ISACA • CyberSec-Fund
Cybersecurity Fundamentals Certificate Practice Test
Validates foundational cybersecurity knowledge across four domains: information security fundamentals, threat landscape, securing assets, and security operations and response, covering core security concepts, threat identification, data protection, and incident detection.
Exam Details
Questions
596
Duration
120 minutes
Passing Score
65%
Difficulty
FoundationalLast Updated
Feb 2026
Exam Domain Breakdown
Securing Assets35%
Information Security Fundamentals27%
Security Operations and Response20%
Threat Landscape18%
Exam Overview
The ISACA Cybersecurity Fundamentals Certificate validates foundational knowledge and practical skills across the core principles of cybersecurity. It covers the language, frameworks, and technologies that define the discipline, including information security fundamentals, data protection, threat identification, and security operations. The credential is designed to establish that a candidate understands both the theoretical underpinnings of cybersecurity and the practical role security professionals play in defending enterprise systems and data.
Unlike ISACA's more advanced practitioner certifications, this certificate is explicitly entry-level and carries no expiration date, making it a durable credential for those early in their cybersecurity journey. The exam blends traditional knowledge-based multiple-choice questions with performance-based questions set in a virtual lab environment, reflecting ISACA's emphasis on applied, real-world competency rather than purely memorized concepts.
Who Should Take This Exam
This certificate is designed for students, recent graduates, and early-career IT professionals who want to establish a verified baseline in cybersecurity. It is also well-suited for IT professionals from adjacent disciplines—such as networking, systems administration, or software development—who are transitioning into security-focused roles and need to formalize their foundational knowledge.
Career changers from non-IT backgrounds entering the cybersecurity field will also find this credential valuable as a first step toward more advanced ISACA certifications such as the CSX-P (Cybersecurity Practitioner). Organizations looking to upskill staff or build internal cybersecurity awareness programs frequently use this certificate as a baseline benchmark for their teams.
Prerequisites
There are no formal prerequisites for the Cybersecurity Fundamentals Certificate. ISACA allows candidates to register for and sit the exam at any time, with no required work experience, prior certifications, or formal education. This open-access policy reflects the foundational, entry-level nature of the credential.
While no prerequisites are mandated, candidates with some exposure to basic IT concepts—such as networking fundamentals, operating system basics, or general IT infrastructure—will find the material more approachable. Familiarity with concepts like access control, encryption basics, or network protocols is beneficial but not required to begin studying.
Exam Format
The exam consists of 60 scored questions delivered over 120 minutes, yielding roughly two minutes per question. It is administered online as a remotely proctored, closed-book exam, meaning candidates can take it from any suitable location without visiting a physical test center. The question format combines traditional knowledge-based multiple-choice questions with performance-based questions set in a virtual lab environment, testing practical application alongside conceptual understanding.
A passing score of 65% is required, meaning candidates must answer at least 39 of the 60 questions correctly. Exam eligibility is valid for 12 months from the date of registration. Candidates may reschedule their exam without penalty if they do so at least 48 hours before the scheduled appointment. The certificate itself does not expire once earned.
Skills Measured
- 1.Securing Assets (35%): The largest domain covers protecting critical organizational assets, including data classification, access control principles, identity and access management, cryptography and encryption techniques, network security controls, and securing endpoints, applications, and cloud environments.
- 2.Information Security Fundamentals (27%): Covers the core principles and frameworks that underpin cybersecurity, including confidentiality, integrity, and availability (CIA triad); security governance and policy; risk management concepts; relevant laws and regulations; and the role and responsibilities of cybersecurity professionals within an organization.
- 3.Security Operations and Response (20%): Addresses the operational side of cybersecurity, including security monitoring, log analysis, incident detection and response procedures, digital forensics fundamentals, business continuity and disaster recovery concepts, and the use of security tools such as SIEMs and intrusion detection systems.
- 4.Threat Landscape (18%): Covers identification and classification of current cyber threats, including malware types, social engineering attacks (phishing, pretexting), advanced persistent threats (APTs), insider threats, vulnerability concepts, and the methods adversaries use to exploit organizational weaknesses.
Study Tips
- Use the official ISACA Cybersecurity Fundamentals Study Guide, authored by global industry experts, as your primary resource. It covers all four domains, sets expectations for exam question style, and includes sample questions with recommended answers.
- Invest time in the ISACA Lab Package, which provides 12-month access to a virtual training environment. Because the exam includes performance-based questions in a simulated lab setting, hands-on practice is essential—not just reading comprehension.
- Prioritize the 'Securing Assets' domain (35%) in your study schedule since it represents more than a third of the total exam weight. Focus on access control models, encryption types, and network security controls within this domain.
- Take the free ISACA Cybersecurity Fundamentals Practice Quiz available on the ISACA website before scheduling your exam. This gives you a direct preview of question format and difficulty, and helps you identify knowledge gaps across all four domains.
- Map your study plan to domain weights: allocate roughly 35% of your study time to Securing Assets, 27% to Information Security Fundamentals, 20% to Security Operations and Response, and 18% to Threat Landscape—mirroring the actual exam distribution.
- Review the ISACA Exam Candidate Guide before registering. It covers remote proctoring requirements, scheduling policies, technical setup for the virtual lab environment, and retake policies—reducing surprises on exam day.
- After completing the official course (9.5 CPE credits) and lab package, attempt at least two to three full timed practice sessions of 60 questions in 120 minutes to build pacing and stamina under exam conditions before your scheduled appointment.
Career Benefits
Earning the Cybersecurity Fundamentals Certificate signals to employers that a candidate has verified, baseline-level cybersecurity knowledge validated by ISACA—a globally recognized standards body also responsible for CISA, CISM, and CRISC. For entry-level roles such as Security Analyst, IT Security Technician, SOC Analyst (Tier 1), or Junior Penetration Tester, this credential helps candidates stand out in competitive applicant pools where many lack any formal cybersecurity validation. The digital badge issued through Credly allows holders to display their credential on LinkedIn and other professional platforms for immediate visibility to recruiters.
As a foundational certificate with no expiration date, it also serves as a stepping stone toward more advanced ISACA credentials. Candidates who go on to earn the CSX-P (Cybersecurity Practitioner) certification—ISACA's hands-on, performance-based practitioner credential—can expect significantly higher earning potential, with mid-career cybersecurity professionals commonly earning between $80,000 and $130,000 annually depending on role and region. The Cybersecurity Fundamentals Certificate positions candidates to begin that progression with a recognized, vendor-neutral credential accepted across industries.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 596 questions.
1. An organization implements quantitative risk analysis for critical business systems. A database server valued at 500000 dollars has an exposure factor of 60 percent for a ransomware attack. The threat occurs approximately once every two years. What is the Annualized Loss Expectancy for this risk? (Select one!)
A250000 dollars per year
B150000 dollars per year
C500000 dollars per year
D300000 dollars per year
Explanation
Annualized Loss Expectancy is calculated using the formula: ALE equals SLE times ARO. First calculate Single Loss Expectancy: SLE equals Asset Value times Exposure Factor equals 500000 times 0.60 equals 300000 dollars. Then calculate Annualized Rate of Occurrence: once every two years equals 0.5 per year. Finally: ALE equals 300000 times 0.5 equals 150000 dollars per year. The other values represent incorrect calculations: 250000 uses wrong exposure factor, 300000 is the SLE not ALE, and 500000 is the raw asset value without applying exposure factor or annualization.
2. A technology company implements mandatory access control for classified research projects. Engineers with confidential clearance work on Project Alpha classified as confidential. Senior researchers with secret clearance work on Project Beta classified as secret. Security administrators with top-secret clearance manage security policies. According to the Bell-LaPadula model governing mandatory access control, which access restrictions apply? (Select two!)
Multiple correct answersAEngineers with confidential clearance cannot read Project Beta documents classified as secret because no read up is enforced
BSenior researchers with secret clearance cannot write research findings to confidential Project Alpha files because no write down is enforced
CSecurity administrators with top-secret clearance can read all project documents at confidential, secret, and top-secret levels without restrictions
DEngineers with confidential clearance can write to secret Project Beta files if granted explicit permissions by project managers
EAll users regardless of clearance level can read documents at their own classification level and below
Explanation
Bell-LaPadula mandatory access control enforces two primary rules to protect confidentiality. No read up prevents subjects from reading objects at higher classification levels, so engineers with confidential clearance cannot read secret Project Beta documents. No write down prevents subjects from writing to objects at lower classification levels, so senior researchers with secret clearance cannot write to confidential Project Alpha files, preventing inadvertent information leakage. Security administrators can read at their level and below due to having top-secret clearance. Engineers cannot write to secret files regardless of permissions because mandatory access control is system-enforced based on labels, not discretionary permissions. Users typically can read at their level and below, not just their own level.
3. A security analyst investigates a sophisticated attack where adversaries established initial access through a spear-phishing email, then installed a backdoor that survived system reboots, escalated privileges to domain administrator, moved laterally to multiple servers, and exfiltrated intellectual property over several months. Which threat actor type is MOST likely responsible? (Select one!)
ACybercriminals conducting ransomware attacks
BAdvanced Persistent Threat (APT) group
CHacktivists performing website defacement
DScript kiddies using automated tools
Explanation
Advanced Persistent Threat (APT) groups conduct sophisticated, long-term operations with persistence mechanisms, privilege escalation, lateral movement, and stealth—exactly matching this attack pattern. APTs are typically nation-state sponsored with extensive resources and custom tools. Script kiddies lack sophistication for multi-stage operations. Cybercriminals focus on immediate financial gain through ransomware rather than long-term stealth. Hacktivists typically conduct visible attacks like DDoS or defacement for ideology, not covert long-term data theft.
4. A nation-state threat actor group conducts a long-term espionage campaign targeting critical infrastructure. The operation spans 18 months with custom malware, sophisticated evasion techniques, and strategic intelligence gathering. Which three characteristics define this as an Advanced Persistent Threat? (Select three!)
Multiple correct answersAWell-resourced operations with nation-state or organized crime backing
BAutomated attacks using publicly available exploit tools
CLong-term persistent access measured in months or years
DOpportunistic targeting of any available vulnerable systems
ESpecific strategic targets aligned with attacker objectives
FRapid smash-and-grab data theft operations
Explanation
Advanced Persistent Threats are characterized by well-resourced operations typically backed by nation-states or sophisticated organized crime groups, long-term persistent access spanning months to years, and specific strategic targeting aligned with intelligence or economic objectives. APTs use custom malware and sophisticated techniques rather than automated public tools. They conduct deliberate targeted operations against specific organizations rather than opportunistic attacks on any vulnerable system. APT campaigns prioritize stealth and long-term access over rapid data theft, maintaining presence while avoiding detection to achieve strategic intelligence goals.
5. An organization implements security controls classified by their function in the security lifecycle. The security team deploys firewalls to block unauthorized access, installs SIEM to alert on suspicious events, maintains tested backup systems to restore operations after incidents, and displays warning banners to discourage attackers. Which control type classification applies to the backup system? (Select one!)
ADetective control identifying suspicious activities
BPreventive control blocking threats before occurrence
CDeterrent control discouraging potential attackers
DCorrective control repairing damage after incidents
Explanation
Corrective control repairing damage after incidents is correct because backup systems are used to restore data and operations after security events occur, repairing the damage caused by attacks or failures. Preventive controls like firewalls stop threats before they occur, which describes the firewall example not the backups. Detective controls like SIEM identify and alert on events but do not restore systems. Deterrent controls like warning banners discourage attackers through psychological means. Backup systems operate after an incident has occurred to correct the damage, making them corrective rather than preventive, detective, or deterrent controls.
$7
One-time access to this exam
Full access to all 596 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available