ISC2 CC Practice Test 13 — 15 Questions

Question 1

An organization configures account lockout after 5 failed login attempts within 15 minutes. This control is designed to mitigate which type of attack?

Accepted Answer

Brute-force attack. Account lockout thresholds (typically 3-10 attempts) help prevent brute-force attacks by temporarily disabling the account after repeated failures.

Answer

Phishing

Answer

Social engineering

Answer

Man-in-the-middle attack

Question 2

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

To control and monitor privileged access to critical systems. PAM controls and monitors the use of privileged accounts (e.g., admin) to reduce risk of misuse or compromise.

Answer

To provide single sign-on for all applications

Answer

To manage visitor access to the building

Answer

To enforce password complexity for all users

Question 3

A system administrator has a regular user account for daily work and a separate account with elevated privileges. Which principle is being applied?

Accepted Answer

Least privilege. Least privilege for admins means using a separate account with only necessary privileges, reducing risk.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 4

A security engineer is designing a physical security plan. Which combination of controls best represents defense in depth for a data center?

Accepted Answer

Perimeter fencing, access badges at building entrance, biometric reader on server room, and cable locks on servers. Defense in depth uses multiple, overlapping controls. Perimeter fencing, access badges, biometric readers, and cable locks each address different layers, providing redundancy.

Answer

Visitor sign-in and escort policy only

Answer

A single high-tech lock on the server room door

Answer

A strong password policy for all employees

Question 5

A company implements a policy where users must swipe their access card and then enter a PIN to enter the data center. This is an example of:

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more factors: something you have (card) and something you know (PIN).

Answer

Biometric authentication

Answer

Single sign-on

Answer

Single-factor authentication

Question 6

An organization enforces a password policy requiring a minimum of 15 characters with no complexity requirements, and does not force periodic changes. This policy aligns with which current best practice?

Accepted Answer

Length over complexity and no periodic changes. NIST SP 800-63 recommends favoring length over complexity and avoiding frequent forced changes unless compromised.

Answer

Passwords should be exactly 8 characters with at least one special character

Answer

Passwords should be changed every 30 days

Answer

Complexity requirements are more important than length

Question 7

A large organization has implemented a Security Operations Center (SOC) with a tiered incident response model. Tier 1 analysts triage alerts and escalate confirmed incidents to Tier 2 for deeper analysis. Recently, the SOC has been overwhelmed by a high volume of low-severity alerts from endpoint detection and response (EDR) tools, causing delays in handling true positive incidents. The SOC manager wants to reduce alert fatigue without missing critical threats. Which of the following strategies would be MOST effective?

Accepted Answer

Implement automated playbooks for low-severity alerts to perform initial investigation and closure if benign.. The most effective strategy because implementing automated playbooks for low-severity alerts allows the SOC to handle high-volume, low-risk events without human intervention. Automation can triage, investigate, and close benign alerts, reducing alert fatigue and freeing Tier 1 analysts to focus on true positives. Option A reverses the tiered model and would overwhelm Tier 2 without addressing root cause. Option B only adds more analysts to deal with symptoms, not the root cause of volume. Option D risks missing critical threats by disabling rules entirely, which could lead to security gaps. Automated playbooks strike the right balance between efficiency and security.

Answer

Require Tier 2 analysts to review all alerts before Tier 1.

Answer

Increase the number of Tier 1 analysts to handle the volume.

Answer

Disable all low-severity alert rules in the EDR.

Question 8

A company configures its firewall to block all inbound traffic except for specific necessary services. This approach aligns with which access control principle?

Accepted Answer

Least privilege. Least privilege in network security means denying all traffic except explicitly allowed.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 9

A session timeout automatically logs out a user after a period of inactivity. This control primarily protects against:

Accepted Answer

Unauthorized access from an unattended workstation. Session timeouts prevent unauthorized access from an unattended active session.

Answer

Password cracking

Answer

Brute force attacks

Answer

Shoulder surfing

Question 10

A security analyst is reviewing physical security controls. Which TWO are considered layered physical security measures for external perimeter protection?

Accepted Answer

Fencing around the property. Fencing and lighting are external perimeter controls.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Chassis locks on servers

Question 11

Which TWO are characteristics of Role-Based Access Control (RBAC)?

Accepted Answer

Users are assigned to roles, and inherit permissions from those roles.. RBAC defines roles that group specific permissions, and users are assigned to these roles. When a user is added to a role, they automatically inherit all permissions associated with that role, simplifying administration and ensuring consistent access rights across the organization.

Answer

Object owners can delegate permissions to others.

Answer

Access decisions are based on security labels.

Answer

It enforces a centralized policy that cannot be overridden by users.

Question 12

A small financial firm has a single server that hosts a critical database and also runs a web application. The server is located in a closet with a simple lock. An intern accidentally left the closet door open, and an unauthorized person gained physical access, connected a laptop to the server, and copied the database. The company wants to prevent such incidents in the future. Which of the following is the most effective course of action?

Accepted Answer

Move the database to a separate server and apply encryption.. Moving the database to a separate server and encrypting it reduces the risk of data theft from physical access. CCTV is detective, 2FA protects remote access, and strong ACLs can be bypassed with physical control of the server.

Answer

Require two-factor authentication for database access.

Answer

Implement strong access controls on the database files.

Answer

Install a CCTV camera in the server closet.

Question 13

Which of the following is an example of a logical access control?

Accepted Answer

A password policy. Logical access controls are software-based mechanisms that regulate access to systems or data.

Answer

A fence around a building

Answer

A security guard

Answer

A biometric reader on a door

Question 14

A user enters a username and password to access a system. Which phase of the access control process does entering the username represent?

Accepted Answer

Identification. Identification is the act of claiming an identity (e.g., username).

Answer

Accounting

Answer

Authentication

Answer

Authorisation

Question 15

Which account type is considered highest risk and should be protected with strict controls, including separate daily use accounts?

Accepted Answer

Admin/root account. Admin/root accounts have elevated privileges and are high-risk targets.

Answer

Standard user account

Answer

Service account

Answer

Guest account