ISC2 CC Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security engineer applies this S3 bucket policy to restrict access. Users outside the 10.0.0.0/16 network report being denied access, which is expected. However, users inside that network also report access denied. What is the likely issue?

Accepted Answer

The policy only allows GetObject; users likely need ListBucket or other actions.. Option C is correct because the S3 bucket policy only grants the s3:GetObject action, but users inside the 10.0.0.0/16 network are likely performing other actions such as s3:ListBucket (e.g., listing objects) or s3:PutObject. Even though the source IP condition allows access from the trusted network, the explicit Allow statement is scoped solely to GetObject. Any request for a different action (like listing the bucket) will be implicitly denied by default, as IAM and S3 policies are deny-by-default unless an explicit Allow exists for that specific action.

Answer

The condition syntax is incorrect and causes all requests to be evaluated incorrectly.

Answer

The Deny statement overrides the Allow statement for all requests.

Answer

The resource ARN includes a wildcard, causing a mismatch with the bucket name.

Question 2

A network engineer is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which port must be opened?

Accepted Answer

443. HTTPS (HTTP Secure) uses TLS/SSL encryption over TCP port 443 by default. To allow inbound HTTPS traffic to a web server, the firewall rule must permit TCP destination port 443. Port 80 is used for unencrypted HTTP, not HTTPS.

Answer

3389

Answer

22

Answer

80

Question 3

An organization has implemented a network-based intrusion prevention system (IPS) in inline mode. After deployment, users report that legitimate web traffic is being blocked. What is the most likely cause?

Accepted Answer

The IPS signature set is too aggressive or includes false positives.. An inline IPS actively inspects and can block traffic based on its signature database. If the signature set is too aggressive or contains false positives, legitimate traffic matching those signatures will be incorrectly blocked. This is the most direct cause of blocking legitimate web traffic after deployment.

Answer

The IPS is not receiving traffic due to a tap failure.

Answer

The IPS is placed behind the firewall instead of in front.

Answer

The IPS is configured in promiscuous mode.

Question 4

A company recently experienced a DoS attack targeting their web server. They want to implement a solution that can differentiate between legitimate traffic and attack traffic based on behavior patterns. Which technology should they deploy?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is the correct choice because it can analyze traffic patterns and behavior in real time, using signature-based and anomaly-based detection to distinguish legitimate traffic from DoS attack traffic. Unlike a WAF, which focuses on application-layer threats like SQL injection, an IPS can inspect network and transport layers to identify volumetric or protocol-based DoS patterns and actively block malicious flows.

Answer

Web Application Firewall (WAF)

Answer

Load balancer

Answer

Stateful firewall

Question 5

A network administrator needs to provide secure remote access to internal resources for employees working from home. The solution must encrypt all traffic and authenticate users before granting access. Which protocol should be used?

Accepted Answer

SSL/TLS VPN. C is correct because SSL/TLS VPNs (e.g., Cisco AnyConnect) provide encrypted tunnels over HTTPS (port 443) and support user authentication via certificates, RADIUS, or LDAP. This allows secure remote access to internal resources without requiring a persistent IPsec tunnel, making it ideal for home workers with dynamic IPs.

Answer

SSH

Answer

IPsec

Answer

SNMPv3

Question 6

Refer to the exhibit. Based on the exhibit, which statement best describes the effect of this policy?

Accepted Answer

Allows DescribeInstances action only from IPs within 10.0.0.0/16. The policy uses an 'Allow' effect with a condition that restricts the source IP to the 10.0.0.0/16 range. Since IAM policies default to implicit deny, only requests matching both the action (DescribeInstances) and the condition (source IP within 10.0.0.0/16) are allowed. This effectively permits DescribeInstances only from the specified CIDR block.

Answer

Allows all actions on EC2 instances from 10.0.0.0/16

Answer

Allows DescribeInstances action from any IP but with a condition

Answer

Denies DescribeInstances action from IPs outside 10.0.0.0/16

Question 7

A security engineer is designing a DMZ for a web server that must be accessible from the internet. The web server needs to query an internal database server. Which network security approach best limits exposure?

Accepted Answer

Place the web server in the DMZ and the database server in the internal network, with a firewall allowing only specific traffic from the web server to the database.. Option D is correct because it implements a true DMZ architecture: the web server resides in the DMZ (a semi-trusted zone) while the database server remains in the internal network, protected by a firewall that permits only specific traffic (e.g., TCP/3306 for MySQL or TCP/1433 for MSSQL) from the web server. This minimizes the attack surface by ensuring that even if the web server is compromised, the database server is not directly reachable from the internet, and the firewall enforces strict stateful inspection and access control.

Answer

Use a single firewall with rules that allow all traffic from the internet to the internal network.

Answer

Place both servers in the same subnet with a firewall allowing all traffic.

Answer

Place the database server in the DMZ with the web server.

Question 8

Which of the following is a primary benefit of implementing network segmentation?

Accepted Answer

Reduced attack surface. Network segmentation divides a network into smaller, isolated segments, which limits an attacker's ability to move laterally after compromising a single host. By restricting traffic between segments using VLANs, ACLs, or firewall rules, the attack surface is reduced because fewer systems are exposed to potential threats. This is a primary security benefit, as it contains breaches and minimizes the impact of malware or unauthorized access.

Answer

Eliminates the need for firewalls

Answer

Increased bandwidth

Answer

Simplified IP address management

Question 9

A security auditor discovers that during a VLAN hopping attack, a threat actor was able to send frames from a workstation on VLAN 10 to a target on VLAN 20. Which configuration flaw is most likely responsible?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. Option A is correct because a VLAN hopping attack exploits the Dynamic Trunking Protocol (DTP) to negotiate a trunk link between the attacker's workstation and the switch. If DTP is enabled on an access port, the attacker can send DTP frames to form a trunk, allowing frames from VLAN 10 to be tagged and forwarded to VLAN 20. Disabling DTP on all access ports with the 'switchport nonegotiate' command prevents this attack.

Answer

The trunk port is set to native VLAN 1

Answer

The switch is using default VLAN 1 for management

Answer

Port security is not configured

Question 10

During a penetration test, an analyst discovers that a company's internal network has a switch configured with port security that allows only one MAC address per port. However, the analyst is able to plug a rogue device into a wall jack and successfully gain network access. What is the most likely weakness in this configuration?

Accepted Answer

The switchport uses sticky MAC learning, and the attacker used a MAC spoofing attack to mimic an authorized device.. Option C is correct because port security with sticky MAC learning records the first MAC address seen on a port and then restricts access to that address only. However, if an attacker spoofs the MAC address of an already-authorized device, the switch sees the spoofed MAC as valid and permits access, bypassing the one-MAC-per-port restriction. This is a common bypass when sticky MAC is used without additional protections like 802.1X or MAC authentication bypass (MAB).

Answer

The administrator configured 'port-security maximum 1' but forgot to enable 'port-security' globally.

Answer

The switchport security violation mode is set to 'shutdown' instead of 'restrict'.

Answer

The switchport is configured as an access port but the rogue device is using a VLAN trunk.

Question 11

Refer to the exhibit. A security analyst runs the above iptables command on a Linux server. The server is configured with a default policy of DROP on the INPUT chain. Users report they can SSH to the server but cannot ping it. What is the most likely reason?

Accepted Answer

The ICMP rule only allows incoming echo requests; outgoing echo replies are not covered by the displayed rules and must be allowed by the OUTPUT chain.. Option D is correct because the displayed iptables rules only govern the INPUT chain, which controls incoming packets. While the rule allows incoming ICMP echo requests (type 8), the server's response—an ICMP echo reply (type 0)—is an outgoing packet that must traverse the OUTPUT chain. If the OUTPUT chain has a default policy of DROP or lacks an explicit ACCEPT rule for ICMP echo replies, the replies are dropped, preventing ping from working even though SSH succeeds (since SSH uses TCP, which is handled differently).

Answer

The default policy DROP on the INPUT chain drops echo replies, but they should be matched by the ESTABLISHED,RELATED rule.

Answer

The ICMP rule is placed after the ESTABLISHED,RELATED rule, so it is never evaluated for new ICMP packets.

Answer

The ACCEPT rule for ICMP only permits echo request (type 8), but ping requires echo reply (type 0) which is not allowed.

Question 12

An AWS bucket policy is shown. What is the security implication?

Accepted Answer

The bucket allows read access to anyone from a specific IP range. The bucket policy grants the `s3:GetObject` action (read access) to all principals (`"Principal": "*"`) but only if the request originates from the specified IP range (`"IpAddress": {"aws:SourceIp": "10.0.0.0/24"}`). This means anyone on the internet can read objects, but only if their source IP falls within that CIDR block. This is a common pattern for allowing read access to a trusted network without requiring AWS credentials.

Answer

The bucket allows anonymous write access

Answer

The policy contains a syntax error

Answer

The bucket is fully public

Question 13

Refer to the exhibit. Based on the exhibit, which traffic will be permitted?

Accepted Answer

HTTP traffic from any source to 192.168.1.100. The exhibit shows an access control list (ACL) that permits TCP traffic from any source to destination host 192.168.1.100 on port 80 (HTTP). The ACL entry is `permit tcp any host 192.168.1.100 eq 80`, which matches only HTTP traffic. Therefore, only HTTP traffic from any source to 192.168.1.100 is permitted.

Answer

All traffic from 192.168.1.100

Answer

All traffic from 10.0.1.0/24

Answer

SSH traffic from any source to 192.168.1.100

Question 14

An organization has multiple network segments for accounting, HR, and engineering. They want to prevent unauthorized traffic between segments while allowing necessary communication. Which security control should be implemented?

Accepted Answer

VLAN segmentation with ACLs. VLAN segmentation with ACLs is the correct choice because VLANs create separate broadcast domains at Layer 2, isolating traffic between network segments (accounting, HR, engineering). ACLs applied to the Layer 3 interface (SVI) or trunk ports then enforce granular rules to permit only necessary inter-VLAN communication, such as allowing HR to access a shared server while blocking all other cross-segment traffic.

Answer

Intrusion Detection System (IDS)

Answer

Proxy server

Answer

Honeypot

Question 15

A company's network uses a perimeter firewall and an internal firewall. The DMZ sits between them. A new application server needs to be accessible from the internet on TCP port 8443 and must be able to make outbound HTTPS connections to an external license server. Which firewall rules should be implemented? (Assume default deny)

Accepted Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443 with stateful inspection. Option B is correct because it allows inbound traffic on TCP 8443 to the server and outbound traffic on TCP 443 from the server to the internet. Stateful inspection automatically tracks the outbound HTTPS connection and permits the return traffic (the license server's response) without needing an explicit inbound rule. This matches the requirement while maintaining a default-deny posture.

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443; allow inbound from internet to server on 443 for license server response

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443

Answer

Allow inbound from internet to server on 8443 and 443; allow outbound from server to internet on any

ISC2 CC Practice Test 13 — 15 Questions

Exhibit

ISC2 CC Practice Test 13 — 15 Questions

Exhibit