ISC2 CC Practice Test 14 — 15 Questions

Question 1

Which THREE of the following are common components of a disaster recovery plan?

Accepted Answer

Backup procedures. Backup procedures are a core component of a disaster recovery plan (DRP) because they ensure that critical data can be restored after a disruptive event. This includes defining backup frequency, storage locations (e.g., off-site or cloud), and the specific data to be backed up. Without documented backup procedures, recovery of systems and data would be uncoordinated and unreliable.

Answer

Password policy

Answer

Employee background checks

Question 2

An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties ensures no single individual can complete a high-risk action alone, reducing fraud risk.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 3

A security team deploys a passive device that monitors network traffic and generates alerts when it detects suspicious patterns, but it does not take any action. This device is best described as a:

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) is passive, monitoring and alerting without blocking traffic, unlike an IPS which is inline.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 4

An organization deploys a network security device that inspects application-layer payloads, can block malicious HTTP requests, and uses OWASP rules. Which type of device is this?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is designed to filter and monitor HTTP/HTTPS traffic, often using OWASP rules to protect against web vulnerabilities.

Answer

Intrusion Detection System (IDS)

Answer

Next-Generation Firewall (NGFW)

Answer

Intrusion Prevention System (IPS)

Question 5

An AWS administrator attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

The user cannot delete the bucket critical-data.. The policy explicitly denies the s3:DeleteBucket action on the critical-data bucket, overriding any allow.

Answer

The user can delete the bucket if allowed by another policy.

Answer

The user can still delete objects inside the bucket.

Answer

The user can delete any bucket except critical-data.

Question 6

A mid-sized company has a network with 200 employees. The security team has implemented a policy that requires all employees to use complex passwords and change them every 60 days. However, the company has experienced multiple phishing attacks where employees have willingly provided their credentials to fake websites. The CEO wants to implement a more robust authentication method. The company uses Microsoft Active Directory and has a budget for new security tools. They also have a remote workforce. Which of the following is the BEST course of action to address the phishing risk?

Accepted Answer

Deploy multi-factor authentication (MFA) for all remote access and critical systems. Multi-factor authentication (MFA) significantly reduces the risk of credential theft because even if a password is phished, the attacker cannot authenticate without the second factor. The other options either do not address phishing directly or are less effective.

Answer

Increase password complexity requirements and change frequency to every 30 days

Answer

Conduct annual phishing awareness training

Answer

Implement a password manager for all employees

Question 7

A mid-sized financial services company has recently experienced a security incident where an attacker gained access to the internal network through a compromised VPN account. The account belonged to a remote employee who had been granted full network access. The company's security team is now reviewing their security principles to prevent a recurrence. The company has 500 employees, with 50 remote workers. They use a traditional perimeter-based firewall and VPN for remote access. The incident revealed that the compromised account had access to the entire internal network, including sensitive financial databases. The security team is considering implementing a new access control model. They have identified the following requirements: (1) Remote workers should only access specific applications necessary for their roles, (2) Access should be granted based on identity and device posture, (3) Network segmentation should be enforced regardless of location. Which of the following approaches BEST addresses these requirements?

Accepted Answer

Adopt a Zero Trust Architecture (ZTA) that uses an identity-aware proxy and micro-segmentation.. Zero Trust Architecture (ZTA) aligns with all three requirements: it verifies identity and device posture, grants least privilege access to specific applications, and enforces micro-segmentation regardless of location. VPN with MFA (A) still grants broad network access. Network segmentation (B) alone does not incorporate identity or device posture. Least privilege (D) is a principle, not an architecture; implementing it without ZTA may not provide the granular control needed.

Answer

Implement multi-factor authentication on the existing VPN and enforce stricter password policies.

Answer

Create separate VLANs for each department and restrict inter-VLAN routing with ACLs.

Answer

Apply the principle of least privilege by reducing user permissions on the network and servers.

Question 8

A company performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server failure occurs. Which backups are needed to restore the server to its state at Tuesday's backup?

Accepted Answer

Sunday full backup, Monday incremental, and Tuesday incremental. With incremental backups, you need the last full backup and all subsequent incremental backups up to the point of failure. Here, Sunday full + Monday incremental + Tuesday incremental.

Answer

Only Tuesday incremental backup

Answer

Only the Sunday full backup

Answer

Sunday full backup and Monday incremental backup

Question 9

A company uses a mandatory access control (MAC) system where all files are labeled 'Confidential', 'Secret', or 'Top Secret'. A user with 'Secret' clearance tries to read a 'Top Secret' file. What is the outcome?

Accepted Answer

Access is denied because the user's clearance is lower than the file's classification. In a mandatory access control (MAC) system, access decisions are based on comparing the user's clearance level with the file's classification label. Since the user has 'Secret' clearance and the file is labeled 'Top Secret', the clearance is lower than the file's classification, so access is denied. This follows the fundamental MAC principle of 'no read up' (simple security property) in Bell-LaPadula model.

Answer

Access is allowed because the user has a legitimate need

Answer

Access is denied only if the file also has a category

Answer

Access is allowed because the user has Secret clearance

Question 10

A security operations center receives an alert that a workstation has been infected with ransomware. The infection is isolated to one machine. What is the first step in the containment phase of incident response?

Accepted Answer

Disconnect the workstation from the network. The first step in the containment phase is to disconnect the workstation from the network. This immediately stops the ransomware from spreading laterally to other systems via SMB, RDP, or other network protocols. Containment prioritizes preventing further damage over remediation or analysis.

Answer

Restore the workstation from a recent backup

Answer

Reboot the workstation in safe mode

Answer

Run a full antivirus scan

Question 11

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and correlate logs to generate alerts. A SIEM aggregates and correlates logs from various sources, generates alerts, and stores historical data for analysis and forensics.

Answer

Encrypt sensitive data at rest

Answer

Manage user passwords and access controls

Answer

Block malicious network traffic in real time

Question 12

After a reorganization, a company using RBAC finds that many users have accumulated permissions that no longer align with their job functions. What is the best practice to address this?

Accepted Answer

Conduct a quarterly review and recertification of role memberships and permissions. Conducting a quarterly review and recertification of role memberships and permissions is the industry-standard practice for maintaining the principle of least privilege in an RBAC system. This process ensures that role assignments are periodically validated against current job functions, removing accumulated permissions that no longer align with user responsibilities. It directly addresses permission creep by enforcing a formal, auditable lifecycle for role membership.

Answer

Assign permissions directly to each user based on their manager's request

Answer

Create new roles for each new position and assign users to them

Answer

Delete all existing permissions and re-add them based on current job descriptions

Question 13

Which TWO of the following are best practices for securing a wireless network? (Select exactly two.)

Accepted Answer

Implement MAC address filtering. MAC address filtering restricts network access to devices with pre-approved MAC addresses, adding a layer of access control. While not foolproof (MACs can be spoofed), it is a recognized best practice for reducing the attack surface in small or home networks.

Answer

Use WEP encryption for compatibility

Answer

Disable SSID broadcast

Answer

Disable DHCP and use static IP addressing

Question 14

A company's security policy requires that employees use only the minimum permissions needed to perform their job functions. This practice reduces the potential impact if an account is compromised. Which TWO access control principles are being applied?

Accepted Answer

Need-to-know. Least privilege ensures users have only the permissions necessary for their role. Need-to-know complements it by limiting access to data that is essential for job duties. Both principles reduce the blast radius of account compromise.

Answer

Defense in depth

Answer

Separation of duties

Answer

Privileged access management

Question 15

An organization decides to accept the risk of using a legacy system that cannot be patched due to critical business operations. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate, transfer, or avoid it.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation