ISC2 CC Practice Test 12 — 15 Questions

Question 1

An organization requires employees to enter a password and then approve a push notification on their mobile device to access the corporate network. What type of authentication is this?

Accepted Answer

Two-factor authentication. Combining a password (Type 1) and a mobile device approval (Type 2) constitutes multi-factor authentication.

Answer

Biometric authentication

Answer

Multi-layer authentication

Answer

Single-factor authentication

Question 2

A company's security policy states that all sensitive data must be encrypted both at rest and in transit. Which threat model does this control primarily address?

Accepted Answer

Unauthorized disclosure. Encryption at rest and in transit primarily protects confidentiality by preventing unauthorized access to data. Option B (Unauthorized disclosure) is correct. Option A (Data tampering) relates to integrity, not confidentiality. Option C (Denial of service) relates to availability, which encryption does not directly address. Option D (Repudiation) concerns non-repudiation, which encryption alone does not ensure.

Answer

Data tampering

Answer

Denial of service

Answer

Repudiation

Question 3

Which type of authentication factor involves something the user knows?

Accepted Answer

Type 1 (knowledge). Type 1 (knowledge) factors include passwords, PINs, and passphrases.

Answer

Type 2 (possession)

Answer

Type 4 (location)

Answer

Type 3 (inherence)

Question 4

An organization uses hashing to ensure that data has not been altered during transmission. Which security principle is being implemented?

Accepted Answer

Integrity. Hashing verifies data integrity by detecting changes to the original data.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 5

An organization requires both a password and a fingerprint scan to access a secure system. This is an example of:

Accepted Answer

Multi-factor authentication. Combining a knowledge factor (password) and an inherence factor (fingerprint) constitutes multi-factor authentication.

Answer

Biometric authentication

Answer

Single-factor authentication

Answer

Two-step authentication

Question 6

A security architect is designing access controls for a new application. The requirement is that only managers can approve expense reports above $10,000. Which control model best fits this requirement?

Accepted Answer

Rule-based access control (RuBAC). Rule-based access control (RuBAC) uses a set of rules or conditions to determine access decisions, such as the expense report amount exceeding $10,000. In this scenario, the access control decision depends on a dynamic attribute (the expense amount) rather than a static role or identity, making RuBAC the best fit. RuBAC is often implemented using access control lists (ACLs) or policy-based engines that evaluate conditions like 'if amount > 10000 then require manager approval'.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 7

Which TWO of the following are essential elements of an incident response plan?

Accepted Answer

Step-by-step procedures for each incident type.. An incident response plan must include step-by-step procedures for each incident type to ensure consistent, repeatable actions during a security event. These procedures guide responders through detection, containment, eradication, and recovery phases, reducing errors and response time. Without predefined steps, teams risk ad-hoc actions that can worsen the incident or miss critical containment measures.

Answer

A list of compliance standards.

Answer

Personal phone numbers of executives.

Answer

Contact information for all employees.

Question 8

Drag and drop the steps to perform a password reset on a Windows user account into the correct order.

Accepted Answer

Open Computer Management, expand Local Users and Groups, select the Users folder, right-click the user account, choose Set Password, enter and confirm the new password. Password reset requires admin rights and is done via Local Users and Groups in Computer Management.

Answer

Right-click the user account, choose Set Password, open Computer Management, expand Local Users and Groups, select the Users folder, enter and confirm the new password

Answer

Open Computer Management, expand Local Users and Groups, right-click the user account, select the Users folder, choose Set Password, enter and confirm the new password

Answer

Open Computer Management, select the Users folder, expand Local Users and Groups, right-click the user account, choose Set Password, enter and confirm the new password

Question 9

A cloud security engineer reviews a cloud storage bucket policy that grants read access to all users, including anonymous users. What is the primary security risk?

Accepted Answer

The bucket is publicly readable, allowing anyone to access its contents [CORRECT]. The bucket policy allows any user to read objects, making the bucket publicly readable. This is the primary security risk. Option A is incorrect because encryption is not addressed in the policy. Option B is incorrect because the policy does not grant delete permissions. Option C is incorrect because the policy does not grant write access. Therefore, the risk is unauthorized read access (Option D).

Answer

The bucket does not have encryption enabled [wrong]

Answer

The bucket policy permits deletion of objects by anyone [wrong]

Answer

The bucket allows unauthorized users to write objects [wrong]

Question 10

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system is critical for operations. Which compensating control is most appropriate to reduce the risk of exploitation?

Accepted Answer

Isolate the system on a separate network segment with strict access controls. Network isolation (segmentation) limits the system's exposure to potential attackers. A WAF can protect web-facing systems, but isolation is broader.

Answer

Increase logging and monitoring without any network changes

Answer

Apply a virtual patch using a web application firewall

Answer

Remove the system from the network entirely

Question 11

According to NIST SP 800-63, which password policy is most effective for user authentication?

Accepted Answer

Require a minimum length of 15 characters and check against breached password lists, without requiring complexity or frequent changes. NIST SP 800-63 recommends favoring longer passwords (15+ characters for high assurance) over complexity, and avoiding frequent forced changes unless compromised.

Answer

Require a mix of uppercase, lowercase, numbers, and symbols, and force password changes every 30 days

Answer

Require a minimum length of 6 characters with no other requirements

Answer

Require a minimum length of 8 characters and check against breached password lists

Question 12

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity requirements. Logical access controls are software-based mechanisms that restrict access to systems and data. Passwords are a common logical control.

Answer

Biometric reader on a door

Answer

Fencing around a building

Answer

Security guards

Question 13

When implementing multi-factor authentication, which combination of factors is considered strongest?

Accepted Answer

Smart card and biometric. Multi-factor authentication (MFA) requires combining two or more different types of factors. The three categories are: something you know (Type 1), something you have (Type 2), and something you are (Type 3). A smart card falls under Type 2 (possession), while a biometric falls under Type 3 (inherence). Combining two different categories is stronger than using two factors from the same category, such as password and PIN (both Type 1) or biometric and fingerprint (both Type 3).

Answer

Password and PIN

Answer

Password and security question

Answer

Biometric and fingerprint

Question 14

Which access control principle ensures that a user is granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. Least privilege limits permissions to reduce the potential damage from accidents or attacks.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 15

An organization implements a policy requiring employees to use a separate administrator account for privileged tasks and a different account for daily activities. Which principle does this support?

Accepted Answer

Least privilege. Least privilege for administrators reduces the risk from compromised daily accounts.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know