ISC2 CC Practice Test 17 — 15 Questions

Question 1

An attacker captures network traffic using Wireshark and reads unencrypted emails. Which security goal is most directly compromised?

Accepted Answer

Confidentiality. Confidentiality ensures that data is only readable by authorized parties. When an attacker captures unencrypted email traffic in Wireshark and reads the contents, the confidentiality of the email is directly compromised because the data was exposed in plaintext to an unauthorized party.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 2

Which layer of the OSI model is responsible for routing packets across networks?

Accepted Answer

Network layer. The Network layer (Layer 3) of the OSI model is responsible for logical addressing and routing packets across networks. Protocols like IP, ICMP, and routing protocols (OSPF, BGP) operate at this layer, using IP addresses to determine the best path between networks. Routers are the classic Layer 3 devices that forward packets based on routing tables.

Answer

Physical layer

Answer

Transport layer

Answer

Data Link layer

Question 3

A financial services firm has a data center that houses customer financial records. They have implemented a defense-in-depth strategy including firewalls, IDS/IPS, and encryption. Recently, an internal audit revealed that a junior administrator has been logging into the database server with a shared admin account and has made unauthorized changes to customer records. The company wants to prevent such incidents in the future while maintaining operational efficiency. The current environment uses Linux servers with PostgreSQL databases. There is no centralized authentication system. What is the BEST action to take?

Accepted Answer

Disable all shared accounts and implement individual accounts with role-based access control and audit logging. The core issue is the lack of accountability due to a shared admin account. Disabling shared accounts and implementing individual accounts with role-based access control (RBAC) and audit logging directly addresses this by ensuring each action is tied to a specific user, enabling non-repudiation and precise forensic analysis. This aligns with the principle of least privilege and is the most effective way to prevent unauthorized changes while maintaining operational efficiency through granular permission management.

Answer

Increase the frequency of password changes for the shared admin account

Answer

Use database encryption to prevent unauthorized changes

Answer

Implement a network access control (NAC) solution to restrict database access to specific IP addresses

Question 4

You are a security analyst at a mid-sized financial firm. The company has a policy that all remote access must be secured using a VPN. Recently, an employee reported that they were able to connect to the internal network from a coffee shop without using the VPN client. The employee accidentally left the client running but it was not authenticating. Upon investigation, you find that the network administrator had configured a rule on the firewall to allow RDP traffic from any public IP to a specific internal server for maintenance purposes. The rule was supposed to be temporary but was never removed. The server contains sensitive customer data. The incident has been reported to management. Which of the following is the most immediate corrective action you should take?

Accepted Answer

Remove the temporary firewall rule that allows RDP from any public IP. The immediate exposure is the overly permissive firewall rule allowing RDP from any public IP to a sensitive server, so the fastest risk-reducing action is to remove or disable that rule. This closes the attack path instantly without disrupting other services. Only after containment should broader remediation (audits, training) be pursued.

Answer

Disable RDP access on all servers

Answer

Conduct a full audit of all firewall rules

Answer

Implement a security awareness training program for all employees

Question 5

Which of the following is an example of a detective control in a security operations context?

Accepted Answer

Reviewing audit logs for suspicious activity.. Detective controls are designed to identify and alert on security incidents after they have occurred. Reviewing audit logs for suspicious activity is a classic detective control because it involves examining historical records to detect unauthorized access or anomalies. In contrast, preventive controls like patching, MFA, and firewall rules aim to stop incidents before they happen.

Answer

Installing a security patch to fix a vulnerability.

Answer

Requiring multi-factor authentication for remote access.

Answer

Firewall rules blocking unauthorized traffic.

Question 6

Match each phase of the incident response process to its description.

Accepted Answer

Preparation: Developing procedures, tools, and training before an incident.. The NIST SP 800-61 incident response process includes Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Options A, B, and C are correct; D and E swap definitions between the last two phases.

Answer

Eradication and Recovery: Conducting a post-mortem and applying lessons learned.

Answer

Post-Incident Activity: Removing the root cause and restoring normal operations.

Question 7

A company needs to enforce access based on attributes such as time of day and location. Which access control model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the correct choice because it evaluates policies based on multiple attributes (e.g., time of day, location, user role, device type) at runtime. This allows fine-grained, context-aware access decisions, such as permitting access only during business hours from a corporate office. ABAC uses a policy engine to evaluate attribute-based rules, making it ideal for dynamic environments where access depends on environmental conditions.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 8

A security analyst is prioritizing incidents based on severity. Which TWO factors are most important for determining incident severity?

Accepted Answer

Sensitivity of the data potentially compromised. Option A is correct because the sensitivity of the data potentially compromised directly drives severity: exposure of regulated or high-classification data (e.g., PII, PHI, cardholder data under PCI DSS, or trade secrets) raises the potential impact and therefore the incident's severity rating. Option C is correct because the number of users affected measures the scope and blast radius of the incident, and broader impact across more accounts or systems generally elevates severity. The type of operating system involved (B) is not a primary severity factor, since impact depends on the affected assets and data rather than the OS platform itself. The time of day the incident occurred (D) is contextual and may influence response logistics but not the intrinsic severity. The color of the server room (E) is irrelevant to incident severity.

Answer

Type of operating system involved

Answer

Time of day the incident occurred

Answer

Color of the server room

Question 9

An organization classifies data as 'confidential' and requires encryption at rest and in transit. Which data classification level is likely being used?

Accepted Answer

Confidential. The 'Confidential' classification level is the one that typically mandates encryption at rest and in transit. In standard data classification schemes, Confidential data is sensitive and requires strong protection, including encryption, to prevent unauthorized disclosure. The question states the organization classifies data as 'confidential' and requires encryption, so the level being used is Confidential.

Answer

Public

Answer

Internal/Private

Answer

Restricted/Top Secret

Question 10

Drag and drop the steps to implement a firewall rule allowing inbound HTTPS traffic into the correct order.

Accepted Answer

Step 1: Define source and destination zones. Step 2: Specify protocol (TCP) and port (443). Step 3: Set action to allow. Step 4: Save and apply the rule.. The correct sequence to implement a firewall rule for inbound HTTPS traffic is: first define the source and destination zones to control traffic direction, then specify the protocol (TCP) and destination port (443) for HTTPS, next set the action to 'allow', and finally save and apply the rule. Zones provide context, the port identifies the service, the action permits the traffic, and saving ensures the rule is active. Common mistakes include swapping the order of zones and port specification, setting the action prematurely, or saving before defining the action.

Answer

Step 1: Specify protocol (TCP) and port (443). Step 2: Define source and destination zones. Step 3: Set action to allow. Step 4: Save and apply the rule.

Answer

Step 1: Define source and destination zones. Step 2: Set action to allow. Step 3: Specify protocol (TCP) and port (443). Step 4: Save and apply the rule.

Answer

Step 1: Define source and destination zones. Step 2: Specify protocol (TCP) and port (443). Step 3: Save and apply the rule. Step 4: Set action to allow.

Question 11

During a vendor risk assessment, a company discovers that a potential vendor has poor security practices. The company decides not to hire the vendor. This is an example of:

Accepted Answer

Risk avoidance. Risk avoidance is the correct answer because the company eliminates the risk entirely by deciding not to engage with the vendor. By not hiring the vendor, the company removes the possibility of any security incidents or data breaches that could arise from the vendor's poor security practices. This is a classic example of risk avoidance, where the risk is sidestepped rather than managed or shared.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 12

A company’s backup strategy: Full backup every Sunday, differential backups Monday through Saturday. On Thursday, the system fails. How many backups are needed to restore the data?

Accepted Answer

Two: Sunday full and Thursday differential. With a full backup on Sunday and differential backups Monday through Saturday, a restore on Thursday requires the Sunday full backup and the most recent differential (Thursday). Differential backups capture all changes since the last full backup, so only the latest differential is needed along with the full.

Answer

One: Thursday differential only

Answer

Four: Monday through Thursday differentials

Answer

Five: Monday through Thursday differentials plus full

Question 13

Which phase of the incident response process involves actions to stop the incident from causing further damage, such as isolating affected systems?

Accepted Answer

Containment. Containment is the incident response phase focused on limiting the scope and impact of an incident — isolating affected systems, disabling compromised accounts, and blocking malicious traffic to prevent further damage. It occurs after detection and analysis but before eradication and recovery. The goal is to stop the spread while preserving evidence for investigation.

Answer

Eradication

Answer

Analysis

Answer

Detection

Question 14

An organization wants to ensure that system logs are tamper-proof after generation. Which control should be implemented?

Accepted Answer

Use a write-once read-many (WORM) storage device.. A WORM (write-once read-many) storage device enforces immutability at the hardware or storage-layer level, meaning once a log is written it cannot be altered or deleted for a defined retention period. This directly satisfies the requirement that logs be tamper-proof after generation, because even administrators with storage credentials cannot modify the data. It is the standard control for regulatory compliance frameworks such as SEC 17a-4, HIPAA, and PCI DSS that mandate immutable audit trails.

Answer

Compress logs before archiving.

Answer

Store logs on the local hard drive of each server.

Answer

Encrypt logs during transmission.

Question 15

After a security incident, the incident response team closes the case. What is the MOST important final step to improve future security posture?

Accepted Answer

Conduct a post-incident review and update policies. The post-incident review (often called a lessons-learned meeting) is the final step that analyzes root causes, identifies gaps in detection or response, and drives updates to policies, playbooks, and security controls. Without this review, the same vulnerability or misconfiguration could be exploited again, even if immediate containment steps like credential revocation or patching were performed. The goal is to close the incident with a feedback loop that improves the overall security posture, not just restore operations.

Answer

Revoke all compromised credentials

Answer

Patch all systems

Answer

Restore all systems from backup