ISC2 CC Practice Test 15 — 15 Questions

Question 1

A SOC analyst is investigating a potential data exfiltration incident. The logs show that an internal user transferred a large volume of data to a cloud storage service using HTTPS. The analyst finds that the user's workstation has BitLocker Drive Encryption enabled, and the user has administrative privileges. Which of the following best describes the PRIMARY challenge in investigating this incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user has administrative privileges, which could allow them to cover their tracks. The primary challenge is that administrative privileges allow the user to tamper with logs, disable security monitoring, or use tools to cover their tracks, making forensic reconstruction difficult. Even with BitLocker and HTTPS, the SOC can still analyze network logs and endpoint telemetry, but admin rights directly undermine the integrity of evidence on the workstation.

Answer

The volume of data transferred makes it difficult to determine what was exfiltrated

Answer

The data was transferred over HTTPS, which cannot be decrypted by the SOC

Answer

BitLocker encryption prevents access to the hard drive for forensic analysis

Question 2

A company's Business Impact Analysis (BIA) determines that its online payment system can tolerate a maximum of 2 hours of downtime. The IT team estimates that restoring the system from backups will take 1 hour, and the team needs another 30 minutes to verify data integrity and resume normal operations. Which metric does the 30-minute verification period represent?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time needed after systems are restored to return to normal operations, distinct from RTO which is the time to restore functionality.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 3

Which of the following is classified as sensitive PII?

Accepted Answer

Medical records. Sensitive PII includes medical records, financial data, and biometrics.

Answer

Email address

Answer

Telephone number

Answer

Date of birth

Question 4

Which THREE of the following are examples of risk mitigation? (Select THREE)

Accepted Answer

Implementing access controls to limit user permissions. Risk mitigation involves implementing controls to reduce risk. Installing antivirus, implementing access controls, and using encryption all reduce risk. Transferring risk to insurer is risk transfer, and accepting risk is risk acceptance.

Answer

Deciding not to fix a low-risk vulnerability due to cost

Answer

Purchasing cyber insurance

Question 5

An organization has detected a ransomware infection. What is the FIRST step in the incident response process?

Accepted Answer

Isolate affected systems. Containment is the immediate priority to prevent further spread of the ransomware.

Answer

Pay the ransom

Answer

Run antivirus scans

Answer

Report to law enforcement

Question 6

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation from the network is a critical containment step in incident response. It immediately stops the compromised system from communicating with the attacker's command-and-control server, preventing further data exfiltration or lateral movement. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the spread of an incident before deeper analysis.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 7

In risk management, which term describes the probability that a threat will exploit a vulnerability and cause harm to an asset?

Accepted Answer

Risk. Risk is defined as the likelihood of a threat exploiting a vulnerability, resulting in harm to an asset.

Answer

Vulnerability

Answer

Control

Answer

Threat

Question 8

Which TWO are primary objectives of a Business Continuity Plan (BCP)? (Select two.)

Accepted Answer

Ensure employee safety. BCP focuses on ensuring employee safety and minimizing financial loss. Restoring IT systems is part of disaster recovery, not the primary BCP goal.

Answer

Comply with regulations

Answer

Restore IT systems within RTO

Answer

Protect brand reputation

Question 9

An organization is developing a security policy. Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. The CIA triad consists of Confidentiality, Integrity, and Availability. Authentication and Non-repudiation are related but not part of the core triad.

Answer

Authorization

Answer

Authentication

Answer

Non-repudiation

Question 10

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

Accepted Answer

Implementing a SIEM with centralized logging from critical systems. A SIEM with centralized logging aggregates and correlates logs from critical systems, enabling real-time analysis and automated alerting. This drastically reduces MTTD by surfacing indicators of compromise (IoCs) within minutes rather than hours or days, as manual log review would require.

Answer

Requiring multi-factor authentication for all remote access

Answer

Conducting annual security awareness training for all employees

Answer

Standardizing firewall rules across all network segments

Question 11

You are the cybersecurity lead for a mid-sized retail company. One morning, employees report that they cannot access files on the shared drive, and a ransom note appears on several screens demanding $50,000 in Bitcoin. The company has a formal incident response plan that was last updated two years ago and has never been tested. Backups are taken nightly to an on-premises tape library and also replicated to a cloud storage service but have not been verified recently. The CEO is insisting on paying the ransom to avoid business disruption. Which of the following is the MOST appropriate first course of action?

Accepted Answer

Isolate the infected systems from the network, then restore data from the most recent verified backup.. The first priority in any ransomware incident is containment: isolating infected systems prevents lateral movement and further encryption. Restoring from the most recent verified backup ensures data integrity and avoids paying the ransom, which does not guarantee decryption and funds criminal activity. The incident response plan should then be activated and updated based on lessons learned.

Answer

Delete all infected files and rebuild the file server from scratch without involving backups.

Answer

Ignore the incident and continue operations, assuming it will resolve on its own.

Answer

Pay the ransom immediately to minimize downtime and recover data quickly.

Question 12

A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)

Accepted Answer

Virtual Private Network (VPN). A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.

Answer

Full disk encryption

Answer

Antivirus software

Question 13

A security analyst discovers that a user's account has been used to access sensitive data outside of normal business hours from an unfamiliar IP address. The user claims they were not logged in at that time. Which security operations process should be initiated first?

Accepted Answer

Initiate the incident response process. The scenario describes a potential security incident—unauthorized access to sensitive data from an unfamiliar IP address outside business hours—which requires immediate activation of the incident response process. The first step in any security operations workflow is to follow the organization's incident response plan (NIST SP 800-61) to contain, analyze, and remediate the threat. Jumping to forensic analysis, password resets, or account disabling without a coordinated incident response can destroy evidence or fail to address the root cause.

Answer

Perform a forensic analysis of the user's workstation

Answer

Reset the user's password and enforce multi-factor authentication

Answer

Disable the user account immediately

Question 14

An organization discovers a ransomware infection on a critical server. According to the incident response phases, what should be the first action after detection?

Accepted Answer

Contain the affected system. Immediately after detection, the priority is to contain the ransomware to prevent it from spreading laterally to other systems. According to NIST SP 800-61 and standard incident response frameworks, containment is the first step after detection and analysis, as it limits damage and preserves evidence for forensic investigation.

Answer

Notify law enforcement

Answer

Eradicate the malware from the server

Answer

Restore from backup

Question 15

A company wants to ensure that a message received was not altered in transit. Which principle is of primary concern?

Accepted Answer

Integrity. Correct: D. Integrity ensures data has not been modified in transit. Option A (Availability) ensures that systems are accessible when needed, not related to data alteration. Option B (Authentication) verifies the identity of users or systems, not data integrity. Option C (Confidentiality) protects data from unauthorized disclosure, not modification.

Answer

Availability

Answer

Authentication

Answer

Confidentiality