ISC2 CC Practice Test 16 — 15 Questions

Question 1

You are a security analyst investigating a potential insider threat incident. An employee from the finance department has been behaving suspiciously: printing large volumes of sensitive financial reports, accessing files outside their normal work hours, and attempting to bypass the company's data loss prevention (DLP) controls by renaming files before emailing them. The employee has been with the company for 10 years and has a clean record. The company's policy requires that any investigation be conducted discreetly to avoid alerting the employee. You need to gather evidence to confirm or refute the suspicion. Which of the following actions should you take FIRST?

Accepted Answer

Review the employee's system logs and DLP alerts in detail to establish a pattern.. Option B is correct because the first step in any insider threat investigation is to gather and analyze available evidence discreetly, as required by policy. Reviewing system logs (e.g., Windows Event Logs, file server audit logs) and DLP alerts allows you to establish a behavioral pattern—such as anomalous access times, file rename operations, and email attachments—without alerting the employee. This evidence-based approach ensures you can confirm or refute the suspicion before taking any disruptive or confrontational actions.

Answer

Confront the employee directly to ask for an explanation.

Answer

Disable the employee's network access immediately to prevent data exfiltration.

Answer

Notify the employee's manager about the suspicion.

Question 2

A financial services firm has a data center that houses customer financial records. They have implemented a defense-in-depth strategy including firewalls, IDS/IPS, and encryption. Recently, an internal audit revealed that a junior administrator has been logging into the database server with a shared admin account and has made unauthorized changes to customer records. The company wants to prevent such incidents in the future while maintaining operational efficiency. The current environment uses Linux servers with PostgreSQL databases. There is no centralized authentication system. What is the BEST action to take?

Accepted Answer

Disable all shared accounts and implement individual accounts with role-based access control and audit logging. The core issue is the lack of accountability due to a shared admin account. Disabling shared accounts and implementing individual accounts with role-based access control (RBAC) and audit logging directly addresses this by ensuring each action is tied to a specific user, enabling non-repudiation and precise forensic analysis. This aligns with the principle of least privilege and is the most effective way to prevent unauthorized changes while maintaining operational efficiency through granular permission management.

Answer

Increase the frequency of password changes for the shared admin account

Answer

Use database encryption to prevent unauthorized changes

Answer

Implement a network access control (NAC) solution to restrict database access to specific IP addresses

Question 3

You are the network security lead for a medium-sized financial firm with 500 employees. The network consists of a core switch, distribution switches, and access switches. There are three main VLANs: VLAN 10 (Management - 192.168.10.0/24), VLAN 20 (Finance - 192.168.20.0/24), and VLAN 30 (Guest Wi-Fi - 192.168.30.0/24). The network uses a single firewall with three interfaces: inside (trusted), outside (untrusted), and DMZ. The firewall is configured with default-deny rules. Recently, the helpdesk reported that employees in the Finance VLAN cannot access a web-based accounting application hosted on a server at 10.0.0.5, which is in the DMZ. The server's default gateway is the firewall's DMZ interface (10.0.0.1). The accounting application runs on HTTPS (TCP 443). Employees in the Management VLAN can access the application without issue. You have verified that the Finance VLAN has connectivity to the firewall's inside interface (192.168.20.1). The firewall's inside interface has an IP of 192.168.20.1. There is no ACL on the inside interface. The firewall's DMZ interface has an ACL permitting TCP/443 from any to 10.0.0.5. The firewall's routing table shows a route to 10.0.0.0/24 via DMZ interface. What is the most likely cause of the issue?

Accepted Answer

The firewall lacks a policy permitting traffic from the inside zone to the DMZ zone.. The firewall uses a default-deny policy between zones. Even though the inside interface has no ACL and the DMZ ACL permits HTTPS from any source, the firewall still requires an explicit policy rule allowing traffic from the inside (Finance) zone to the DMZ zone. Without this policy, packets from VLAN 20 to the DMZ server are dropped by the firewall's stateful inspection engine, regardless of interface ACLs or routing.

Answer

The routing table on the firewall does not have a return route to the Finance subnet.

Answer

The DMZ ACL is blocking traffic from the Finance subnet because it only permits from Management subnet.

Answer

An ACL applied inbound on the inside interface is blocking Finance traffic but allowing Management traffic.

Question 4

A medium-sized e-commerce company operates a web application on three virtual servers behind a load balancer. The application handles credit card payments and stores customer data in a database server. The company has a security operations team that monitors logs from firewalls, IDS, and servers. One morning, the IDS generates a critical alert indicating a SQL injection attempt from an external IP to the web application. The alert shows that the injection string was ' OR '1'='1' -- . The web server logs confirm that the request returned a 200 OK status and a large response size. The database logs show a query that returned multiple rows. The security analyst needs to determine the best immediate course of action. The company has a documented incident response plan that includes containment, eradication, and recovery phases. Which action should the analyst take first?

Accepted Answer

Take the web server offline and initiate the containment phase of the incident response plan. The correct first action is to take the web server offline and initiate the containment phase. The IDS alert confirms a successful SQL injection (200 OK, large response, multiple rows returned), indicating a data breach is in progress. Containment must precede any other step to stop further data exfiltration, as per the incident response plan's phases.

Answer

Apply a virtual patch using a web application firewall (WAF) rule to block similar injection attempts

Answer

Notify the web development team to fix the SQL injection vulnerability in the code

Answer

Run a full database backup to preserve evidence

Question 5

A mid-sized e-commerce company has a primary data center in New York and a disaster recovery site in Dallas. The application stack includes a web server, application server, and a PostgreSQL database. The database uses synchronous replication to the DR site. During a routine failover test, the IT team discovers that after failing over to Dallas, the web servers in New York continue to attempt connections to the original database IP, causing application errors. The DNS records have been updated to point to the DR database IP, but the web servers are not refreshing their DNS cache. The company uses a standard TTL of 300 seconds. The IT manager needs a solution that ensures minimal disruption during future failovers. Which action should be taken?

Accepted Answer

Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP. Option D is correct because it decouples the web servers from the database IP address by introducing a load balancer or proxy with a virtual IP (VIP). During failover, the VIP is simply moved to the DR database, and the web servers continue connecting to the same VIP without any DNS dependency or cache refresh issues. This eliminates the problem of stale DNS caches and ensures minimal disruption, as the connection endpoint remains constant.

Answer

Add a static host entry in the web servers' hosts file pointing to the DR database IP

Answer

Increase the DNS TTL to 86400 seconds to ensure all caches are updated quickly

Answer

Configure the web servers to use a different DNS resolver that does not cache

Question 6

You are the lead SOC analyst for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers and cloud services (AWS). The SIEM is Splunk Enterprise, collecting logs from firewalls, IDS/IPS, endpoints (Windows and Linux), and AWS CloudTrail. Recently, the company experienced a ransomware attack that encrypted critical file servers. The initial infection vector was a phishing email that led to the download of a malicious macro-enabled document. The document was executed on a Windows workstation, which then established a C2 connection to an external IP. The C2 traffic was over HTTPS, and the workstation was part of the domain. After the attack, the forensic team found that the workstation had Windows Event Logs cleared, and the local admin account had been used to disable the antivirus. The C2 IP was later blocked, but the ransomware had already spread to file servers via SMB. As part of the lessons learned, you need to recommend improvements to prevent and detect such attacks in the future. Which of the following is the BEST course of action to address the specific weaknesses exploited in this incident?

Accepted Answer

Implement application whitelisting, disable macros by default, enforce strong local administrator passwords, and segment the network to restrict SMB traffic between workstations and servers.. Option B directly addresses the attack chain: disabling macros by default prevents the initial infection vector, application whitelisting blocks unauthorized executables (including the ransomware), strong local admin passwords hinder credential abuse, and network segmentation restricts SMB lateral movement. This combination targets the specific weaknesses exploited (macro execution, antivirus disablement via local admin, and SMB propagation) rather than just detecting or patching after the fact.

Answer

Increase the frequency of vulnerability scans and patch all systems within 24 hours of patch release.

Answer

Deploy additional IDS/IPS sensors and tune the SIEM to detect C2 traffic patterns.

Answer

Require multi-factor authentication (MFA) for all remote access and privileged account use.

Question 7

A medium-sized company uses a network with three VLANs: VLAN 10 (Users, 192.168.10.0/24), VLAN 20 (Servers, 192.168.20.0/24), and VLAN 30 (DMZ, 192.168.30.0/24). A Layer 3 switch with an ACL is used for inter-VLAN routing. The company has a web server in the DMZ that must be accessible from the internet (via a public IP mapped to 192.168.30.10). Users in VLAN 10 need to access the web server on its private IP (192.168.30.10) for internal testing. The ACL is applied inbound on the VLAN 10 SVI. The ACL currently has the following entries: permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255; deny ip any 192.168.20.0 0.0.0.255; permit ip any any. Recently, the security team noticed that users can access the web server on its private IP, but they cannot access the web server via the public IP (which goes through the firewall and then to the DMZ). The firewall logs show that traffic from the users to the public IP is allowed and reaches the DMZ web server, but the return traffic is blocked. The web server's default gateway is the Layer 3 switch (192.168.30.1). Which of the following is the most likely cause of the problem?

Accepted Answer

The ACL on the DMZ SVI (VLAN 30) is blocking the return traffic from the web server to the firewall. The correct answer is B. The web server's default gateway is the Layer 3 switch (192.168.30.1). When users access the web server via the public IP, traffic enters the DMZ through the firewall, but the web server sends return traffic to its default gateway (the Layer 3 switch) instead of back to the firewall. The ACL applied inbound on the VLAN 30 SVI (the DMZ SVI) blocks this return traffic because the source is the web server (192.168.30.10) and the destination is the user's IP (192.168.10.x), which is not explicitly permitted by the ACL (the ACL only permits traffic from VLAN 10 to DMZ, not the reverse).

Answer

The web server's default gateway should be set to the firewall, not the Layer 3 switch

Answer

The ACL on the VLAN 10 SVI is blocking the traffic to the public IP because it only allows private IP ranges

Answer

The firewall is blocking the return traffic due to a stateful inspection rule

Question 8

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Accepted Answer

Disconnect the server from the network and activate the manual process.. The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Answer

Report the incident to the regulatory authority immediately.

Answer

Perform a forensic analysis of the server to determine the scope of compromise.

Answer

Keep the server online under close monitoring to minimize customer disruption.

Question 9

A small e-commerce company hosts its web application on a single server with a public IP address. The server runs a Linux OS with Apache, MySQL, and PHP. The company recently experienced a data breach where an attacker gained access to the customer database. The investigation reveals that the attacker exploited a vulnerability in the PHP application to execute arbitrary commands. The server logs show that the attacker used an unauthenticated HTTP POST request to a legacy script that should have been removed. Additionally, the server had default firewall rules allowing all inbound traffic on ports 80 and 443. The company wants to prevent future breaches without redesigning the entire application. Which course of action is the most effective?

Accepted Answer

Implement a web application firewall (WAF) with virtual patching for the vulnerability.. Option D is the most effective because it provides immediate protection against the exploited vulnerability without requiring application redesign. A WAF with virtual patching can inspect HTTP POST requests to the legacy script and block malicious payloads, even if the underlying code remains vulnerable. This approach addresses the root cause (the unauthenticated exploit) while allowing the company to maintain operations and plan a permanent fix.

Answer

Move the database to a separate internal server and require VPN access for administration.

Answer

Upgrade the PHP version to the latest release and enable SELinux.

Answer

Remove the legacy script and update the firewall to block all traffic except necessary IPs.

Question 10

A financial institution has a security operations center that monitors network traffic using a SIEM. The SIEM receives logs from all network devices, servers, and endpoints. One analyst notices an anomaly: a user account, 'jsmith', which is normally used during business hours (9 AM to 5 PM), has been logging in from a remote IP address at 2 AM every day for the past week. The logins are successful, and the user is accessing internal file shares. The user jsmith works in the accounting department and has access to sensitive financial reports. The analyst checks the user's workstation logs and finds that the workstation is powered off at the time of the remote logins. The company uses two-factor authentication, but the log entries show that only the password was used. Which of the following is the most likely explanation and the best immediate action?

Accepted Answer

The user's credentials have been stolen and are being used by an attacker; disable the account. The anomaly—successful logins at 2 AM from a remote IP while the user's workstation is powered off and only a password (bypassing 2FA) is used—strongly indicates credential theft and account takeover. The SIEM logs show authentication without the second factor, which means the attacker either obtained the password and bypassed 2FA (e.g., through a phishing attack that captured both factors or a session cookie) or the 2FA was not enforced for this specific remote login. Disabling the account immediately stops the unauthorized access to sensitive financial shares.

Answer

The user is working overtime from home; no action needed

Answer

The two-factor authentication system is malfunctioning; reconfigure the 2FA server

Answer

The user's workstation is infected with a remote access trojan; run antivirus

Question 11

Which TWO of the following are fundamental security principles? (Select TWO.)

Accepted Answer

Defense in depth. Defense in depth is a fundamental security principle that implements multiple layers of security controls (e.g., firewalls, IDS/IPS, encryption, access controls) so that if one layer fails, others still provide protection. This layered approach ensures no single point of failure can compromise the entire system, aligning with the CC exam's emphasis on holistic security strategies.

Answer

Fail-open

Answer

Need to share

Answer

Complexity

Question 12

Which THREE of the following are essential components of an incident response plan? (Select THREE.)

Accepted Answer

Preparation. Preparation is the foundational phase of the NIST SP 800-61 incident response lifecycle, ensuring policies, tools, and trained personnel are in place before an incident occurs. Without preparation, subsequent phases like detection and containment cannot be executed effectively. The CC exam emphasizes that preparation includes establishing communication plans, acquiring forensic tools, and conducting tabletop exercises.

Answer

Business continuity plan activation

Answer

Vulnerability scanning schedule

Question 13

A security operations center receives an alert that a workstation has been infected with ransomware. The infection is isolated to one machine. What is the first step in the containment phase of incident response?

Accepted Answer

Disconnect the workstation from the network. The first step in the containment phase is to disconnect the workstation from the network. This immediately stops the ransomware from spreading laterally to other systems via SMB, RDP, or other network protocols. Containment prioritizes preventing further damage over remediation or analysis.

Answer

Restore the workstation from a recent backup

Answer

Reboot the workstation in safe mode

Answer

Run a full antivirus scan

Question 14

You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?

Accepted Answer

Integrate HR system with identity management to automatically disable accounts upon termination, and implement network segmentation with a firewall that restricts database access to only authorized application servers.. Option B addresses both the user provisioning issue (automated account disablement) and the network access issue (segmentation and least privilege). Option A only addresses one aspect. Option C focuses on monitoring but not prevention. Option D adds unnecessary complexity and does not directly fix the root causes.

Answer

Deploy a database activity monitoring (DAM) solution that alerts on unusual queries, and require strong passwords for all database accounts.

Answer

Implement a firewall rule to block all traffic from the marketing network to the database server, and require all database access to go through a bastion host.

Answer

Implement two-factor authentication for all database access, and conduct quarterly access reviews.

Question 15

A company's security policy requires that all data at rest be encrypted. Which of the following is the BEST approach to ensure compliance while maintaining performance?

Accepted Answer

Deploy full disk encryption on all endpoints and servers.. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all data at rest, ensuring compliance with a policy requiring all data at rest to be encrypted. FDE operates at the block level, typically using AES-256, with minimal performance overhead because encryption and decryption are handled by the disk controller or CPU with hardware acceleration (e.g., AES-NI), making it the best approach for maintaining performance while meeting the broad requirement.

Answer

Use database encryption to protect sensitive data.

Answer

Apply network encryption using TLS for all data transfers.

Answer

Implement file-level encryption for sensitive files only.