ISC2 CC Practice Test 16 — 15 Questions

Question 1

Drag and drop the steps to recover a system from a verified backup after a ransomware attack into the correct order.

Accepted Answer

Step 1: Isolate the infected system, Step 2: Wipe the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.. Recovery requires isolation, backup verification, wiping, restoration, and scanning.

Answer

Step 1: Wipe the infected system, Step 2: Isolate the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.

Answer

Step 1: Isolate the infected system, Step 2: Restore data from the verified backup, Step 3: Wipe the infected system, Step 4: Scan the restored system for malware.

Answer

Step 1: Scan the infected system, Step 2: Isolate the infected system, Step 3: Wipe the infected system, Step 4: Restore data from the verified backup.

Question 2

A security policy requires that all changes to a production system go through a formal change management process with approval from a change control board. This is an example of which security principle?

Accepted Answer

Governance. Governance is the set of processes, policies, and controls that direct and oversee how an organization manages its systems and risks. A formal change management process with a change control board (CCB) that reviews and approves production changes is a textbook example of governance — it establishes oversight, accountability, and decision-making authority. The policy itself is the governance artifact, and the CCB is the governing body enforcing it.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 3

An organization has a policy that all servers must have security patches applied within 30 days of release. Which of the following is the best practice for patching?

Accepted Answer

Test patches in a non-production environment before deploying to production. Testing patches in a non-production environment first allows the organization to identify compatibility issues, performance regressions, or conflicts with existing software before risking production systems. This aligns with the change management principle of validating changes in a controlled setting, ensuring that the 30-day patching deadline can be met without introducing instability. Skipping testing (A) or applying patches simultaneously (B) could lead to widespread outages, while only applying critical patches (D) would leave the organization exposed to non-critical vulnerabilities that could be chained in an attack.

Answer

Skip patches that have not been widely tested

Answer

Apply patches to all servers simultaneously

Answer

Only apply critical patches

Question 4

An organization is adopting the 3-2-1 backup rule. They currently have data on a primary server and a daily backup to an external hard drive. To comply with the rule, what is the minimum additional requirement?

Accepted Answer

A cloud backup stored offsite. The 3-2-1 backup rule requires at least three copies of data, on two different media types, with one copy stored offsite. The organization currently has two copies (primary and external hard drive), both likely on-site and possibly the same media type. Adding a cloud backup provides the required third copy and satisfies the offsite requirement, making it the minimum additional requirement.

Answer

A second external hard drive stored on-site

Answer

An incremental backup to a network share

Answer

A full backup on tape stored in the same room

Question 5

An LDAP distinguished name is written as: CN=John Smith,OU=Sales,DC=company,DC=com. What do the 'OU' and 'DC' components represent?

Accepted Answer

OU = Organizational Unit; DC = Domain Component. In LDAP distinguished names, OU stands for Organizational Unit and DC stands for Domain Component. These are the standard RDN attribute types defined in RFC 4519 and used to build hierarchical directory paths, so option A is the correct expansion.

Answer

OU = Organizational Unit; DC = Domain Controller

Answer

OU = Organizational Unit; DC = Distinguished Component

Answer

OU = Object Unit; DC = Domain Component

Question 6

An organization uses a layered security approach: perimeter fencing, access badge readers at building entrances, biometric scanners in server rooms, and cable locks on laptops. This strategy best exemplifies which access control concept?

Accepted Answer

Defense in depth. Defense in depth is the practice of layering multiple independent security controls so that if one fails, others continue to protect the asset. The scenario describes physical controls at progressively deeper levels — perimeter fencing, badge readers at entrances, biometric scanners in server rooms, and cable locks on laptops — each adding a distinct barrier. This layered approach is the textbook definition of defense in depth.

Answer

Need-to-know

Answer

Least privilege

Answer

Separation of duties

Question 7

Which process involves verifying the identity of a user who claims to be a specific person?

Accepted Answer

Authentication. Authentication is the process of verifying that a user's claimed identity is genuine, typically by validating credentials such as a password, token, or biometric factor against stored data. It answers the question 'Are you really who you say you are?' and occurs after identification but before authorization. This is the core definition tested in the CIA triad's access control model.

Answer

Authorization

Answer

Identification

Answer

Accounting

Question 8

A security administrator is configuring user permissions and ensures that each user has only the minimum rights needed to perform their job. Which access control principle is the administrator applying?

Accepted Answer

Least privilege. Least privilege means granting users only the minimum permissions required to perform their job functions — nothing more. The administrator is explicitly ensuring each user has only the rights needed, which is the textbook definition of least privilege. This principle limits the blast radius of compromised accounts and reduces accidental or malicious misuse of permissions.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 9

An organization uses Active Directory to manage user accounts. Which protocol does Active Directory primarily use to query and modify directory services?

Accepted Answer

LDAP. Active Directory primarily uses LDAP (Lightweight Directory Access Protocol) to query and modify its directory services. LDAP defines the structure and operations for accessing directory information, and AD implements LDAP v3 as its core access protocol on port 389 (and 636 for LDAPS). Administrative tools and applications use LDAP queries to read and write user, group, and computer objects.

Answer

HTTP

Answer

FTP

Answer

SNMP

Question 10

What is the difference between identification and authentication?

Accepted Answer

Identification claims identity; authentication proves identity. Identification is the process of claiming an identity, such as providing a username. Authentication is the process of proving that claimed identity, typically by providing a password, token, or biometric. Therefore, identification claims identity, and authentication proves it.

Answer

Identification proves identity; authentication claims identity

Answer

They are the same thing

Answer

Identification uses passwords; authentication uses biometrics

Question 11

A bank implements a policy that requires two different employees to approve any wire transfer over $10,000. One employee initiates the transfer, and another approves it. This is an example of which access control principle?

Accepted Answer

Separation of duties. The policy requires two different employees to approve wire transfers over $10,000, with one initiating and another approving. This is a classic example of separation of duties, which ensures that no single individual has the authority to complete a critical task alone, thereby reducing the risk of fraud or error. By splitting the task between two people, the organization enforces a system of checks and balances.

Answer

Need-to-know

Answer

Least privilege

Answer

Defense in depth

Question 12

A company is implementing separation of duties for financial transactions. Which of the following are examples of this principle? (Choose TWO.)

Accepted Answer

One employee creates a purchase order, another approves it. Option A is correct because separation of duties requires that no single person controls an entire transaction; having one employee create a purchase order while a different employee approves it splits the critical functions of initiation and authorization. Option B is correct because requiring two managers to approve any payment over $5,000 enforces dual control (two-person integrity), ensuring that high-value transactions cannot be executed by one individual acting alone. Option C is incorrect because allowing a manager to both initiate and approve a wire transfer concentrates incompatible duties in one person, which is the exact opposite of separation of duties. Option D is incorrect because sharing the same password for the accounting system destroys individual accountability and non-repudiation, and it is a poor authentication practice rather than a separation-of-duties control. Option E is incorrect because read-only access to financial reports is an example of least privilege, not separation of duties, since it does not divide transaction responsibilities among multiple people.

Answer

A manager can both initiate and approve a wire transfer

Answer

All employees use the same password for the accounting system

Answer

A user has read-only access to financial reports

Question 13

Which protocol is considered insecure because it transmits data in cleartext, including passwords?

Accepted Answer

Telnet. Telnet is considered insecure because it transmits all data — including usernames and passwords — in cleartext over the network, with no encryption whatsoever. Anyone with access to the traffic path (via packet capture or MITM) can read credentials directly. This is why Telnet has been replaced by SSH for remote administration.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 14

Which of the following is an indicator of a phishing email?

Accepted Answer

The email includes a link that directs to a website with a domain similar to, but not exactly, the company's official domain. A link pointing to a domain that closely resembles—but is not exactly—the company's official domain is a classic phishing indicator (typosquatting or homoglyph attack). Attackers register lookalike domains to deceive users into entering credentials or downloading malware.

Answer

The email has a professional signature with contact information

Answer

The email comes from a known colleague and contains a file attachment they mentioned earlier

Answer

The email is sent during regular business hours

Question 15

An organization wants to allow external users to securely access internal web applications. Which network security device is specifically designed to inspect HTTP/HTTPS traffic and block malicious requests?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic at Layer 7 and applies rules to block attacks like SQL injection, cross-site scripting (XSS), and malicious bots. It understands web protocols and can examine request bodies, headers, and cookies, which is exactly what is needed to protect internal web applications exposed to external users. This makes WAF the purpose-built device for the scenario.

Answer

Stateful firewall

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall