ISC2 CC Practice Test 11 — 15 Questions

Question 1

An organization implements encryption for data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 2

A company decides to accept the risk of using a legacy system because the cost of replacing it exceeds potential losses. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and not taking further action.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation

Question 3

Which of the following best describes a vulnerability in the context of risk management?

Accepted Answer

A weakness that can be exploited. A vulnerability is a weakness that can be exploited by a threat to cause harm.

Answer

A potential cause of an unwanted incident

Answer

The likelihood of a threat exploiting a weakness

Answer

A measure that reduces risk

Question 4

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

One-time passcode from a hardware token. Type 2 (possession) factors include something the user has, such as a smart card, OTP token, or mobile authenticator app.

Answer

Fingerprint scan

Answer

Password

Answer

Question 5

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Restricted data includes trade secrets, classified government info, and biometric data.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 6

An organization is implementing backup strategies. Which THREE are characteristics of differential backups? (Select THREE)

Accepted Answer

Requires only the last full backup and the latest differential backup for a full restore. Differential backups copy all changes since the last full backup, making them medium-sized and faster to restore than incremental, but slower to back up than incremental.

Answer

Backup time is generally faster than incremental backups

Answer

Requires all differential backups since the last full backup for a full restore

Question 7

An organization uses a warm site for disaster recovery. Which of the following is the MOST significant risk of this approach?

Accepted Answer

Data may not be synchronized with the primary site. A warm site has infrastructure and connectivity ready but does not maintain real-time data synchronization with the primary site. The most significant risk is that data may not be synchronized, meaning the Recovery Point Objective (RPO) could be hours or days old, leading to potential data loss during failover. Unlike a hot site with synchronous replication, a warm site typically uses periodic backups or asynchronous replication, creating a gap in data currency.

Answer

The site may be too far away

Answer

The site may not have recent data

Answer

High cost of maintaining duplicate hardware

Question 8

Which THREE are phases of the incident response process according to NIST SP 800-61?

Accepted Answer

Containment, Eradication, and Recovery. NIST SP 800-61 defines the incident response process as four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The 'Containment, Eradication, and Recovery' phase is explicitly grouped together as a single phase in the standard, making A a correct choice.

Answer

Risk Assessment

Answer

Vendor Management

Question 9

A company deploys a web application firewall (WAF), performs regular vulnerability scans, and implements strict access controls. Which security principle is being applied?

Accepted Answer

Defense in depth. Defense in depth is the security principle of layering multiple independent security controls so that if one fails, others still provide protection. The question describes three distinct layers: a WAF (application-layer filtering), vulnerability scanning (proactive detection), and strict access controls (preventive policy). This stacking of different types of controls across the network, host, and application layers is the textbook definition of defense in depth.

Answer

Accountability

Answer

Risk management

Answer

Least privilege

Question 10

During a tabletop exercise, the IT team realizes that the backup tapes are stored in the same building as the servers. Which risk does this highlight?

Accepted Answer

Insufficient off-site storage. Storing backup tapes in the same building as the primary servers violates the fundamental principle of geographic separation for disaster recovery. If a fire, flood, or physical security breach destroys the building, both the primary data and the backup tapes are lost simultaneously, rendering the backups useless. This directly indicates a lack of off-site storage, which is a core requirement for a viable backup strategy.

Answer

Single point of failure

Answer

Lack of redundancy

Answer

Inadequate segregation of duties

Question 11

A security administrator is reviewing network security controls. Which TWO of the following are examples of network segmentation technologies? (Select TWO)

Accepted Answer

Subnetting. Subnetting divides a larger network into smaller, logical subnetworks by manipulating the subnet mask (e.g., using VLSM or CIDR). This creates separate broadcast domains at Layer 3, allowing administrators to isolate traffic and apply distinct security policies between subnets, which is a core function of network segmentation.

Answer

Proxy servers

Answer

Honeypots

Answer

Firewalls

Question 12

Match each security control type to its description.

Accepted Answer

Preventive: Controls that prevent security incidents from occurring. Security controls are categorized by their primary function. Preventive controls stop incidents, detective controls identify them, and corrective controls restore operations. Common confusions involve swapping preventive and detective roles.

Answer

Preventive: Controls that identify security incidents

Answer

Detective: Controls that prevent security incidents

Question 13

A network administrator needs to allow secure remote access for teleworkers. Which VPN protocol provides the best confidentiality and integrity while using a single UDP port?

Accepted Answer

SSL/TLS (OpenVPN). SSL/TLS (OpenVPN) is correct because it provides robust confidentiality and integrity through TLS encryption (e.g., AES-256-GCM) and HMAC authentication, while operating over a single UDP port (typically 1194). This makes it ideal for teleworkers as it can traverse NAT and firewalls easily, unlike protocols that require multiple ports or IPsec's complex port/protocol handling.

Answer

PPTP

Answer

L2TP/IPsec

Answer

IKEv2

Question 14

Match each risk management term to its meaning.

Accepted Answer

Risk: The potential for loss or harm when a threat exploits a vulnerability.. Risk is the potential for loss when a threat exploits a vulnerability. A threat is a potential cause of harm. A vulnerability is a weakness. Controls are measures to reduce risk.

Answer

Risk: A weakness in a system or its design.

Answer

Threat: The potential for loss or harm.

Answer

Vulnerability: A measure that modifies or reduces risk.

Question 15

An organization is designing a privileged access management (PAM) solution. Which THREE of the following are best practices for managing privileged accounts? (Select three.)

Accepted Answer

Applying the principle of least privilege to admin accounts. PAM best practices include using separate admin accounts, monitoring privileged sessions, and applying least privilege. Sharing passwords and storing them in plaintext are security risks.

Answer

Sharing the root password among all administrators for convenience

Answer

Storing privileged passwords in an unencrypted text file