ISC2 CC Practice Test 18 — 15 Questions

Question 1

A security administrator is selecting controls to protect the confidentiality of a database containing customer PII. Which TWO controls are most appropriate?

Accepted Answer

Access control lists. Access control lists (C) are appropriate because they enforce authorization by restricting which users, roles, or hosts may read the PII records, directly limiting exposure to only approved principals. Database encryption (D) is appropriate because it protects confidentiality at rest and, when applied to columns or tablespaces, renders the PII unreadable if the storage or backups are compromised. Hashing (A) is not suitable here because it is a one-way integrity mechanism, not a reversible confidentiality control for data that must be read back. Load balancing (B) and redundant power supplies (E) are availability controls and do nothing to prevent unauthorized disclosure of PII.

Answer

Hashing

Answer

Load balancing

Answer

Redundant power supplies

Question 2

A hospital's electronic health record (EHR) system must be available 24/7. The disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour. Which combination of backup and site strategy best meets these objectives?

Accepted Answer

Hot site with continuous data replication. A hot site with continuous data replication best meets an RTO of 4 hours and RPO of 1 hour because a hot site is a fully operational duplicate facility that can take over almost immediately, and continuous replication keeps data loss well under 1 hour. This combination provides the lowest recovery time and data loss, aligning with the hospital's 24/7 availability requirement.

Answer

Cloud-based recovery with daily snapshots

Answer

Warm site with weekly full backups

Answer

Cold site with daily full backups

Question 3

A SOC analyst is reviewing logs from a web server and sees the following entry:
GET /../../../../etc/passwd HTTP/1.1
Which type of attack is being attempted?

Accepted Answer

Directory traversal. The log entry shows a GET request with '../' sequences attempting to navigate outside the web root to access the '/etc/passwd' file. This is the classic signature of a directory traversal attack, which exploits insufficient path sanitization to read arbitrary files on the server. The correct answer is C because the attack targets the file system, not the application's data layer or client-side scripts.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 4

An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?

Accepted Answer

Separation of duties. Requiring two separate approvals for a high-value transaction is the classic definition of separation of duties: no single individual has enough authority to complete a sensitive action alone. This prevents fraud and error by distributing control across multiple people.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 5

Which of the following is a security concern associated with the Telnet protocol?

Accepted Answer

It transmits data in cleartext.. Telnet transmits all data, including usernames and passwords, in cleartext, making it vulnerable to eavesdropping and credential theft. This lack of encryption is the primary security concern associated with Telnet. Other options do not accurately describe Telnet's security weaknesses.

Answer

It requires certificate management.

Answer

It is vulnerable to DNS poisoning.

Answer

It uses encryption that is too weak.

Question 6

Which of the following ensures that data has not been tampered with during transmission?

Accepted Answer

Hashing. Hashing ensures data integrity by producing a fixed-length digest from the original data; if even one bit changes during transmission, the resulting hash will differ, allowing the receiver to detect tampering. Common algorithms include SHA-256 and MD5 (though MD5 is deprecated for security). Hashing is specifically designed to verify that data has not been altered, which is the definition of integrity.

Answer

Redundancy

Answer

Encryption

Answer

Authentication

Question 7

Which TWO of the following are examples of physical access controls?

Accepted Answer

Biometric scanners. Biometric scanners (B) are physical access controls because they authenticate a person via a physical characteristic such as a fingerprint, iris, or retina before granting entry to a facility or device. Smart cards (C) are also physical access controls since they are tangible tokens used with a card reader to authenticate and unlock doors or restricted areas. Encryption (A) is a logical/technical control that protects data confidentiality, not physical entry. Intrusion Prevention Systems (D) and firewalls (E) are network-based technical controls that monitor or filter traffic, so they are not physical access controls.

Answer

Encryption

Answer

Intrusion Prevention Systems (IPS)

Answer

Firewalls

Question 8

During a security incident, the crisis communication team must notify stakeholders. According to best practices, which THREE groups should always be included in initial notifications? (Select THREE.)

Accepted Answer

Legal department. Legal department (A) must be included in initial notifications because they assess regulatory and contractual breach-notification obligations, preserve legal privilege, and guide the organization on disclosure requirements that may carry statutory deadlines. Internal management (B) is essential because executives and incident-response leadership need immediate situational awareness to authorize containment actions, allocate resources, and make business-impact decisions. Public relations (E) belongs in the initial notification group because they control the organization's external messaging, prepare holding statements, and prevent inconsistent or damaging communications while facts are still being verified. Affected customers (C) are typically notified only after the scope and impact are confirmed and legal/PR messaging is prepared, so they are not part of the initial internal notification wave. Law enforcement (D) is engaged selectively depending on the incident type, jurisdiction, and whether criminal activity or regulatory reporting mandates apply, so it is not always an initial notification recipient.

Answer

Affected customers

Answer

Law enforcement

Question 9

An organization wants to securely manage network devices from remote locations. Which of the following protocols should be used for command-line access?

Accepted Answer

SSH. SSH (Secure Shell) provides encrypted command-line access to network devices, ensuring confidentiality and integrity of the session. It is the standard protocol for secure remote administration. The other protocols either lack encryption or are not designed for command-line access.

Answer

HTTP

Answer

Telnet

Answer

FTP

Question 10

A company implements a policy that requires two employees to approve any financial transaction over $10,000. Which security principle is being applied?

Accepted Answer

Separation of duties. Separation of duties (SoD) requires that a sensitive task be divided among multiple people so that no single individual can complete it alone. Requiring two employees to approve any financial transaction over $10,000 is a classic SoD control that prevents fraud and errors by ensuring one person cannot unilaterally authorize a payment.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege

Question 11

Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?

Accepted Answer

The server is infected with malware. Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.

Answer

The server is being used for remote desktop access

Answer

The server is performing a port scan

Answer

The server is a legitimate mail server

Question 12

Refer to the exhibit. An SOC analyst pulled this log snippet. Which type of attack is most likely in progress?

Accepted Answer

DDoS attack. The log snippet shows a massive volume of incoming traffic from multiple source IPs targeting a single destination, which is characteristic of a distributed denial-of-service (DDoS) attack. The high packet rate and diverse source addresses indicate an attempt to overwhelm the target's resources, such as bandwidth or server capacity, making services unavailable to legitimate users.

Answer

Phishing

Answer

Man-in-the-middle

Answer

Insider threat

Question 13

A security administrator is concerned about MAC address spoofing on the network. Which technology can help mitigate this risk by associating a specific MAC address with a port?

Accepted Answer

Port security. Port security is the correct answer because it directly mitigates MAC address spoofing by allowing an administrator to statically or dynamically associate a specific MAC address with a switch port. When a device with a different MAC address attempts to use that port, port security can either disable the port (errdisable) or drop the traffic, preventing unauthorized access. This is a Layer 2 security feature that enforces MAC-to-port binding.

Answer

Dynamic ARP inspection

Answer

DHCP snooping

Answer

VLAN hopping prevention

Question 14

A company deploys a new intrusion detection system (IDS) on the internal network. Which of the following best describes the primary purpose of this system?

Accepted Answer

Detect and alert on potential security incidents.. An intrusion detection system (IDS) is a passive monitoring technology that analyzes network traffic or system activity for signs of malicious behavior or policy violations. Unlike an intrusion prevention system (IPS), an IDS does not take inline action to block traffic; its primary purpose is to detect suspicious activity and generate alerts for security personnel to investigate and respond.

Answer

Block malicious traffic in real time.

Answer

Encrypt sensitive data at rest.

Answer

Prevent unauthorized access to the network.

Question 15

Which TWO of the following are examples of administrative security controls? (Choose two.)

Accepted Answer

Security awareness training

Answer

Intrusion detection system

Answer

Firewall

Answer

Encryption