to management or the appropriate authority.

• A. Incorrect. While confronting the colleague may seem helpful, demanding amendments privately is not the proper ethical resolution when falsification is clear. The ISC2 Code of Ethics requires reporting unethical behavior through appropriate channels, not informal confrontation.
• B. Incorrect. Ignoring a known violation to avoid project delays conflicts with the ISC2 Code of Ethics, which mandates that professionals act in the public interest and report unethical or illegal activities. Protecting team comfort or timelines does not justify inaction.
• C. Correct. Reporting the violation to management or the appropriate authority aligns with the ISC2 Code of Ethics, which requires professionals to report unethical, illegal, or suspicious activities. This promotes integrity, public trust, and accountability.
• D. Incorrect. Assisting in hiding falsified data is a direct violation of the ISC2 Code of Ethics, which prohibits actions that could harm the public, the profession, or the organization. It also increases harm to stakeholders and undermines professional integrity.

Correct answer: B — Perform periodic restoration tests of backup data

• A. Incorrect. Increasing backup frequency reduces data loss but does not validate that the backup data is intact or restorable. Without testing, backups may be corrupt or incomplete.
• B. Correct. Periodic restoration tests directly validate that backup data can be successfully restored, proving both integrity and usability. Disaster recovery requires not just backups but assurance that restoration works within required timeframes.
• C. Incorrect. Cloud storage improves resilience and offsite availability but does not verify backup integrity or restorability. Restoration testing is still needed to confirm recoverability.
• D. Incorrect. Encryption protects confidentiality of backup data against unauthorized access but does not confirm that the data is intact or can be restored. It is a security control, not a validation method for disaster recovery.

Correct answer: B — Use configuration management to keep the hot site synchronized

• A. Incorrect. Replacing a hot site with a warm site reduces costs but sacrifices immediate readiness, as warm sites require setup time before becoming operational.
• B. Correct. Configuration management ensures the hot site remains synchronized with the primary site, maintaining consistency and readiness for rapid failover with minimal disruption.
• C. Incorrect. Increasing backup frequency improves data currency but does not address synchronization of configurations, applications, or systems needed for immediate hot site operation.
• D. Incorrect. Switching to a cold site eliminates immediate readiness, as cold sites require significant setup time and are not pre-configured for rapid recovery.

Correct answers: B, D — The warm site capability does not support the required RTO; The cold site was not prepared with the necessary hardware

• A. Incorrect. The Recovery Point Objective (RPO) defines the maximum acceptable data loss, not the time to recover. A low RPO means less acceptable data loss and may increase backup frequency, but it does not directly impact the ability to meet the RTO.
• B. Correct. A warm site is partially equipped and requires some setup before becoming fully operational. If the required RTO is aggressive, the warm site may not have the necessary resources to restore operations within that timeframe, causing a failure to meet the RTO.
• C. Incorrect. While corrupted backup data can prevent successful restoration, this is primarily a data integrity issue related to RPO rather than a site capability issue. It would not typically be the reason for failing to meet the RTO based on site type.
• D. Correct. A cold site has no pre-installed hardware or infrastructure. Setting up the necessary equipment takes significant time, often exceeding tight RTOs. This makes the cold site unsuitable for meeting short recovery time objectives.

Correct answer: A — Recovery Point Objective (RPO)

• A. Correct. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, representing the point in time to which data must be recovered after a disruption.
• B. Incorrect. Recovery Time Objective (RTO) defines the maximum acceptable time to restore a function or service after a disruption, not the amount of data loss.
• C. Incorrect. Service Level Agreement (SLA) is a contractual agreement that defines expected service levels and responsibilities, but it does not specifically address data loss.
• D. Incorrect. Maximum Tolerable Downtime (MTD) defines the total time a business process can be disrupted before causing unacceptable damage, not the amount of data loss.

Correct answer: A — Running a business impact analysis

• A. Correct. A business impact analysis (BIA) is the primary activity for identifying and prioritizing critical business functions and processes. It assesses the potential impact of disruptions on business operations, determining recovery priorities and timeframes. While a BIA may not address all threats, its core purpose is to evaluate the effects of disruptions on critical functions.
• B. Incorrect. A detailed risk assessment identifies threats, vulnerabilities, likelihood, and impact, but its focus is on evaluating risks rather than specifically identifying and prioritizing critical business functions. The BIA is the appropriate tool for that purpose.
• C. Incorrect. Reviewing supply chain continuity is important for resilience, particularly for external dependencies, but it does not directly identify and prioritize internal critical business functions. It is a narrower activity within the broader continuity program.
• D. Incorrect. Evaluating vendor risk management addresses risks from third-party vendors and is relevant to BC, but it is not the primary method for identifying and prioritizing critical business functions. That role belongs to the BIA.

Correct answer: B — Reduce damage and return to normal operations.

• A. Incorrect. While identifying the attacker may be part of the investigative process, the primary goal is incident containment and recovery, not attribution.
• B. Correct. The primary goal of incident response is to contain the incident, minimize damage, and restore normal operations as quickly and safely as possible, thereby reducing business impact.
• C. Incorrect. Improving disaster recovery plan effectiveness can be a secondary benefit from lessons learned, but incident response focuses on immediate containment and remediation, not plan improvement.
• D. Incorrect. Compliance with legal regulations is important during incident handling, but the main objective is to mitigate the incident's impact and restore operations.

Correct answer: C — Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned

• A. Incorrect. The sequence should start with Preparation, not Detection. Preparation is a proactive phase that establishes policies, tools, and training before an incident occurs.
• B. Incorrect. Containment should not occur before Detection. An incident must first be identified before containment can be applied. The correct sequence places Detection before Containment.
• C. Correct. The standard incident response lifecycle is Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. This sequence reflects readiness, identification, containment, removal of threat, restoration, and post-incident review.
• D. Incorrect. Preparation should be the first phase, not Detection. Additionally, Eradication must occur before Recovery to ensure the root cause is removed before restoring normal operations.

Correct answer: C — Notify the legal and compliance teams first.

• A. Incorrect. While notifying affected customers is important, it should not be the first step. Premature notification without internal coordination can lead to inaccurate information and may conflict with legal or regulatory obligations.
• B. Incorrect. A public statement should only be issued after internal teams have assessed the situation and ensured accurate, controlled messaging. The organization should first involve internal legal/compliance stakeholders to assess obligations.
• C. Correct. Legal and compliance teams must be notified first to assess regulatory obligations (e.g., GDPR, CCPA), potential liabilities, preservation of evidence, and mandatory reporting timelines. This ensures the organization responds appropriately and avoids mishandling the breach.
• D. Incorrect. While authorities may need to be notified, this usually follows internal legal/compliance review. Best practice is to coordinate through the legal/compliance function first so notifications are accurate, timely, and compliant with applicable laws.

Correct answer: B — Role-based access control

• A. Incorrect. Mandatory access control (MAC) is a restrictive model where access decisions are based on system-enforced security labels and classifications, not on roles. It is commonly used in high-security environments and is not the best fit for permissions granted based on job function.
• B. Correct. Role-based access control (RBAC) assigns permissions to roles, and users inherit access by being assigned to those roles. This is the standard model used when access is tied to job duties or responsibilities.
• C. Incorrect. Discretionary access control (DAC) allows the resource owner to decide who can access an object, often using ACLs or permissions set by the owner. While flexible, it is not based on organizational roles.
• D. Incorrect. The principle of least privilege is a security principle stating that users should have only the access necessary to perform their tasks. It is a guiding concept for access control design, but it is not itself a specific access control model like RBAC.

Correct answer: A — Discretionary access control

• A. Discretionary Access Control (DAC) is a model where the owner of a resource determines access permissions based on user identity. This allows resource owners to control who can access their resources.
• B. Segregation of duties is a security principle that divides critical tasks among multiple people to reduce fraud and error, not an access control model.
• C. Mandatory Access Control (MAC) uses system-enforced labels and classifications to control access, not owner discretion.
• D. The principle of least privilege is a security guideline that users should have only the minimum access necessary, but it is not an access control model.

Correct answer: B — Segregation of duties

• A. Mandatory access control (MAC) is an access control model where system-enforced labels and classifications determine access based on user clearance and data sensitivity. It is not a principle for dividing responsibilities.
• B. Segregation of duties is a preventive control principle that reduces the risk of fraud and error by splitting critical tasks among different individuals. This ensures that no single person has complete control over a process.
• C. Discretionary access control (DAC) allows resource owners to set permissions at their discretion. It is about access assignment, not about separating responsibilities to prevent misuse.
• D. Role-based access control (RBAC) grants permissions based on job roles. While it can help enforce segregation of duties, RBAC itself is a model for access management, not the principle of splitting duties.

Correct answer: C — A clean agent gas system that suppresses fire without residue and is safe for electronics.

• A. Incorrect. A dry pipe sprinkler system still uses water, which can damage sensitive electronic equipment. It is more suited to environments where pipes may freeze, not where water exposure must be minimized.
• B. Incorrect. A wet pipe sprinkler system with foam concentrate introduces water and foam residue, which can damage electronics. Foam systems are typically used for flammable liquid fires, not data center equipment.
• C. Correct. A clean agent gas system suppresses fire without leaving residue and is safe for electronics. It reduces the risk of damage to servers and other hardware while effectively extinguishing the fire, making it ideal for data centers.
• D. Incorrect. Carbon dioxide systems extinguish fire by displacing oxygen, but they pose a risk of asphyxiation in occupied spaces. They are not the preferred choice for a data center with personnel present.

Correct answer: B — Network access control (NAC) with device profiling to enforce access policies.

• A. Incorrect. A VPN can encrypt traffic in transit, but it does not address whether IoT devices are authorized or enforce access policies. It adds complexity and may not be practical for constrained devices.
• B. Correct. Network access control (NAC) with device profiling identifies IoT devices and enforces access policies based on device identity, type, behavior, or compliance. This directly addresses the challenge of unauthorized or unknown devices on the network.
• C. Incorrect. A DMZ is designed to isolate public-facing services, not internal IoT devices. It does not provide device-specific control or dynamic access enforcement like NAC.
• D. Incorrect. Micro-segmentation can restrict lateral movement but is complex to implement for large-scale IoT and does not directly address device authentication or initial access policy enforcement as effectively as NAC.

Correct answer: B — A private cloud deployment where cloud resources are dedicated exclusively to a single tenant.

• A. Incorrect. A public cloud deployment is hosted by a third-party provider and resources are typically shared among multiple tenants, not dedicated to a single organization.
• B. Correct. A private cloud deployment is designed for exclusive use by one organization or tenant, with resources dedicated to that single entity, offering greater control and security.
• C. Incorrect. A hybrid cloud combines on-premises and public cloud services but does not inherently mean resources are dedicated to a single tenant; it is defined by the mix of environments, not exclusivity.
• D. Incorrect. A community cloud is shared among several organizations with common requirements, so its resources are not dedicated to a single tenant.

Correct answer: A — Signature-based detection

• A. Signature-based detection compares network traffic or system activity against a database of known attack signatures or patterns. It is effective for identifying known threats but cannot detect zero-day attacks.
• B. Anomaly-based detection identifies deviations from normal behavior rather than relying on known attack patterns. It can detect new or unknown threats but may produce false positives.
• C. Protocol state analysis examines the state of network protocols to detect deviations from expected behavior, such as malformed packets or unexpected sequences. It does not rely on a database of known attack patterns.
• D. Heuristic rule detection uses predefined rules or logic to identify suspicious behavior, often based on patterns or thresholds. While it may use some form of pattern matching, it is not primarily based on a database of known attack signatures.

Correct answer: B — An intrusion detection system

• A. Incorrect. A stateful inspection firewall tracks the state of active connections and filters traffic based on connection state and rules, but it is designed to block or allow traffic, not just monitor and alert. It does not primarily function as a detection-only system.
• B. Correct. An intrusion detection system (IDS) is designed to monitor network or host activity for suspicious or malicious behavior and generate alerts. It does not take direct action to block traffic; its primary purpose is detection and notification.
• C. Incorrect. An intrusion prevention system (IPS) also monitors traffic and detects threats, but it can take direct action to block or prevent detected threats, such as dropping packets or resetting connections. This goes beyond the monitoring and alerting function of an IDS.
• D. Incorrect. A web application firewall (WAF) is specifically designed to protect web applications by filtering and monitoring HTTP/HTTPS traffic for application-layer attacks like SQL injection and cross-site scripting. It is specialized for web traffic and not intended for general network attack detection.

Correct answers: A, B — It cannot analyze encrypted network traffic packets; It cannot detect zero-day attacks lacking known signatures

• A. Signature-based IDS relies on known attack patterns and cannot inspect encrypted payloads without decryption, making it a limitation.
• B. Signature-based IDS cannot detect zero-day attacks because these attacks do not have known signatures in its database. This is a classic limitation.
• C. False positives are more commonly associated with anomaly-based IDS, not signature-based IDS. Signature-based IDS generally produces fewer false positives when properly tuned.
• D. Requiring a learning period to establish baselines is a characteristic of anomaly-based IDS, not signature-based IDS.

Correct answer: B — The manipulation of individuals to disclose confidential information.

• A. Incorrect. This describes technical exploitation or hacking using software tools to target system vulnerabilities. Social engineering relies on human interaction and psychological manipulation, not software.
• B. Correct. Social engineering involves manipulating individuals through psychological tactics (e.g., phishing, pretexting) to trick them into revealing confidential information or performing actions that compromise security. It focuses on deceiving people rather than exploiting technical flaws.
• C. Incorrect. Intercepting network traffic is associated with packet sniffing, man-in-the-middle attacks, or other network-based attacks. These are technical attacks on data in transit and do not involve human manipulation as social engineering does.
• D. Incorrect. Physical theft of hardware is a form of physical security breach or theft, not social engineering. Social engineering relies on deception and trickery, not physical access or stealing assets.

Correct answer: B — Enforce a clean desk rule and mandate cross-cut shredding for sensitive papers.

• A. Incorrect. This action misdirects blame and fails to address the root cause: improper disposal of confidential documents. The janitor's discovery highlights a process weakness; disciplining them would not prevent recurrence.
• B. Correct. Enforcing a clean desk/clear desk policy and mandating cross-cut shredding for sensitive papers directly prevents confidential information from being placed in regular trash. This addresses the root cause and reduces risk of data exposure.
• C. Incorrect. While securing waste receptacles might seem helpful, it does not solve the core issue of how sensitive documents are discarded. The better control is to ensure confidential materials are destroyed before disposal, not just moved to a different location.
• D. Incorrect. Discarded does not mean declassified. Customer account numbers remain sensitive and must be protected from unauthorized disclosure. Taking no action leaves the organization vulnerable to data breaches and regulatory non-compliance.

Correct answer: B — Hang up and call the bank's official customer service number to inquire.

• A. Incorrect. One-time codes are sensitive authentication data and should never be shared with unsolicited callers. This is a common vishing (voice phishing) attempt designed to bypass account protections.
• B. Correct. Hanging up and independently contacting the bank using the official customer service number ensures the employee verifies the request through a trusted channel. This prevents falling victim to vishing and confirms whether the request is legitimate.
• C. Incorrect. Simply ignoring the call and deleting voicemail does not confirm whether there is a real security issue with the account. The employee should verify the situation through a trusted channel, such as calling the bank's official number.
• D. Incorrect. Confirming the caller's name and employee ID does not prove legitimacy, as such information can be forged or stolen. One-time codes should never be shared over the phone, regardless of the caller's claims.

Correct answer: B — Investigate the crash and consider rolling back the patch on affected systems.

• A. Incorrect. Removing the patch immediately from every system without investigation could reintroduce vulnerabilities and expose unaffected systems to the original threat. A blanket rollback is not recommended; the team should first assess the scope.
• B. Correct. The team should investigate the crash to confirm whether the patch is the cause. If so, rolling back the patch only on impacted systems minimizes business disruption while preserving security for unaffected systems. This controlled response aligns with best practices.
• C. Incorrect. Crash reports, especially for a critical business application, should never be disregarded without investigation. They may indicate a genuine compatibility issue that requires prompt action. Ignoring them could lead to prolonged downtime or hidden security gaps.
• D. Incorrect. Applying another patch without understanding the root cause is risky and could worsen the problem or introduce new vulnerabilities. Proper troubleshooting should be conducted first to determine the appropriate remediation.

Correct answer: B — Performing regular vulnerability scans and patch prioritization.

• A. Incorrect. While specifying maximum allowable downtime is important for business continuity and availability planning, it is not a core component of a patch management policy. Patch management focuses on identifying, testing, and deploying patches, not on defining downtime limits.
• B. Correct. Performing regular vulnerability scans helps identify systems that require patches and exposes weaknesses, while patch prioritization ensures that the most critical fixes are applied first. This supports timely, risk-based remediation and is a fundamental part of an effective patch management policy.
• C. Incorrect. Defining encryption standards for data at rest and in transit is an important security control, but it belongs to data protection and cryptographic policies, not to patch management. Patch management deals with software updates, not encryption policies.
• D. Incorrect. Setting minimum password length requirements is a password policy control under identity and access management, not a patch management requirement. It improves authentication security but does not help manage operating system or application patches.

Correct answer: B — Create a fast-track for emergency security patch approval.

• A. Incorrect. Bypassing all approvals removes necessary oversight and governance, increasing the risk of deploying faulty or incompatible patches and undermining auditability.
• B. Correct. A fast-track or emergency change path allows critical security patches to be reviewed and approved more quickly while still preserving oversight, balancing speed with control for urgent remediation.
• C. Incorrect. Automatically deploying all patches without human review eliminates accountability and can introduce outages or security issues if a patch is defective or conflicts with existing systems, sacrificing control and validation.
• D. Incorrect. Eliminating the change management process entirely removes all controls, creating major operational and security risks; change management ensures accountability, testing, and controlled implementation.

Correct answer: C — A documented and tested plan to revert changes if necessary.

• A. While peer code reviews are a best practice in software development, they are not universally required in all change management policies, as change management applies to various types of changes beyond code.
• B. User acceptance testing sign-off is important in many contexts, but it is not universally required for all changes, especially minor or non-customer-facing changes.
• C. A documented and tested plan to revert changes is a core element of change management, providing a safety net to reverse changes that cause issues, thereby reducing risk and ensuring business continuity. This is universally required across different types of changes.
• D. Automated deployment pipelines are a modern best practice that can improve consistency, but they are not a universal requirement in change management policies, as many organizations still use manual or hybrid processes.

Correct answer: A — Bring Your Own Device (BYOD) policy

• A. Correct. A Bring Your Own Device (BYOD) policy specifically defines security requirements for personal devices used on the corporate network, including mandatory antivirus, host firewall, and other controls to mitigate risks.
• B. Incorrect. An Acceptable Use Policy (AUP) governs how users may use corporate resources but does not typically mandate specific technical security controls for personal devices.
• C. Incorrect. Change management policy governs the process for approving and implementing changes to systems and configurations; it does not address endpoint security requirements.
• D. Incorrect. Password policy sets rules for password creation and management, not requirements for device security like antivirus or firewall.

Correct answer: B — Submit a formal change request for assessment and approval.

• A. Taking a backup is a prudent measure, but it is not the appropriate first step according to change management policy. The change must first be formally requested and authorized before any modifications, including backups as part of the execution plan, are performed.
• B. Submitting a formal change request is the correct first step. It ensures the change is documented, assessed for risks, approved by the appropriate authority, and prioritized. This process reduces the risk of introducing instability into the production environment.
• C. Replicating the issue in a development environment is a good technical troubleshooting practice, but it should occur after the change request is submitted and approved. The change management workflow requires formal authorization before any development or testing related to production fixes.
• D. Notifying the change advisory board (CAB) may be required for emergency changes, but it is not the first step. The process begins with submitting a formal change request, which triggers any necessary CAB actions. Skipping the request bypasses the control process.

Correct answer: C — Confidential

• A. Incorrect. Public data is intended for open distribution and its disclosure poses no harm to the organization.
• B. Incorrect. Internal data is meant for internal use; its disclosure may cause limited harm, but not typically severe harm.
• C. Correct. Confidential data is sensitive information whose unauthorized disclosure could cause severe harm, such as financial loss or reputational damage.
• D. Incorrect. Unclassified data typically has no sensitivity and does not require protection; disclosure would not cause severe harm.

Correct answer: B — Use symmetric encryption, which relies on a single shared secret key.

• A. Incorrect. Hashing is a one-way cryptographic function used for integrity verification, not encryption. It produces a fixed-size digest that cannot be reversed to recover the original data, so it does not provide confidentiality for data at rest that must later be decrypted.
• B. Correct. Symmetric encryption uses a single shared secret key for both encryption and decryption. It is efficient and well-suited for encrypting large amounts of data at rest, especially when only one user needs access and possesses the decryption key.
• C. Incorrect. Asymmetric encryption uses a public/private key pair and is computationally more expensive than symmetric encryption, making it less practical for encrypting large datasets at rest. It is typically used for key exchange, digital signatures, or scenarios requiring multiple parties.
• D. Incorrect. Digital signatures provide integrity, authenticity, and nonrepudiation, but they do not encrypt data. They are used to verify the source and integrity of a message, not to protect data confidentiality.

Correct answer: B — Encrypt the document using the partner's public key before sending it.

• A. Hashing only provides integrity verification; it does not keep the document contents secret. The original document remains readable if intercepted.
• B. Encrypting with the partner's public key ensures that only the partner's private key can decrypt it, providing confidentiality over an untrusted network. This is a core principle of asymmetric encryption.
• C. Using a shared secret password requires a secure key exchange beforehand, which is not guaranteed over an untrusted network. Additionally, this method does not leverage the partner's public key that is already available.
• D. Signing with the company's private key proves authenticity and integrity, but does not hide the document contents. Anyone can still read the document.