ISC2 CC Practice Test 15 — 15 Questions

Question 1

An organization's backup strategy includes daily full backups and hourly incremental backups. During a restoration, they discover that a critical file was corrupted 6 hours ago. Which backup set is required for the restoration?

Accepted Answer

The most recent full backup plus the incremental backups from the last 6 hours.. The correct answer is C because restoring a file that was corrupted 6 hours ago requires the most recent full backup as the base, plus all incremental backups taken in the last 6 hours. Incremental backups only store changes since the last backup (full or incremental), so to reconstruct the file as it existed 6 hours ago, you need the full backup and every incremental backup from that point forward until the corruption time. Without all those increments, the file state cannot be fully reconstructed.

Answer

The most recent incremental backup only.

Answer

The most recent full backup only.

Answer

The most recent full backup plus all incremental backups since.

Question 2

A company's IDS generates an alert for a potential SQL injection attack on a web application. The analyst reviews the log and sees the following: "SELECT * FROM users WHERE username = 'admin' OR 1=1 --'". Which action should the analyst take next?

Accepted Answer

Verify if the WAF blocked the attack. Option C is correct because the analyst's first priority is to determine whether the attack was actually successful or was already mitigated. A Web Application Firewall (WAF) sits in front of the web application and can inspect and block SQL injection payloads before they reach the database. By verifying the WAF logs, the analyst can confirm if the attack was blocked, which dictates the next steps—if blocked, no immediate escalation is needed; if not blocked, further investigation is required.

Answer

Submit a change request to patch the application

Answer

Conduct a forensic analysis of the database

Answer

Block the source IP immediately

Question 3

A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst opens the file on a sandboxed virtual machine and observes that it attempts to modify registry keys and establish persistence. This type of analysis is known as:

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing a suspicious file in a controlled environment, such as a sandboxed virtual machine, to observe its runtime behavior. In this scenario, the analyst runs the file and directly observes registry modifications and persistence mechanisms, which are characteristic of dynamic analysis. This approach captures actual system interactions that static analysis cannot reveal.

Answer

Static analysis

Answer

Reverse engineering

Answer

Threat hunting

Question 4

Refer to the exhibit. An analyst sees many alerts from this IDS rule. What is a likely cause?

Accepted Answer

The rule is poorly written generating false positives. Option D is correct because the IDS rule is likely generating excessive alerts due to poor signature design, such as using overly broad content matches or lacking proper contextual filters. Without the 'flow' keyword to establish session state (e.g., 'to_server, established'), the rule may trigger on any packet containing the SQL pattern, including non-exploit traffic like error messages or benign queries, resulting in false positives.

Answer

A web application is vulnerable to SQL injection

Answer

An attacker is scanning for SQL injection

Answer

The rule is missing the "flow" keyword

Question 5

Refer to the exhibit. Based on the JSON policy, what access does the SecurityAuditor role have?

Accepted Answer

Read-only access to all objects in the critical-data bucket.. The JSON policy grants the SecurityAuditor role the `s3:GetObject` action on the `arn:aws:s3:::critical-data/*` resource, which provides read-only access to all objects in the critical-data bucket. The `Effect` is set to `Allow`, and no other actions like `s3:PutObject` or `s3:DeleteObject` are included, so the role cannot write or delete objects. This matches the correct answer B.

Answer

No access to any S3 resources.

Answer

Write access to the critical-data bucket.

Answer

Full access to the S3 bucket critical-data.

Question 6

During a disaster recovery test, the recovery time objective (RTO) for a critical application is 4 hours, but the actual recovery takes 6 hours. Which of the following best describes the impact?

Accepted Answer

The application is unavailable for 2 hours longer than acceptable.. The recovery time objective (RTO) defines the maximum acceptable downtime for an application. Since the RTO is 4 hours but the actual recovery took 6 hours, the application was unavailable for 2 hours beyond the acceptable threshold, directly impacting business continuity. This is a failure to meet the RTO, not the RPO, which concerns data loss.

Answer

Data loss beyond the recovery point objective (RPO).

Answer

The recovery point objective (RPO) is not met.

Answer

No impact because RTO is only a guideline.

Question 7

A company uses a proxy server for internet access. Employees can browse websites (HTTP/HTTPS), but they cannot connect to external FTP servers using FTP client software (e.g., FileZilla). The proxy is configured to allow HTTP and HTTPS only. The security team wants to allow FTP while maintaining security (e.g., logging and filtering). The FTP traffic is used for occasional file transfers with partners. Which of the following is the BEST solution to meet both requirements?

Accepted Answer

Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.. Option A is correct because deploying a dedicated FTP proxy in the DMZ allows the security team to inspect, log, and filter FTP traffic while keeping the existing HTTP/HTTPS proxy unchanged. Firewall rules can be tightened to permit FTP only to that proxy, which then forwards connections to external FTP servers, maintaining a secure, auditable chokepoint without exposing internal clients directly to FTP.

Answer

Use SSH tunneling to encapsulate FTP traffic over SSH to a jump server.

Answer

Configure the proxy to allow FTP traffic by adding FTP as an allowed protocol.

Answer

Enable FTP passive mode on the proxy.

Question 8

You are a forensic analyst responding to a reported compromise of a Linux web server. The server hosts a public-facing web application and is part of a DMZ. The initial investigation shows that unauthorized outbound connections were made to a known malicious IP address during the previous night. The server is still running and connected to the network, but the web application has been taken offline for maintenance. The incident response team wants to preserve evidence for potential legal action. You have a forensic workstation with tools like dd, netcat, and memory acquisition tools. Which of the following should be your FIRST step in the forensic acquisition process?

Accepted Answer

Capture the contents of volatile memory (RAM) using a memory acquisition tool.. Volatile memory (RAM) contains critical evidence such as running processes, network connections, encryption keys, and in-memory malware that would be lost when the system is powered off. In a forensic response, the order of volatility dictates that RAM must be captured first before any non-volatile data. Option D is correct because it follows the established forensic principle of preserving the most volatile data first.

Answer

Create a bit-for-bit copy of the hard drive using dd and a write blocker.

Answer

Capture network traffic from the server for analysis.

Answer

Run a full antivirus scan to identify malware.

Question 9

A financial firm has a data center with strict access controls. Employees must use smart cards and PINs to enter a mantrapped entrance. Recently, an unauthorized person gained access by following an employee through the mantrapped door (tailgating). The security team reviews logs and finds that the door was opened twice in quick succession, indicating tailgating occurred. The firm wants to implement a solution that prevents tailgating without slowing down authorized access. Which action should they take?

Accepted Answer

Implement a turnstile that allows only one person per smart card authentication. Option C is correct because a turnstile physically enforces one-person-per-authentication by rotating only after a valid smart card read and allowing a single passage, then locking until the next authentication. This directly prevents tailgating without adding delay, as each authorized user passes through at their own pace without needing additional steps like biometric scans or pre-approval.

Answer

Require employees to log access requests in advance

Answer

Install a biometric scanner that requires fingerprint and retina scan

Answer

Increase the number of security guards at the entrance

Question 10

A government agency uses a multi-level security system with mandatory access control (MAC). A user with Secret clearance attempts to write data to a file classified as Confidential. Under the Bell-LaPadula model, which rule applies and what is the outcome?

Accepted Answer

The *-property (no write down) denies the operation. The Bell-LaPadula model enforces mandatory access control (MAC) with two primary rules: the simple security property (no read up) and the *-property (no write down). In this scenario, a user with Secret clearance attempts to write to a Confidential file, which is a write-down operation. The *-property prohibits writing to a lower classification to prevent the leakage of higher-classified information, so the operation is denied. Option D correctly identifies this rule and outcome.

Answer

The simple security property (no read up) denies the operation

Answer

The *-property allows the operation because the user is writing down

Answer

The simple security property allows the operation because the user's clearance is higher

Question 11

Your organization runs a critical e-commerce platform on a private cloud. The database server is located in a data center in a seismic zone. The current DR plan uses a warm site with daily differential backups and a 12-hour RTO. A recent earthquake caused a power outage but no physical damage. The database corruption was discovered after 6 hours. The backups from last night are intact but restoring involves applying transaction logs. The RTO is now at risk. What should be done FIRST?

Accepted Answer

Initiate the warm site recovery by restoring the latest differential backup onto standby servers.. Option C is correct because the immediate priority is to restore the latest differential backup onto the warm site's standby servers. This approach minimizes recovery time by applying only the changes since the last full backup, directly addressing the RTO risk. The warm site is already prepared, and restoring the differential backup is the fastest path to operational readiness without the overhead of full backup restoration or log replay.

Answer

Fail over to the warm site immediately without data restoration.

Answer

Perform a point-in-time recovery using the last full backup and all transaction logs.

Answer

Restore the last full backup and then apply all subsequent differential and log backups.

Question 12

An online retailer has a DR plan that includes active-active data centers. During a major DDoS attack, one data center's external connectivity is saturated. The internal network is operational. The security team has identified the attack traffic pattern and is working with the ISP to filter. To maintain service availability, what action should be taken?

Accepted Answer

Redirect all traffic to a cloud-based scrubbing center.. Option B is correct because a cloud-based scrubbing center (DDoS mitigation service) can filter malicious traffic before it reaches the retailer's network, preserving the active-active data center architecture. Since the internal network is operational, the attack only saturates external connectivity; redirecting traffic to the scrubbing center allows clean traffic to be re-injected into the data centers, maintaining service availability without taking any site offline.

Answer

Shut down the attacked data center and fail all traffic to the other data center.

Answer

Implement rate limiting on the affected network segment.

Answer

Continue monitoring and let the ISP handle the attack.

Question 13

A small company has a single flat network with no segmentation. They recently experienced a malware outbreak that spread quickly across all devices. The IT manager wants to implement network segmentation to contain future outbreaks with minimal cost and complexity. The company currently has a single switch and a router/firewall appliance. The network consists of three departments: Sales, HR, and Engineering. After analyzing the requirements, what is the best course of action?

Accepted Answer

Replace the single switch with multiple managed switches and create VLANs for each department, then connect them to the firewall. Option B is correct because VLANs logically segment the flat network into separate broadcast domains for Sales, HR, and Engineering, containing malware spread at Layer 2. Using multiple managed switches with VLANs and trunking to the firewall allows inter-VLAN traffic to be inspected and controlled by the firewall, providing segmentation with minimal cost and complexity. This approach leverages existing hardware (router/firewall) and avoids the expense of additional appliances.

Answer

Deploy a next-generation firewall between the switch and the router to inspect traffic

Answer

Implement 802.1X authentication on the switch to control device access

Answer

Install host-based firewalls on all endpoints

Question 14

A small business has a single server that hosts critical applications. The server's hard drive fails, and the most recent backup is 3 days old. The backup is stored on an external drive that is kept in the same room as the server. The server is also the domain controller and file server. After replacing the drive and restoring from backup, the IT administrator discovers that some user files are missing because they were created after the backup. The administrator needs to minimize data loss in the future. Which of the following should be implemented?

Accepted Answer

Use a cloud-based backup solution.. A cloud-based backup solution automatically stores backups offsite, ensuring that even if the local site is compromised or the backup drive fails, recent data is recoverable. This minimizes data loss by enabling more frequent backups (e.g., hourly or continuous) without relying on manual intervention or physical media rotation, directly addressing the 3-day gap in the scenario.

Answer

Perform daily backups and store them offsite.

Answer

Implement RAID 1 for disk redundancy.

Answer

Enable versioning on the file server.

Question 15

You are a security analyst at a medium-sized company with 500 employees. The company uses a centralized log management system that collects logs from all servers and network devices. For the past week, you have noticed a pattern: every night at 2:00 AM, a series of failed login attempts occurs on the domain controller from an internal IP address (10.10.50.100). The attempts use the username "Administrator" and are always from the same workstation in the accounting department. The accounting department operates 9 AM to 6 PM, so no one is in the office at 2 AM. You have checked the workstation's physical security; it is in a locked office with access only by authorized accounting staff. The workstation is running Windows 10 with up-to-date antivirus and has no signs of compromise. You also checked the network switch logs and see that the workstation is connected to a specific port. You suspect the workstation might be compromised or being used remotely. What is the most appropriate next step?

Accepted Answer

Perform a forensic analysis of the workstation to identify any malware or remote access tools.. Option B is correct because the pattern of failed logins at 2 AM from a locked workstation with no signs of compromise strongly suggests a remote access tool (RAT) or hidden malware that is not detected by standard antivirus. Forensic analysis of the workstation is the most appropriate next step to identify the specific malware or remote access tool, its persistence mechanism, and the attacker's entry point, which is essential before taking any remediation actions. This aligns with the incident response process of identification and analysis before containment or eradication.

Answer

Reimage the workstation with a clean OS image and reset all passwords.

Answer

Increase the password complexity requirements for the domain.

Answer

Immediately block the IP address at the firewall and disable the administrator account.