CPA ISC: Security controls and threats
Blueprint II.B · Area II, Security, Confidentiality and Privacy · 35–45% of ISC
Ten ISC questions on security controls and threats, untimed, with a reason for every answer option.
Or take the full ISC mock examA company lets employees read email on personal phones. Which control best protects company data if a phone is lost?
Security controls and threats on CPA ISC
Area II of ISC (35–45%) covers security, confidentiality and privacy. This topic covers threats and attacks, and the preventive, detective and corrective controls that address them.
- Blueprint groups
- II.B
- Share of the section
- Area II, Security, Confidentiality and Privacy: 35–45%
- Our drill
- 10 questions from 19 on this topic, untimed, with a reason for every option; one free attempt, unlimited with a pass
What to know
- The CIA triad: confidentiality, integrity and availability; DDoS attacks target availability.
- Multifactor authentication combines different factor types: something you know, have or are.
- Least privilege, defense in depth and zero trust (verify every request) are core design principles (NIST SP 800-207).
- An IDS detects and alerts; an IPS blocks traffic inline.
- Digital signatures are created with the sender's private key and verified with the public key; hashes verify integrity.
- Parameterized queries prevent SQL injection; offline or immutable backups limit ransomware damage.
Test yourself on security controls and threats
Ten ISC questions on security controls and threats, untimed, with a reason for every answer option.
Or take the full ISC mock examCommon questions
How much of the ISC section is security controls and threats?
It sits in Blueprint Area II (II.B). The AICPA weights whole areas, not single topics; see the area’s range on the ISC page. Our 82-question mock draws each area at the middle of its range.
Are these real ISC questions?
No. The AICPA does not release live exam questions. These are original practice questions written to the published 2027 CPA Exam Blueprints, with a reason for every answer option and the standard or code section behind the key.
More ISC topics
- Information systems, IT general controls and change managementdrill
- Data management, databases and data analyticsdrill
- Frameworks, confidentiality, privacy and incident responsedrill
- Planning and performing SOC engagementsdrill
- SOC reports and opinionsdrill
ISC full mock exam: 4 hours, 5 testletsISC task-based simulations
Blueprint and exam facts checked November 2026: AICPA: Learn what is tested on the CPA Exam (Blueprints effective January 1, 2027) · AICPA: CPA Exam score release and testing windows · NASBA: CPA Exam FAQ · Virginia Board of Accountancy: CPA Exam fees.
Original independent practice questions written to the AICPA CPA Exam Blueprints. Not affiliated with or endorsed by the AICPA or NASBA.