ISC2 CC Practice Test 10 — 10 Questions

Question 1

A company's security policy requires that all data at rest be encrypted. Which of the following is the BEST approach to ensure compliance while maintaining performance?

Accepted Answer

Deploy full disk encryption on all endpoints and servers.. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all data at rest, ensuring compliance with a policy requiring all data at rest to be encrypted. FDE operates at the block level, typically using AES-256, with minimal performance overhead because encryption and decryption are handled by the disk controller or CPU with hardware acceleration (e.g., AES-NI), making it the best approach for maintaining performance while meeting the broad requirement.

Answer

Use database encryption to protect sensitive data.

Answer

Apply network encryption using TLS for all data transfers.

Answer

Implement file-level encryption for sensitive files only.

Question 2

Refer to the exhibit. A security analyst is reviewing firewall logs and notices repeated denied TCP packets from 192.0.2.10 to internal hosts. The packets are being denied by the access-group "OUTSIDE_IN". What is the most likely reason for these denials?

Accepted Answer

An external host is performing a port scan against internal systems.. The repeated denied TCP packets from 192.0.2.10 (an external IP) to multiple internal hosts indicate a port scan. The access-group 'OUTSIDE_IN' is applied to the outside interface, and the firewall is denying these packets because they match a deny ACE (access control entry) that blocks unsolicited inbound traffic. This pattern of multiple denied connections from a single external source to different internal destinations is characteristic of a reconnaissance scan, not a DoS attack or data exfiltration.

Answer

The firewall is misconfigured and blocking legitimate traffic.

Answer

An internal host has been compromised and is exfiltrating data.

Answer

An external host is launching a denial-of-service (DoS) attack.

Question 3

During an incident response, a forensics analyst captures a memory dump from a compromised server. The analyst needs to ensure the dump is not altered during analysis. Which practice best maintains integrity?

Accepted Answer

Generate a cryptographic hash of the dump before analysis. Generating a cryptographic hash of the memory dump before analysis creates a fixed-length digest that acts as a unique fingerprint of the data. Any subsequent modification, even a single bit flip, will produce a completely different hash value, allowing the analyst to verify the dump has not been altered. This is the standard method for proving integrity in forensic investigations, as required by evidence handling procedures.

Answer

Encrypt the memory dump file

Answer

Maintain a chain of custody log

Answer

Restrict access to the dump to authorized personnel only

Question 4

Refer to the exhibit. Which security principle is being supported by the logging of these events?

Accepted Answer

Accountability. Correct: D - Accountability. Logging provides a record of events that can be traced to specific sources, enabling accountability. Non-repudiation involves proof of actions by a user, but these logs do not prove user identity. Authentication and availability are not directly supported.

Answer

Availability

Answer

Authentication

Answer

Non-repudiation

Question 5

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

Accepted Answer

Implementing write-once storage for log files. Write-once storage (WORM) physically prevents modification or deletion of log data after it is written, which is the strongest guarantee of log integrity. Because the media enforces immutability at the storage layer, even a compromised application or administrator cannot alter historical records.

Answer

Storing logs on the same server as the application

Answer

Using a separate log server with read-only access

Answer

Encrypting logs with a symmetric key

Question 6

Which of the following is a control that can reduce the risk of a DDoS attack?

Accepted Answer

Load balancing. Load balancing helps mitigate DDoS attacks by distributing incoming traffic across multiple servers, preventing any single server from being overwhelmed by a flood of requests. This increases the capacity and resilience of the infrastructure, making it harder for an attacker to exhaust resources. While not a complete DDoS solution, load balancing is a foundational control that reduces the impact of volumetric and application-layer attacks.

Answer

Access control lists

Answer

Encryption

Answer

Digital signatures

Question 7

During a security assessment, a penetration tester captures network traffic and notices that the source IP address in packets appears to be from a different network. Which technique is the attacker likely using?

Accepted Answer

IP spoofing. IP spoofing involves forging the source IP address field in packet headers so the traffic appears to originate from a different network or host. The scenario explicitly describes source IP addresses appearing to come from a different network, which is the defining symptom of IP spoofing. Attackers use it for reflection/amplification DDoS, evasion, and impersonation.

Answer

DNS spoofing

Answer

ARP spoofing

Answer

MAC spoofing

Question 8

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited by a threat. In risk management frameworks such as ISO 27005 and NIST SP 800-30, a vulnerability is formally defined as a weakness in an asset, system, or control that a threat can exploit to cause harm. Option C captures this exactly: it is the weakness itself, not the probability of exploitation, not a control, and not the threat source. This distinction matters because risk is typically calculated as a function of threat, vulnerability, and impact — the vulnerability is the intrinsic flaw, while likelihood arises from the interaction between threat and vulnerability.

Answer

The likelihood that a threat will exploit a weakness

Answer

A measure that reduces risk

Answer

A potential cause of an unwanted incident

Question 9

An attacker sends a flood of SYN packets to a server, never completing the three-way handshake, exhausting the server's resources and causing it to become unresponsive. What type of attack is this?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending many SYN packets with spoofed source addresses, causing the server to allocate resources for half-open connections that are never completed. This exhausts the server's connection table and backlog, making it unresponsive to legitimate traffic. It is a classic denial-of-service attack.

Answer

ICMP flood

Answer

UDP flood

Answer

ARP spoofing

Question 10

An organization is selecting a recovery site strategy that offers the fastest recovery time, measured in hours, to minimize downtime for critical applications. Which recovery site type best meets this requirement?

Accepted Answer

Hot site. A hot site is a fully equipped alternate facility that is ready to operate immediately, offering the fastest recovery time, often within hours. It mirrors the primary site's hardware, software, and data, allowing critical applications to resume quickly. Thus, D is correct.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Warm site