ISC2 CC Practice Test 12 — 15 Questions

Question 1

Which incident category involves an attacker tricking an employee into revealing credentials?

Accepted Answer

Social engineering. Social engineering is the incident category that involves manipulating people into divulging confidential information, such as credentials. Attackers use psychological tactics like phishing, pretexting, or baiting to trick employees into revealing passwords or other sensitive data.

Answer

Data breach

Answer

Malware

Answer

Denial of service

Question 2

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Option B (classified government intelligence) is correctly marked restricted/top secret because it is information whose unauthorized disclosure would cause exceptional damage to national security and is legally protected at the highest classification levels. Option D (trade secrets) is correct because trade secrets are proprietary intellectual property whose disclosure would cause severe competitive and financial harm, so best-practice data classification places them in the highest sensitivity tier. Option E (biometric data of employees) is correct because biometric identifiers are sensitive personal data (often special-category data under regimes like GDPR) that cannot be changed if compromised, warranting restricted handling. The unmarked options do not belong: A (company cafeteria menu) and C (marketing brochures) are intended for public or internal distribution and carry negligible confidentiality impact, so they would be classified as public or internal, not restricted.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 3

Which backup strategy requires the least amount of time to perform a daily backup but the most time to perform a full restore?

Accepted Answer

Incremental backup. An incremental backup only captures data changed since the last backup of any type, so each daily run is very fast and small. However, a full restore requires the last full backup plus every incremental since then, applied in sequence—making restore the slowest of all strategies.

Answer

Differential backup

Answer

Full backup

Answer

Synthetic full backup

Question 4

Which TWO of the following are fundamental principles of information security that form the CIA triad?

Accepted Answer

Confidentiality. Confidentiality (A) is a core CIA triad principle because it ensures information is not disclosed to unauthorized individuals, systems, or processes, typically enforced through encryption, access controls, and classification. Integrity (B) is also a core CIA triad principle because it ensures data and systems remain accurate, complete, and protected from unauthorized modification, whether in storage or transit, using mechanisms like hashing, checksums, and digital signatures. Together with Availability, these three form the CIA triad, the foundational model for information security. Privacy (C) is a related concept concerning the appropriate handling of personal data, but it is not one of the three CIA triad principles. Non-repudiation (D) is a security property that prevents a party from denying an action, often achieved with digital signatures, but it is not part of the CIA triad. Accountability (E) supports security through auditing and traceability, but it is likewise not one of the three CIA triad pillars.

Answer

Privacy

Answer

Non-repudiation

Answer

Accountability

Question 5

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to inspect HTTP and HTTPS traffic at Layer 7, apply rule sets such as the OWASP ModSecurity Core Rule Set, and block malicious requests like SQL injection, XSS, and CSRF before they reach the web server. It understands web protocols and can enforce positive/negative security models based on HTTP headers, cookies, and payloads. This matches the described requirement exactly.

Answer

Honeypot

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 6

A company has a reciprocal agreement with another organization for disaster recovery. During a major outage, the company attempts to activate the agreement but finds that the partner's facility is also impacted by the same disaster. This scenario highlights a primary disadvantage of which recovery strategy?

Accepted Answer

Reciprocal agreement. A reciprocal agreement is a DR arrangement where two organizations agree to host each other's workloads during a disaster, typically at no or low cost. The scenario shows the classic failure mode: a regional disaster affects both parties simultaneously, so the partner site is unavailable exactly when it is needed.

Answer

Cold site

Answer

Warm site

Answer

Hot site

Question 7

A configuration management tool detects that a critical server's security settings have changed from the approved baseline. What is the first action the security team should take?

Accepted Answer

Investigate the root cause of the configuration change. The first action should be to investigate the root cause of the configuration change. This is because a configuration drift could be caused by a legitimate change (e.g., an approved patch) or a malicious act. Understanding the cause informs the appropriate response, whether to revert, isolate, or update the baseline. Isolating or reverting without investigation could disrupt business operations or destroy evidence.

Answer

Isolate the server from the network

Answer

Automatically revert the settings to the baseline

Answer

Update the baseline to match the current configuration

Question 8

An organization implements a redundant server infrastructure to ensure that services remain operational even if one server fails. This is an example of protecting which principle?

Accepted Answer

Availability. Redundant server infrastructure ensures that services remain operational even if one server fails, which directly supports the principle of availability. Availability ensures that systems and data are accessible to authorized users when needed.

Answer

Integrity

Answer

Accountability

Answer

Confidentiality

Question 9

A company's security policy requires that all sensitive data be encrypted both at rest and in transit. This is an example of applying which security principle?

Accepted Answer

Defense in depth. Encrypting sensitive data both at rest and in transit applies multiple overlapping controls at different layers of the environment, which is the definition of defense in depth. Rather than relying on a single control, the organization layers cryptographic protections so that compromise of one layer (e.g., a stolen disk) does not automatically expose the data. This is a classic example of layered, redundant security controls.

Answer

Separation of duties

Answer

Need to know

Answer

Least privilege

Question 10

An organization wants to detect and alert on potential network intrusions but does not want to risk blocking legitimate traffic. Which system should they deploy?

Accepted Answer

Network-based Intrusion Detection System (NIDS). A Network-based Intrusion Detection System (NIDS) passively monitors network traffic and generates alerts when suspicious patterns are detected, but it does not take any inline action to block traffic. This makes it the correct choice for an organization that wants to detect and alert on potential intrusions without any risk of blocking legitimate traffic, as the NIDS operates out-of-band and cannot drop packets.

Answer

Unified Threat Management (UTM) appliance

Answer

Firewall with deep packet inspection

Answer

Network-based Intrusion Prevention System (NIPS)

Question 11

A company is deploying a multi-factor authentication (MFA) solution. Which combination represents two different authentication factors?

Accepted Answer

Smart card and PIN. MFA requires factors from different categories: something you know, something you have, and something you are. A smart card is something you have (a physical token), and a PIN is something you know — two distinct factor types, making this a valid MFA combination.

Answer

Password and security question

Answer

OTP token and mobile authenticator app

Answer

Fingerprint and retina scan

Question 12

Which TWO are best practices for managing backup media?

Accepted Answer

Encrypt backup data. Option A (Encrypt backup data) is correct because backups contain sensitive data at rest, and encryption protects confidentiality if media is lost, stolen, or accessed by unauthorized parties, satisfying compliance and security best practices. Option C (Store backups in a separate physical location) is correct because offsite storage ensures survivability against site-wide disasters such as fire, flood, or theft, enabling recovery even if the primary site is destroyed. Option B is wrong because keeping backups only on the same server leaves them vulnerable to the same failure, ransomware, or disaster that affects the production system. Option D is wrong because best practice is a tiered or diversified media strategy (disk, tape, cloud) based on RPO/RTO and cost, not reliance on a single media type. Option E is wrong because backups should be tested regularly — ideally after each backup cycle or at least quarterly — not just annually, since untested backups may be unusable when needed.

Answer

Keep backups on the same server for easy access

Answer

Use only tape media

Answer

Test backups annually

Question 13

A security team discovers that an internal database server is sending large amounts of data to an unknown external IP address. The server is not supposed to communicate externally. Which security control should be implemented to prevent such data exfiltration?

Accepted Answer

Configure a firewall to deny all outbound traffic from the database server except to specific authorized destinations. A firewall with restrictive egress rules blocks unauthorized outbound traffic, preventing data exfiltration. Option A (VPN) would not stop the traffic; it could even encrypt and tunnel it. Option B (IDS) can detect but not block. Option D (DLP) monitors content but may not effectively block at the network level.

Answer

Implement a VPN for all external communications

Answer

Install an intrusion detection system (IDS) on the network segment

Answer

Deploy a data loss prevention (DLP) system on the server

Question 14

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.

Answer

Job rotation

Answer

Need-to-know

Answer

Separation of duties

Question 15

According to NIST SP 800-63, which password policy is most recommended?

Accepted Answer

Enforce a minimum length of 8 characters and check against breached password lists. NIST SP 800-63B recommends a minimum password length of 8 characters (with 15+ encouraged for memorized secrets) and screening new passwords against lists of commonly used and breached passwords. This approach prioritizes length and blocklist checks over forced complexity and rotation.

Answer

Allow short passwords but require numbers and symbols

Answer

Use complex passwords with special characters and minimal length

Answer

Require frequent password changes every 30 days