ISC2 CC Practice Test 11 — 15 Questions

Question 1

During a security incident, the incident response team needs to preserve evidence. Which of the following actions should be performed first?

Accepted Answer

Capture a memory dump. Capturing a memory dump (volatile data) is the first priority because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. The order of volatility dictates that volatile data must be collected before any non-volatile data, and before any actions that could alter system state.

Answer

Notify law enforcement

Answer

Power off the system

Answer

Run antivirus scan

Question 2

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring incoming alerts, performing initial triage, and deciding whether to escalate to Tier 2. They follow predefined playbooks to filter false positives and validate true positives. This role is explicitly designed for rapid alert assessment, not deep investigation or management.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 3

A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)

Accepted Answer

Virtual Private Network (VPN). A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.

Answer

Full disk encryption

Answer

Antivirus software

Question 4

During a data breach investigation, the incident response team discovers that personally identifiable information (PII) of EU residents was exfiltrated. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

7 days

Answer

48 hours

Answer

24 hours

Question 5

A security analyst notices that a user has been granted access to files beyond their job function. Which principle is violated?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the minimum access rights necessary to perform their job functions. Granting access to files beyond that scope directly violates this principle. This is a foundational access control concept in security frameworks like ISO 27001 and NIST.

Answer

Authentication

Answer

Non-repudiation

Answer

Accountability

Question 6

Which protocol operates at the Transport layer of the OSI model and is connectionless and unreliable?

Accepted Answer

UDP. UDP (User Datagram Protocol) is a Transport layer (Layer 4) protocol that is connectionless and unreliable. It does not establish a connection before sending data, and it does not guarantee delivery, ordering, or error recovery. This makes it suitable for applications that prioritize speed over reliability, such as streaming or DNS.

Answer

TCP

Answer

HTTP

Answer

IP

Question 7

An organization uses hashing to ensure that data has not been altered during transmission. Which security principle is being implemented?

Accepted Answer

Integrity. Hashing produces a fixed-length digest that acts as a fingerprint of the data. If even a single bit changes during transmission, the resulting hash will differ, allowing the receiver to detect any alteration. This directly enforces the security principle of integrity, which ensures data is not modified in an unauthorized or accidental manner.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 8

Which TCP segment is sent to initiate the three-way handshake?

Accepted Answer

SYN. The TCP three-way handshake begins with the client sending a SYN segment to the server to request a connection and synchronize sequence numbers. The server responds with SYN-ACK, and the client completes with ACK. Therefore, the segment that initiates the handshake is SYN.

Answer

ACK

Answer

SYN-ACK

Answer

FIN

Question 9

During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)

Accepted Answer

Legal and public relations. Option B (Legal and public relations) is correct because during a ransomware incident, legal counsel must be engaged immediately to assess regulatory notification obligations (e.g., GDPR, HIPAA, SEC disclosure rules) and preserve attorney-client privilege, while public relations manages external messaging to protect the organization's reputation and prevent misinformation. Option E (Internal management) is correct because executive leadership and management must be notified right away to authorize incident response actions, allocate resources, make critical business decisions, and fulfill their governance and oversight responsibilities. Option A (Affected customers) is not an immediate notification group; customer notification typically occurs after the scope of the breach is determined and legal/regulatory guidance is obtained, often with a defined timeline. Option C (All employees) is too broad for immediate notification, as mass communication can cause panic or leaks; only those with a need to know are informed initially. Option D (Competitors) has no legitimate role in incident response notification and would only expose the organization to further risk.

Answer

Affected customers

Answer

All employees

Answer

Competitors

Question 10

A company's BCP requires that critical systems be restored within 2 hours of disruption. Which metric defines this?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a system or application can be unavailable after a disruption. In this scenario, the requirement to restore critical systems within 2 hours directly specifies the RTO. It is a key metric in business continuity planning that drives the design of failover and recovery strategies.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 11

According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics Canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — takes precedence over all others. This means that when obligations conflict, the safety and welfare of society outweigh duties to employers, clients, or the profession. The remaining canons (act honorably, provide diligent service, advance the profession) are subordinate to this top-level obligation.

Answer

Advance the profession

Answer

Act honourably

Answer

Provide diligent service

Question 12

A company uses encryption to protect data at rest and in transit. This primarily addresses which aspect of the CIA triad?

Accepted Answer

Confidentiality. Encryption protects data confidentiality by ensuring that only authorized parties can read the data. Whether at rest (stored on disk) or in transit (moving across networks), encryption renders data unreadable to unauthorized users, directly addressing the confidentiality aspect of the CIA triad. Integrity, authentication, and availability are separate concerns not primarily addressed by encryption alone.

Answer

Integrity

Answer

Authentication

Answer

Availability

Question 13

Which access control principle restricts access to data based on the user's job role and tasks?

Accepted Answer

Need to know. Need to know restricts access based on the specific data a user requires to perform their job tasks, which is exactly what the question describes. It is narrower than least privilege: least privilege limits the level of access (e.g., read vs. write), while need to know limits which specific data the user can see.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 14

An employee uses their username to claim an identity and then enters a password to prove it. What is the term for the process of proving the claimed identity?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity, typically by validating one or more factors such as something you know (password), something you have (token), or something you are (biometric). When the employee enters a password to prove the username they claimed, that verification step is authentication. Identification is the act of claiming the identity; authentication proves it.

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 15

Which common port is used by DNS and which transport layer protocol does it primarily use?

Accepted Answer

Port 53, both UDP and TCP. DNS uses port 53 for both UDP and TCP: UDP is used for standard queries and responses because it is fast and low-overhead, while TCP is used for zone transfers, DNSSEC responses, and queries with responses larger than 512 bytes (or EDNS0-negotiated sizes). This dual-protocol design is why the correct answer must include both.

Answer

Port 53, UDP only

Answer

Port 161, UDP

Answer

Port 53, TCP only