10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The RCCE exam has 100 questions and runs 2 hours.
These 10 free RCCE questions are organized by exam domain, so you can see how each part of the Rocheston Certified Cybersecurity Engineer - Level 1 (RCCE) blueprint is tested. Reveal the answer and explanation under each question.
At a quarterly supplier review, an access-control matrix shows mappings to NIST CSF 2.0. The customer needs evidence that privileged access was actually revoked when staff left during the quarter. Which evidence would most directly support that conclusion?
Correct answer: D - Dated leaver records matched to actual privileged-account disablement logs.
Segmentation has reduced an unpatchable service's residual risk to within its owner's delegated authority. The exception is permitted by policy, all mandatory controls are operating, and the owner agrees to retain the remaining risk until a patch is available. What completes the risk decision?
Correct answer: A - Record the owner's acceptance, its scope, and the review or expiry conditions.
During a remediation meeting, the owner of an internet-facing reservation service reviews a verified vulnerability: CVSS v4.0 Base 8.3; EPSS probability 0.12 (12%); EPSS percentile 0.96 (96th percentile). Select the accurate briefing on what these figures establish.
Correct answer: A - High severity; 12% forecast probability of observed exploitation in the wild over the next 30 days; local compromise unproven.
Authorized scan results for the same host are: UDP port 53: no response after retries. TCP port 443: handshake completed. No other evidence suggests compromise. Select the defensible entry for the assessment record.
Correct answer: B - Port 53 is open or filtered; validate with another authorized check.
After retraining, a network detector classifies previously detected malicious samples as benign. The test samples are unchanged. Investigators find that a compromised contributor account was used to relabel malicious training examples as benign before the new model was built. Which diagnosis and response fit this evidence?
Correct answer: A - Poisoning; verify label provenance and restrict training-data changes.
A SOC dashboard summarizes 1,000 classified events. The detector alerted on 72 malicious and 48 benign events; it missed 18 malicious events and correctly ignored 862 benign events. Overall accuracy is 93.4%. The manager asks whether that means almost every alert detected malicious activity. Which reply correctly interprets alert quality?
Correct answer: B - No. Precision is 60.0%; two in five alerts were benign despite the high overall accuracy.
Customers may view only their own invoices. Signed in as one customer, an assessor submits an invoice URL from a link forwarded by another customer. The API returns the other customer’s complete invoice. The portal uses parameterized SQL queries and rejects unauthenticated requests. The defect is best corrected by:
Correct answer: C - Checking the user’s permission for the requested invoice before returning its contents.
Both /search and /transfer accept TLS 1.3 0-RTT requests. Replaying a captured early-data transfer creates a second payment; certificates validate correctly. The application has no replay defense. The service owner wants to keep early data for read-only searches. The necessary change is to:
Correct answer: D - Accept transfers only after the handshake completes, retaining early data for searches.
Yesterday, an unexpected Amazon EC2 security-group change exposed an administration port. The organization runs its own OS images and applications; no managed guest-OS service is contracted. The review must identify who changed the rule and who must patch a vulnerable guest package. Choose the correct evidence-and-ownership pairing.
Correct answer: C - CloudTrail management events identify the policy-changing principal; the customer patches the guest OS.
A compromised engineering workstation is sending unauthorized dosing commands, creating an immediate safety hazard at a plant. The control-room supervisor confirms that the dosing controllers can maintain safe local operation once this workstation is isolated and authorizes that action. Disconnecting the shared control switch would disable safety monitoring. No destructive activity is occurring locally on the workstation, and responders need its volatile evidence. Which immediate action best contains the threat while preserving safe operation and evidence?
Correct answer: D - Disconnect the workstation's network link and leave the workstation powered on.
The full bank has 1,020 more RCCE questions with explanations.
Continue in the free practice test →
View plans