ISC2 CC Practice Test 13 — 15 Questions

Question 1

An organization implements a rule that an employee cannot approve their own expenses. This is an example of which security principle?

Accepted Answer

Separation of duties. Correct: B - Separation of duties. Separation of duties prevents a single individual from having conflicting roles. Option A is wrong because least privilege limits access to only necessary resources. Option C is wrong because defense in depth uses multiple layers. Option D is wrong because accountability tracks actions to individuals.

Answer

Least privilege

Answer

Defense in depth

Answer

Accountability

Question 2

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Amplification attack

Question 3

A security analyst notices that a user's account has been used to access sensitive files outside of normal working hours from an unknown IP address. Which security principle is most directly violated?

Accepted Answer

Confidentiality. The scenario describes unauthorized access to sensitive files from an unknown IP address outside normal hours, which directly violates the principle of confidentiality. Confidentiality ensures that data is accessible only to authorized users and systems, and this breach indicates that sensitive information may have been exposed to an unauthorized party.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 4

A security analyst at a Security Operations Centre (SOC) receives an alert from the SIEM indicating multiple failed login attempts for a user account followed by a successful login from an unusual geographic location. According to SOC tier responsibilities, which tier should perform the initial triage of this alert?

Accepted Answer

Tier 1 analyst. Tier 1 analysts are responsible for initial alert triage — monitoring the SIEM queue, validating alerts, gathering basic context, and escalating confirmed incidents to Tier 2. The scenario describes a standard alert requiring first-level review, which falls squarely within Tier 1 duties. Escalation to higher tiers occurs only after Tier 1 confirms the incident or determines it requires deeper investigation.

Answer

IT support team

Answer

Tier 2 analyst

Answer

Tier 3 analyst

Question 5

Which data classification level typically requires the highest level of protection and is reserved for information that could cause catastrophic harm if disclosed?

Accepted Answer

Restricted. 'Restricted' is the highest data classification level in most frameworks, reserved for information whose unauthorized disclosure could cause catastrophic harm to an organization, such as trade secrets, national security data, or highly sensitive personal information. It typically mandates the strictest controls, including encryption, need-to-know access, and often regulatory compliance requirements.

Answer

Confidential

Answer

Public

Answer

Internal

Question 6

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's VPN concentrator. Which type of attack is most likely occurring?

Accepted Answer

Brute force. Repeated failed login attempts from a single external IP targeting a VPN concentrator are the hallmark of a brute force attack. The attacker systematically tries many username/password combinations to gain unauthorized access, exploiting weak or common credentials rather than exploiting a protocol vulnerability.

Answer

Spoofing

Answer

Man-in-the-Middle (MITM)

Answer

Denial of Service (DoS)

Question 7

A financial institution has a security operations center that monitors network traffic using a SIEM. The SIEM receives logs from all network devices, servers, and endpoints. One analyst notices an anomaly: a user account, 'jsmith', which is normally used during business hours (9 AM to 5 PM), has been logging in from a remote IP address at 2 AM every day for the past week. The logins are successful, and the user is accessing internal file shares. The user jsmith works in the accounting department and has access to sensitive financial reports. The analyst checks the user's workstation logs and finds that the workstation is powered off at the time of the remote logins. The company uses two-factor authentication, but the log entries show that only the password was used. Which of the following is the most likely explanation and the best immediate action?

Accepted Answer

The user's credentials have been stolen and are being used by an attacker; disable the account. The anomaly—successful logins at 2 AM from a remote IP while the user's workstation is powered off and only a password (bypassing 2FA) is used—strongly indicates credential theft and account takeover. The SIEM logs show authentication without the second factor, which means the attacker either obtained the password and bypassed 2FA (e.g., through a phishing attack that captured both factors or a session cookie) or the 2FA was not enforced for this specific remote login. Disabling the account immediately stops the unauthorized access to sensitive financial shares.

Answer

The user is working overtime from home; no action needed

Answer

The two-factor authentication system is malfunctioning; reconfigure the 2FA server

Answer

The user's workstation is infected with a remote access trojan; run antivirus

Question 8

To protect the integrity of log files, which of the following is a best practice?

Accepted Answer

Use write-once storage or a separate log server. Using write-once storage (WORM) or a separate log server protects log integrity by preventing modification or deletion of log files. Write-once storage ensures logs cannot be altered after being written, and a separate log server isolates logs from the source system, reducing the risk of tampering by compromised hosts.

Answer

Store logs on the same server as the application

Answer

Allow administrators to edit logs for accuracy

Answer

Encrypt logs but store them locally

Question 9

A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst opens the file on a sandboxed virtual machine and observes that it attempts to modify registry keys and establish persistence. This type of analysis is known as:

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing a suspicious file in a controlled environment, such as a sandboxed virtual machine, to observe its runtime behavior. In this scenario, the analyst runs the file and directly observes registry modifications and persistence mechanisms, which are characteristic of dynamic analysis. This approach captures actual system interactions that static analysis cannot reveal.

Answer

Static analysis

Answer

Reverse engineering

Answer

Threat hunting

Question 10

Which type of recovery site is pre-configured with hardware and software, but does not have live data, typically requiring days to become operational?

Accepted Answer

Warm site. A warm site is a recovery facility that is pre-configured with hardware, software, and network connectivity but lacks live, up-to-date data, so it typically takes days to become fully operational after data restoration and configuration. This matches the question's description exactly. Warm sites balance cost and recovery speed between cold and hot sites.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Hot site

Question 11

An analyst reviews the exhibit. What security principle is best demonstrated by this policy?

Accepted Answer

Least privilege. The policy grants users only the permissions necessary to perform their job functions, which is the core definition of least privilege. By restricting access to only required resources, the policy minimizes the attack surface and limits potential damage from compromised accounts.

Answer

Separation of duties

Answer

Defense in depth

Answer

Non-repudiation

Question 12

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental or differential backups?

Accepted Answer

Differential backup. A differential backup captures all data changed since the last full backup, so each successive differential grows larger until the next full backup resets the baseline. This differs from an incremental backup, which only captures changes since the last backup of any type. The key characteristic in the question — 'regardless of subsequent incremental or differential backups' — matches the differential model, where the reference point remains the last full backup.

Answer

Full backup

Answer

Synthetic full backup

Answer

Incremental backup

Question 13

Which TWO of the following are essential elements of an incident response plan?

Accepted Answer

Step-by-step procedures for each incident type.. Option C is correct because an incident response plan must include step-by-step procedures for each incident type, giving responders a documented, repeatable playbook (e.g., containment, eradication, recovery steps) so they can act quickly and consistently during an actual event. Option E is correct because defined roles and responsibilities establish who leads the response, who handles communications, who performs forensics, and who has authority to make decisions, which is essential for coordination and accountability under pressure. Options A, B, and D do not belong: a list of compliance standards is a governance/audit reference rather than a core response element, personal phone numbers of executives are too narrow and not a structural component of the plan, and contact information for all employees is an overly broad directory detail rather than an essential element of the incident response plan itself.

Answer

A list of compliance standards.

Answer

Personal phone numbers of executives.

Answer

Contact information for all employees.

Question 14

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 15

During which phase of the incident response process would the team identify the root cause of a security incident?

Accepted Answer

Analysis. The Analysis phase (also called Investigation) is where the incident response team examines all available data—logs, memory dumps, network captures—to determine how the incident occurred, what systems were affected, and the root cause. This phase follows Detection and precedes Eradication. Identifying the root cause is essential to ensure the same vulnerability isn't exploited again after containment and recovery.

Answer

Eradication

Answer

Preparation

Answer

Detection