ISC2 CC Practice Test 14 — 15 Questions

Question 1

What is the primary purpose of identification in the context of access control?

Accepted Answer

To claim an identity. In access control, identification is the process by which a user claims an identity (e.g., by providing a username or account name). It is distinct from authentication, which verifies that claim. The primary purpose of identification is to assert who you are, not to prove it.

Answer

To grant permissions to resources

Answer

To verify the identity of the user

Answer

To record user activities

Question 2

Which metric is used to define the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Answer

RTO

Answer

SLA

Answer

MTBF

Question 3

A mid-sized company has a network with 200 employees. The security team has implemented a policy that requires all employees to use complex passwords and change them every 60 days. However, the company has experienced multiple phishing attacks where employees have willingly provided their credentials to fake websites. The CEO wants to implement a more robust authentication method. The company uses Microsoft Active Directory and has a budget for new security tools. They also have a remote workforce. Which of the following is the BEST course of action to address the phishing risk?

Accepted Answer

Deploy multi-factor authentication (MFA) for all remote access and critical systems. MFA directly mitigates credential phishing because even if an employee surrenders their username and password to a fake site, the attacker cannot complete authentication without the second factor. It addresses the root cause (credential compromise via phishing) rather than symptoms, and it works for the remote workforce described. Given Active Directory and budget for new tools, deploying MFA to remote access and critical systems is the highest-impact control.

Answer

Increase password complexity requirements and change frequency to every 30 days

Answer

Conduct annual phishing awareness training

Answer

Implement a password manager for all employees

Question 4

A company's Business Impact Analysis (BIA) determines that its online payment system can tolerate a maximum of 2 hours of downtime. The IT team estimates that restoring the system from backups will take 1 hour, and the team needs another 30 minutes to verify data integrity and resume normal operations. Which metric does the 30-minute verification period represent?

Accepted Answer

Work Recovery Time (WRT). The 30-minute verification period represents Work Recovery Time (WRT), which is the time needed after systems are technically restored to validate data integrity and confirm normal operations can resume. WRT is distinct from RTO because RTO covers only the time to bring systems back online, while WRT accounts for the post-recovery validation phase. Together, RTO + WRT must fit within the Maximum Tolerable Downtime (MTD) of 2 hours, which in this case is satisfied (1 hour RTO + 30 min WRT = 1.5 hours).

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 5

During a security audit, it is discovered that a single employee can approve purchase orders and also receive the goods. Which security principle is being violated?

Accepted Answer

Separation of duties. Separation of duties (SoD) requires that no single individual controls all parts of a critical transaction or process. In this scenario, one employee can both approve purchase orders and receive the goods, meaning they could create a fictitious vendor, approve the payment, and confirm receipt of goods that never arrived — a classic fraud vector. SoD mandates that these two functions be split between different people so that collusion is required to commit fraud.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 6

Which THREE of the following are key objectives of a security risk management program?

Accepted Answer

Assess risks. The three key objectives of a security risk management program are to identify risks (B), assess risks (A), and mitigate risks (E). Identifying risks means discovering and documenting threats, vulnerabilities, and potential adverse events that could affect the organization's assets. Assessing risks involves analyzing the likelihood and impact of those identified risks, often through qualitative or quantitative methods, to determine their severity and priority. Mitigating risks means applying controls, such as administrative, technical, or physical safeguards, to reduce risk to an acceptable level. Options C and D are not key objectives of risk management itself; implementing intrusion detection systems and encrypting all data at rest are specific security controls or countermeasures that may be selected during risk mitigation, not the overarching objectives of the program.

Answer

Implement intrusion detection systems

Answer

Encrypt all data at rest

Question 7

An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) assigns permissions to roles (or groups) rather than to individual users. Users are then made members of these roles, inheriting the permissions associated with the role. This matches the description in the question, where users are assigned to groups and permissions are granted to those groups.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 8

Which is a key benefit of a cold site as a recovery location?

Accepted Answer

Low cost. A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.

Answer

Real-time data synchronization

Answer

Reduced need for testing

Answer

Fast recovery time

Question 9

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication is "something you are," i.e., biometrics based on a physical or behavioral characteristic of the user. Option B, retina scan, is correct because it authenticates by measuring the unique pattern of blood vessels in the eye's retina, a physiological biometric trait. Option C, fingerprint recognition, is correct because it verifies identity from the unique ridge patterns of a finger, another physiological biometric. The other options belong to different factors: A (one-time password token) and D (smart card) are Type 2, "something you have," while E (password) is Type 1, "something you know."

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 10

A company uses a mandatory access control (MAC) system where all files are labeled 'Confidential', 'Secret', or 'Top Secret'. A user with 'Secret' clearance tries to read a 'Top Secret' file. What is the outcome?

Accepted Answer

Access is denied because the user's clearance is lower than the file's classification. In a mandatory access control (MAC) system, access decisions are based on comparing the user's clearance level with the file's classification label. Since the user has 'Secret' clearance and the file is labeled 'Top Secret', the clearance is lower than the file's classification, so access is denied. This follows the fundamental MAC principle of 'no read up' (simple security property) in Bell-LaPadula model.

Answer

Access is allowed because the user has a legitimate need

Answer

Access is denied only if the file also has a category

Answer

Access is allowed because the user has Secret clearance

Question 11

An organization is implementing a new access control system. Which TWO of the following are examples of Type 3 authentication factors?

Accepted Answer

Fingerprint scan. Type 3 authentication factors are based on something you are — biometric characteristics — so option D (fingerprint scan) is correct because it verifies a unique physical trait of the user, and option E (retina scan) is correct because it measures the distinct vascular pattern of the eye's retina. Both are biometric methods that cannot easily be shared or forgotten, which is the defining property of Type 3 factors. Option A (password) is wrong because it is a Type 1 factor (something you know), and option C (PIN) is also a Type 1 factor (something you know). Option B (smart card) is wrong because it is a Type 2 factor (something you have).

Answer

Password

Answer

Smart card

Answer

Question 12

Which incident category involves an attempt to make a system or network resource unavailable to its intended users?

Accepted Answer

Denial of service. A denial-of-service (DoS) incident is defined as any attempt to make a system or network resource unavailable to its intended users, typically by flooding it with traffic or exploiting resource exhaustion. This matches the question's description exactly. Other categories like malware or data breach involve different objectives such as data theft or code execution.

Answer

Malware

Answer

Data breach

Answer

Social engineering

Question 13

Which type of incident involves an attacker attempting to make a system or network resource unavailable to legitimate users?

Accepted Answer

Denial of service. A Denial of Service (DoS) attack explicitly aims to disrupt the availability of a system or network resource, making it inaccessible to legitimate users. This aligns with the definition of a DoS incident, which focuses on overwhelming the target with traffic or exploiting vulnerabilities to exhaust resources. The other options describe different attack categories: social engineering targets human trust, malware is malicious software, and data breach involves unauthorized data access.

Answer

Social engineering

Answer

Malware

Answer

Data breach

Question 14

According to NIST SP 800-63, which password policy is recommended to enhance security?

Accepted Answer

Favor length over complexity and check against breached password lists. NIST SP 800-63B recommends favoring password length over complexity and screening new passwords against lists of commonly used and breached passwords. Length increases entropy far more effectively than forcing special characters, and breach-list checks block credentials attackers already possess. The same guidance also discourages forced periodic rotation absent evidence of compromise.

Answer

Allow passwords as short as 4 characters

Answer

Enforce maximum complexity with special characters and numbers

Answer

Require frequent password changes every 30 days

Question 15

Which type of backup copies all data that has changed since the last full backup, regardless of any subsequent incremental or differential backups?

Accepted Answer

Differential backup. A differential backup copies all data that has changed since the last full backup, regardless of any subsequent incremental or differential backups. This means each differential backup includes all changes since the last full backup, growing in size over time. Therefore, differential backup is the correct answer.

Answer

Full backup

Answer

Incremental backup

Answer

Synthetic full backup